The token was compared with != (timing leak), and an app with no webhook_token accepted a request that sent none, since None != None is false. Require both tokens and use hmac.compare_digest.
