Experimenting with http signature auth, more work on API