big refactor.

should now verify HMAC signature