#hmac

Webhook receiver saved the signed bytes, then hashed a copy it rewrote

A new webhook receiver kept the exact bytes the sender signed and then checked the signature against re-encoded JSON instead. Review caught it and one line fixed it, but the branch that lets unsigned events through is still there.