Adding test for Session::read() with HMAC strategy on non-existent key.

Proves #1111.
Fixing Session::read() with HMAC strategy on non-existent key.

Fixes #1111.
Form::sign() shouldn't include 'label' fields. (mentioned in issue #998 part 1)
Merge pull request #1132 from koushki/bug/LabelInFormSign

Fixing FormSignature::check() when 'label' is added with form helper
Deprecating `Download` shorthand header.

Updating tests; moving location test into other existing method.

We should strive for as little magicness as possible. But when
we provide convience methods they should entirely cover the case.

With forcing content download there's already some additional preparation to do
which we also didn't catch here i.e. setting Content-Type to application/octet-stream.

The magic Download header was never supported when passing headers as an array.
Making form signature tests not depend on string algo.
Making `String::compare()` param order similar to `hash_equals()`.

This is the 1st step in replacing `String::compare()` with the native
`hash_equals()` in the future. It doesn't change behavior but makes
signature and documentation more similar.

- Changing order in which strings for comparison are passed
  to `String::compare()`.

- Also clarifying documentation to indicate which string must be user-supplied
  and which one is known.
Error if params are not string in String::compare; BC Break.
Use native hash_equals if available.
Adding more FormSignature tests. Proves 2. of #998.
Fixing test where FormSignature would fail on fields.

Fixes 2. of issue #998.

Refactoring into symmetric compile/parse methods.
Adding test for security helper sending correct signature fields.
Make excluded fields part of form signature.
Fix form signature where locked would be included in fields.
Merge pull request #1137 from davidpersson/bug/form-sign-fixes

Multiple form signing fixes
Merge pull request #1138 from davidpersson/feature/native-hash-equals

Making String::compare similar to hash_equals and use native function if available.
Merge pull request #1134 from davidpersson/qa/deprecate-download-header

Deprecate `Download` shorthand header.
Excluding '_method' input when http method is like PUT.