Make webhooks CSRF exempt