when publishing, authenticate with hmac-sha1