Signature verification

This fixes a security flaw in the `parse_signed_request` function. I'm not the only one to encounter issues with this code - see http://stackoverflow.com/questions/24463410/bigcommerce-fail-to-verify-the-load-callbacks
`hash_equals` only exists in php 5.6+
We should note that in the README or pull in a compatibility lib (`t-richards/hash_equals ` looks good)