Stripe event handling doesn't verify the source

[alexgmin]

djangoproject.com/fundraising/views.py

Lines 196 to 201 in 5537f96

	# For security, re-request the event object from Stripe.
	# TODO: Verify shared secret here?
	try:
	event = stripe.Event.retrieve(data["id"])
	except stripe.error.InvalidRequestError:
	return HttpResponse(422)

Instead of calling Stripe with the event id it should verify the source of the event and prevent replay attacks as indicated here
https://docs.stripe.com/webhooks#verify-events

The Stripe library already has a method to do this https://docs.stripe.com/webhooks?lang=python#verify-webhook-signatures-with-official-libraries

[bmispelon]

@alexgmin I've opened a PR for this: #1770

Does that seem ok to you?