pubsub sender validation

[will-rowe]

At the moment pubsub messages from any sender are checked - maybe there should be an 'approved sender list' or something.