title: Securing REST API using signature
body: <p>I have some problems to understand how to secure REST API. 
  When a client sign up, the password is hashed and sent to the server through HTTPS.
  Then, the server store hash(password+privatesalt).</p>
  
  <p>When the client consumes a rest service, he creates the request and a signature HMAC-SHA1 with his own password (like <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/S3_Authentication2.html" rel="nofollow">here</a>). 
  Server side, how to sign the request to compare with the client signature if the password is hash-salted in the database ? </p>
  
  <p>I know the data appears in clear over the web, but I just want to authenticate the user.</p>