Metadata for mutation callbacks

[thomaslove]

Can we have an optional extra field on action to be able to set a secret that we can validate on the webhook server's side. Github's implementation seems solid.

https://developer.github.com/webhooks/securing/

It just involves hashing the secret and attaching it to the "X-Hub-Signature" header when you make the POST request

[schickling]

Yes, that makes a lot of sense. I've added it to our roadmap: https://github.com/graphcool/feature-requests/projects/1

[marktani]

Setting a custom authorization header, or other headers, would be very useful as well

[marktani]

Closing in favor of #118.