hint at the token being one from a webhook

took me a while to figure it out. This might make it more clear for other people who try to authenticate against Slack.