gets hmac from query string instead of header