Notifications System core

Following https://issues.cask.co/browse/CDAP-849 jira and design doc.
Build is running at https://builds.cask.co/browse/CDAP-DUT320-3.
Do we need to guard against this public access when we have internal auth? We can simply block calls from router context, right?