Clarify the get_user API

* Add timestamp (how did I miss that?!)
* Clarify how the hash should be signed