move webhook processing to leader only

- also move locks into constructor rather than protected, non-final
access
- change enabled / abort to use methods