message: apply verification middleware only on the webhook endpoint
diff: @@ -101,31 +101,30 @@ function Slackbot(configuration) {
  // adds the webhook authentication middleware module to the webserver
  - function secureWebhookEndpoints() {
  + function secureWebhookEndpoints(webserver, endpoint, tokens) {
  var authenticationMiddleware = require(__dirname + '/middleware/slack_authentication.js');
  - // convert a variable argument list to an array, drop the webserver argument
  - var tokens = Array.prototype.slice.call(arguments);
  - var webserver = tokens.shift();
  slack_botkit.log(
  '** Requiring token authentication for webhook endpoints for Slash commands ' +
  'and outgoing webhooks; configured ' + tokens.length + ' token(s)'
  );
  - webserver.use(authenticationMiddleware(tokens));
  + webserver.use(endpoint, authenticationMiddleware(tokens));
  }
  // set up a web route for receiving outgoing webhooks and/or slash commands
  slack_botkit.createWebhookEndpoints = function(webserver, authenticationTokens) {
  -
  + var endpoint = '/slack/receive';
  if (authenticationTokens !== undefined && arguments.length > 1 && arguments[1].length) {
  - secureWebhookEndpoints.apply(null, arguments);
  + //botkit allows an array of tokens or multiple tokens as variable length params
  + var tokens = Array.prototype.slice.call(arguments).slice(1);
  + secureWebhookEndpoints(webserver, endpoint, tokens);
  }
  slack_botkit.log(
  '** Serving webhook endpoints for Slash commands and outgoing ' +
  'webhooks at: http://' + slack_botkit.config.hostname + ':' + slack_botkit.config.port + '/slack/receive');
  - webserver.post('/slack/receive', function(req, res) {
  + webserver.post(endpoint, function(req, res) {
  // respond to Slack that the webhook has been received.
  res.status(200);
  