Exempt webhook from CsrfProtect