short circuiting signature checking in other places for http-redirect