initial http auth body and signature checking spike

Checks the hmac msg signature, body md5 hash, client time, app id, and
app key.
Code currently breaks the request.body read, and the validation needs to
be split out into its own file/package and refactored heavily before
being ready to merge.