Added HMAC signature checking

This is the last big step in making sure this is reasonably secure.  I'd like to add
HTTPS at some point, but then you get into all kinds of cert issues.  At least for public
repos, I think this should be fine (if anyone disagrees, pull requests are welcome).

I was originally using a middleware for Martini to do the GitHub signature checking,
but it stripped the body of the request out, so that kind of spoiled things.  So I
integrated the check into my code.  Computing the HMAC isn't that hard and I was
doing it anyway for my test case.