More restrictive header normalization
Properly implement KeybarApiSignatureAuthentication.authenticate_header, update tests, fix error message on wrong device id.