Unauthenticated endpoints
Looks like users are accessible without authentication:
server_1 | [14/Apr/2020 17:45:48] "GET /projects/ HTTP/1.1" 403 117
server_1 | [14/Apr/2020 17:45:48] "GET /customers/ HTTP/1.1" 403 117
server_1 | [14/Apr/2020 17:45:48] "GET /circles/ HTTP/1.1" 200 184
server_1 | [14/Apr/2020 17:45:48] "GET /circles/joinable/ HTTP/1.1" 200 193
server_1 | [14/Apr/2020 17:45:48] "GET /users/ HTTP/1.1" 200 1169
server_1 | [14/Apr/2020 17:45:48] "GET /customers/ HTTP/1.1" 403 117
Need to test all endpoints.