Chris I've implemented strict content type check for REST/RPC endpoint in Java shindig (see http://codereview.appspot.com/28042/show). The next thing Id like to figure out the variance between Java and PHP Shindig for body signing, in particular what happens currently in PHP to the signature base string when the content type is application/x-www-form-urlencoded but the body is JSON. For backwards compatability the Java implementation will need to do the same thing when the new content signing mechanism is not being used.
-Louis
