Auth adapter should prioritize pulling header values from params

[coleshaw]

The auth adapter should, in approve_hmac, prefer header values from the body instead of the query params, since sometimes the query params might get mungled.