added signature verification (usually not really needed by the SP but
the IdP)