Use HMAC secret for Github request verification