You're only using SSL which protects you vs relay attacks (it's doing its own MAC). Authentication is being done through the HTTP request Authorization header and the attached pre shared key.

Use SSL only, tune ciphers and you're good. You're wasting time trying to overthink the problem by adding another layer on top.