Signed webhook receiver. POST to /hook.