webhook validation: use time-constant compare
Merge pull request #41 from freewil/scmp

webhook validation: use time-constant compare