Actually, I think this satisfies my question above, but a test with a header that is explicitly non-hashed, non-base64-encoded would be nice. Just to test the edge-case, of course.