move webhook processing to leader only

- also move locks into constructor rather than protected, non-final
access
- change enabled / abort to use methods
That constructor will only ever be called if a lock is present. Make it take the lock directly and have it wrap in an optional here. Also, add a checkNotNull(). :-)