Authorization pass

[diggyk]

Hermes currently does very poor authorization. Some event-types can be designated such that the CLI/WebGUI won't try to throw them but the authz happens at the client layer and not the API layer.

Also, nothing prevents a person from throwing cancel events against a quest they don't own. By design, it was never assumed such restrictions should exist because the event system wasn't designed to restrict what could throw events and what types of events it could throw, and the quest/labor system just responds to those events.

But upon further reflection, some better care might be good here. It would take significant amount of work to accomplish this.

• machine validation: when kerberos is deployed, it would be possible to restrict only machines to throw events about their themselves, or authorized agents. This would be better than the restrictions that happen at the CLI layer b/c the API could authenticate the caller and see if they are approved to throw certain events.
• only-if-applicable: certain events like cancel events should probably only be allowed if there is a labor for the host and that labor was the result of a quest created by the user,