Consider if we have a security issue when specifying action without `type`

[kjellmorten]

Most actions will have payload.type, but if you specify a targetService you may not be required to. However, the authorization uses payload.type to check what auth schema to use, and no type means no authorization.

This should be addressed.