adding signature to card, initial commit. this code fails.

In the test, I use setupAccount() utility function from test/account.js - the session is somehow undefined when passed into the Card constructor. Wtf?
We should also protect against malformed input, not just the lack of it. How does the `sign()` function below behave if I pass in a string?