fixed two errors in the webhook

The webhook had a minor bug which could lead to a path-disclosure if errors were not hidden (line: 221)

There was also a minor bug if there was no payment_id (lines 225/226, headers_already_sent) which lead to a path-disclosure and the wrong headers being sent.