update webhooks to use injectable sessions