To validate the ticket, it looks inside the ticket at the user ID, the timeout date and it checks the signature. HMAC is a lightweight symmetric-key signature. Symmetric keys are OK because the same person is generating and checking signatures. Data plus signature equals proof that "I earlier permitted this". I don't need to remember it in the interim.

A forged request can't guess the HMAC key, and a forged request with an invalid key is refused. A replay is disallowed after the timeout. The server can also keep track of "spent" tickets until they would have timed out, preventing a replay even during the timeout period.