Update:
	- eventConsumer.ktr *must* always relate to a user (read: must receive a param 'user' and do a query for that user's notifications *only*)
	- surround rest call cns/api/do/notify/all with administrator priviledges: only admin may do an operation that could potentially be misused as spam
	- moved getNotifications.ktr / setNotifications.ktr to outside endpoints/admin folder, as to allow users like 'suzy' and 'pat' to be able to use them