Try add a line like this
<usertoken>bxv4tx_bjix_8xxxxxxxx</usertoken>
The Webhook actually runs under a userid and takes on that userid's permisisons. So decide what userid it will run under, and then sign on as that user and go to "My Preferences under the user's name at the top right and then
Manage User Tokens
That will give you a long code, similar to the App Token, but in this case it essentially logs in under that userid to execute the Webhook.
A consideration is to choose a userid which will perhaps out survive your personal access to the app. For example if you are an App Admin for a Company and you set up a bunch of obscure webhooks under you own userid and then choose not to be immortal, or at least choose not to be an employee for te next 100 years, then its a better idea to set up a Userid which will be owned by the IT department, and last longer than perhaps your personal access to the app.
Once that userid assciated with the Usertoken l no longer has access to the app, then it will fail.
