don't verify signature every api request

[Geczy]

this is expensive and it runs way too often

we should cache the signature against the hash either in the db or in memory