HMAC webhook validation