Use urls from the event payload instead of hardcoding urls

* so it works on both dw-free/dw-nonfree (also so that there's no need
  to change when testing vs in prod)

* send Authorization header instead of sending the token via the URL

* tweak the %GITHUB hash format, because we already have a %GITHUB hash
  -- so put the token and shared secret into %GITHUB{api}