Add ability to require client request signing

[saintberry]

I'm not sure if anyone is interested in this functionality but will add a PR in case people are.

I've added the ability to force clients to pass a signature in with all requests.

This is a cheap way to validate that requests are coming form trusted sources. It's not completely foolproof and is a bit of security through obscurity however it will stop someone from looping through every possible modifier and requesting sizes that differ by 1px. This would put a lot of load on the server and if done by a botnet could DDoS the service.

Simply set a REQUEST_SIGNING_KEY to be a long string. Share this key with your clients and the algorithm used to create signatures.

If image-resizer sees that a REQUEST_SIGNING_KEY is set it will compare the signature with the requested image/modifier options and make sure there is a match. If no match is found a 404 is returned.

I've also changed image.js to return a 404 if a request comes in for an unsupported format. This seems more logical to me than returning a 500.

[jgillman]

👍 This is a feature I would use!