Implement Server-Authorization header and configuraion directive

[algermissen]

Hawk specifies a header Server-Authorization that the server can use to sign its responses. Clients can use that header to determine that a given response has not been modified by an attacker.

This header is not a necessity for the use of the module in the OTTO context, yet, but at some point it should be implemented.

There should be a configuration directive to switch Server-Authorization generation on or off in the nginx config.