Server: auto-reject unauthenticated global requests
Server: return push() value where possible
Server: pass nothing for channel requests with no extra info
readme: first go at documentation rewrite