Authorize arbitrary notification creation

Adds authorization checks to prevent arbitrary notification creation.