Invalid Signature in Services Oauth
Once I figured out that the access log was different than the $_SERVER variable, I called my hosting provider and discovered that their servers are only configured to allow GET and POST (haven't checked HEAD). 

So I invented this hack to use the header, since it seems that Apache just transparently changes unrecognized methods to GET.

if( isset($_SERVER['HTTP_X_REQUEST_METHOD']) &amp;&amp; $_SERVER['REQUEST_METHOD'] === 'POST' ) {
    $_SERVER['REQUEST_METHOD'] = $_SERVER['HTTP_X_REQUEST_METHOD'];
}