add validation of hmac