authenticate callback signature. Closes #1281