CAS email lookup service needs to be secured

[stevec]

The "email lookup by GUID" service on CAS needs to be restricted either to internal PLoS ONE servers only or to the user making the call. Seems like we can make use of the PGT and wrap a call to the verification servlet, take the GUID, to the lookup, and pass back the email.

[amit]

Steve, assigning this back to you. I think we have taken care of this, but just to be sure.

[stevec]

no, this has not been taken care of.

[anonymous]

Milestone Bugs deleted