documented HTTPS requirement for webhookEndpoint not enforced with validation marker
