secure botToken

[IPdotSetAF]

• remove bot token from webhook route (the route does not get encrypted so the bot token will be leaked)

[IPdotSetAF]

• bot token will be transmitted through header instead of secure key