For more information about making data tamper-proof using HMACs see the paper "Dos and Don'ts of Client Authentication on the Web" by Kevin Fu et al. [1]. I've implemented the "FuCookie" and I use it everywhere.

[1] http://pdos.csail.mit.edu/papers/webauth:tr.pdf