verify the HMAC that GitHub sends