[gibybo]

Candy crush does this, and circumventing it was one of the points of the article. It is hashed with a secret key from the flash client. He just extracted the key from the client and started signing the requests himself.

[gknoy]

He signed the requests. I think they'd need some sort of way to ensure that the level's initial settings were also used.

[ry0ohki]

True, although it seems not all of the calls are like that, for example the number of lives.