Check if signature has a valid value in isValid Webhook function

Otherwise it's possible that the isValid() function evaluates to true if both the header is not set (and therefore the getHeader return false) and no JSON body is available (and therefore generateSignature() also returns false).

In this case it would be possible to execute code within a isValid() block called from an external source which normally would only be trusted from a Help Scout hook.