Webhooks: advanced security

Current webhook auth relies on query/basic auth which is less secure.

Enhance webhook security with passing auth tokens in headers or/and implementing signed requests.