There is no way for a detector to tell the source of a change among: 
xmlrpc, rest and web interfaces. Currently they all end up setting 
tx_Source on the database object to "web".

We distinguish between email submission methods.
We differentiate pgp signed vs unsigned email mechanisms.
These corresponds to different security/authentication levels.

All the web endpoints have the same authentication level (password).

Ralf believes this may be useful. I am not quite so sure.

Quips, comments, evasions, questions or answers?

Still a little dubious that this is worth it. People want to be
able to restrict who can do what via the rest interface.
This is a valid addition to those use cases.

Done on rev5881:9938c40e03bc