Excluded webhooks from CSRF protection

The webhooks already use a token to verify that any third parties have
access to the webhooks. Thus, CSRF protection is not necessary.