Pusher is an amazing service for quickly integraing realtime behaviour into an app.
All client events have to be authenticated on your server before they'll send any data. Then (and this is the gotcha which held me hostage for more than a little while), you have to ensure that all client events (i.e. events you send from the browser), start with a
client- prefix. Without this, it's not going to work.
As usual, it's all in the documentation.