verify the request came from GitHub

The IPs came from GitHub's website.

Can't test it because I don't really want to make a git repo, set up a site, etc.