Require HTTP basic auth for github webhook

Previously, we only checked that X-Forwarded-For (set by Heroku)
contained an IP from a trusted range. However, GitHub recommends
HTTP basic auth:

https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist

Note that if you deploy this, you'll have to update your production.yml and change the Github WebHook URL to include the configured user/password (http(s)://user@password:.../...).