The client libs handle everything for you if you use fbml, since every request is proxied by facebook and has its own signature. If you use an iframe, like the Moods app and many other popular apps, requests go directly to your server, so you have to explicity include and validate a signature for each request.
It's still not terribly difficult, but most facebook app devs are trying to churn out apps and features so fast that there's no time for this kind of detail.
