protect webhook test endpoint behind api jwt auth.