bug fix: The Alipay return_url calls do not include the sign parameter.

Only validate the sign parameter if it's included or if the request
includes the notify_id parameter too.