get codec from secure-scuttlebutt/defaults
invalid authorization request is denied
use hmac module
actually test client auth stuff
better error messages
use a proper hmac function
config.pass no longer used