validate HMAC signature during callback phase