Optional authentication on webhook

So that we know that the callback came from Cuttlefish and not someone else pretending

This could be a more elegant way to do it: http://progrium.com/blog/2012/12/17/http-signatures-with-content-hmac/

Which means that Cuttlefish is always doing the same thing and it's up to the client app to be more paranoid if it wants to be.