Is there any standard regarding how a Webhook should be secured? I can either add an oAuth layer, or some other mechanism like JWT that is created using a shared secret betw