stop CSRF in webhooks