s4:remote RPC - make this one "signed-safe"