The evidence: call backs to event listeners are not run with the service's logged in subject, this prevents secure endpoints from establishing connections for call backs.
I have rectified this in my local code and am running tests. Just thought you might be interested to know. Regards, Peter.