Pulled out the header authentication so that client apps can use it to validate signed jive requests from apps.