func Sign(message string) string
Sign a given string with the app-configured secret key. If no secret key is set, returns the empty string. Return the signature in base64 (URLEncoding).
func Verify(message, sig string) bool
Verify returns true if the given signature is correct for the given message. e.g. it matches what we generate with Sign()