ack, access token requests need to be signed by the request token secret.
hmacSignedMiddleware now takes an 'isInitialRequest' option.
move common functionality into lib/model/util.js.