Cleanup webhooks

* fixed existing webhook tests
* removed index.js and made lib/index.js the main in package.json
* fixed `createHooks` logic (response.status is undefined) and added some tests
* made `verifySignature` use constant-time string comparison to protect against timing attacks and added tests