When test in Web Chat, it doesn't include an authorization header in the request to the bot. However, the downloaded project contains below logic, that returns Unauthorized response in this case. You can remove this logic in order to test in Web Chat.

if (!req.headers.authorization && process.env.RUNNING_ON_AZURE === '1') {
    return res.send(401, 'unauthorized');
}