subscription auth handled correctly

event subscription fails without the correct permissions, and when
a user is logged out, they are unsubscribed from things they don't
have permissions for. client automatically resubscribes when
permissions change.