Simplify controller notification

[pLeminoq]

A nice workaround to #101 could be that the notification does not contain data but only tells the remote to make a request. This way, the unauthenticated case would be equal to the authenticated one.

[pLeminoq]

The suggested implementation has the problem of a self-enforced DDOS attack if there are many remotes. If we implement #110, we should skip this.