Verify acuity webhook

[olivernyc]

We need to verify acuity message signatures to make sure they are not forged. https://developers.acuityscheduling.com/docs/webhooks

// Get hash of message using shared secret:
var hasher = crypto.createHmac('sha256', secret);
hasher.update(buf.toString());
var hash = hasher.digest('base64');

// Compare hash to Acuity signature:
if (hash !== req.header('X-Acuity-Signature')) {
    throw new Error('This message was forged!');
}