Actually, the more fundamental issue here is why they're signing requests. They likely don't understand why, and don't need to, so the usual fix is "stop signing requests". -- Scott