rest HMAC authentication