HMAC authorization must MD5 hash the actual body content

Should not require or trust the Content-MD5 header for calculating the hash