HMAC Authorization header compatibility about multibit-merchant

[gary-rowe]

There are some minor issues with the Warden HMAC algorithm documentation. I have elected to ignore query-based authentication since it exposes authentication details in a manner that could be shared as a permalink. Also the query-based authentication breaks caching since every request is unique if a short TTL is included.

I have some issues with the inclusion of all headers on the server side since it is possible that intermediary servers could add headers to the request that are unknown to the client and render the signature void. However, the server should be aware of those headers and strip them out during the creation of the canonical representation.