I can invoke equivalent of http 'POST /events' via zcap invocation

[gobengo]

so we can accomodate authz use cases via delegation and also avoid sever-side shared secrets