Merge pull request #9 from google/env

Allow using env variable for passing credentials. Fixes #8.
Verify Github webook secrets. Fixes #1

This ensures that the hooks actually come from Github, see:
  https://developer.github.com/webhooks/securing