no word about request integrity - http-cavage, - [IETF Draft HTTP Message Signatures](https://datatracker.ietf.org/doc/draft-ietf-httpbis-message-signatures/), - [AWS Signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) a strategy to prevent replay attack ?!?