This was needed to prevent sig fails when query params are involved. Weirdly even though with express I was seeing the exact same signature as with restify with express it was failing until query params were used to create the sig.

oauth-client which provides the signing does this in their request-signing so this was all lifted from there.