don't use arbitrary order when creating Authorization header

The spec doesn't say it explicitly but at least in
[https://github.com/etoccalino/django-rest-framework-httpsignature](this
project) they assume the order of the parameters should be the order of
appearance in the spec. Maybe the spec needs to be more explicit.