Currently it just checks that the POST came from Phabricator in general. But it should be checked using the HMAC which I was able to get to work some of the time before.