- when signing make h_auto the default to get secure header protection
- h_auto and h can be given together when signing and h can include additional
  headers not automatically added using h_auto