but the parameter is now being removed if it is present, so it is not being passed to validate_signature, so this method will always return false.  This isn't just for legacy auth.