For Facebook fbml Apps Facebook is sending in a signed_request parameter explained here:
http://developers.facebook.com/docs/authentication/canvas
They have
Alternative to @dae.eklen's solution, you can append === to it:
===
s = 'iEPX-SQWIR3p67lj_0zigSWTKHg' base64.urlsafe_b64decode(s + '===')
This works because Python only complains about missing padding, but not extra padding.