Should close #1426, and possibly #1440.
All requests for Mastodon users must be signed if the server is running in secure mode. In situations where there is no active user it's best to sign them with the relay user instead of leaving them unsigned.