Badge instances schema.
Whitespace
Move webhooks into own schema/model, add webhook secret.

We want to be able to sign our webhook requests so the other end can
verify the request is coming from a trusted source. Our plan is to
generate a unique shared secret for each registered webhook. This secret
will be used *only* for signing outgoing webhook requests.
Can create badge instances and get the assertions.
Rearrange sql clauses.
Fix test data.
Can create a valid badge assertion.
Fix broken program test
Make images public
Exempt /public/* urls from auth
Test for criteria.
Call system webhook when a badge is awarded.