anchor.diff:  signature itself from the values you generate the signature over for
   verification. If the incoming message is
   
  -```
  -b=1&a=2&c=3&h=V5FkMYr9GCG9tQA9ihuuybWl99U=
  -```
  + b=1&a=2&c=3&h=V5FkMYr9GCG9tQA9ihuuybWl99U=
  +
   
   make sure to remove h before verifying:
   
  -```
  -b=1&a=2&c=3 
  -```
  + b=1&a=2&c=3
   
   Don't forget to sort the key/value pairs.
   
  -## Verification
  +== Verification
   
   There is one call to verify YubiKey OTPs: verify.
   
  
positive.code: signature or use HTTPS connections (and verify the server
  certificate).
  
  ## Generating signatures
  
  The protocol uses HMAC-SHA-1 signatures. The HMAC key to use is the
  client API key.
  
negative.code: 
  | REPLAYED_REQUEST 
  | Server has seen the OTP/Nonce combination before
  |===
  
  == Changes since version 1.1
  
  The verify URL has changed.  In the request, the new required field
  "nonce" were added, and the new optional fields "sl" and "timeout" are
  