webhooks: panic on nested webhook auth case

This is not strictly speaking necessary since we have a panic which
immediately follows the switch, but it is cleaner.

webhooks: initial prototype for GQL-native webhooks