Assertion must be signed if HTTP POST binding is used #17