fix `createHooks()` logic for non-201 responses
constant-time string compare in `verifySignature`