[api] rework how subscriptions work

We need to be able to have multiple roles per event - and ignore
them for users