Require HTTP basic auth for github webhook

Previously, we only checked that X-Forwarded-For (set by Heroku)
contained an IP from a trusted range. However, GitHub recommends
HTTP basic auth:

https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist