Allow for the configured mechanism for a web app to be the named mechanism for programatic authentication.

Also a minor update to the notification API to identify notifications caused by programatic events.
fix a few typos