Authorization for Spin components #60
Description
Currently, there is no concept of authorization in Spin.
A component is invoked whenever its trigger receives a request, and at no point is checked where the event is coming from, or who generated it.
How should this work?