don't sign body when not form-urlencoded

see issue #4.

note: this is only tested for one oauth endpoint!