Web 2074 secure api

- ignoring body in signature
- reading authorization header if provided per oauth spec