Added HMAC auth strategy for GET requests

Also completed the HmacOrLocal strategy, a middleware which checks
first for an authorization header and if found uses the HMAC strategy
for authentication, otherwise uses the local strategy. This allows
for API consumption from either a web app or a mobile app.