webhook validation: use time-constant compare