subscription POST and DELETE require signed header