Allow non-GET query based HMAC verification

We should not assume the request method is GET when verifying the HMAC
signature of a query-based authorization. Especially not when the
provided Faraday middleware specifically sets the method to the request
method when generating the signature to send with the request. This
prevented any non-GET requests from being validated.