Our documentation on the way WebHook payloads are signed claimed to use SHA-1

hashes for HMAC, but in reality, we were using MD5. This is because we were

failing to pass in the hash method to the HMAC library.

Ran unit tests.