authorization for replication

Here the client connects, authorizes, and then replication starts only after the remote has authorized, and only if they authorized as a peer.

This also makes it easy to support adding additional remote keys to a scuttlebot (so we can have a bot that multiple people could post from, for example), and this also leads directly to having applications or web sites that may log in to your scuttlebot instance.
Yeah I get that. What I didn't see was the permissions call that preceded this return statement. It looks like it can be L124 (`rpc.permissions({allow: ['createHistoryStream']})`), but that's not guaranteed to be hit.