call server.shudown when shutting donw
add test case for invalid signature
use secure_compare to prevent timing attack