Exports: Security Issue

[jamlung-ri]

There was a Private collection that I cannot access via API (as expected), but I can access it by adding export to the end. Should this be allowed without authorization? Loom video as an example.

One potential dependency - does this affect the OpenMRS subscription module? Will they now need to input an API auth token? That might break some implementations for a bit. @paynejd has messaged OpenMRS squad to find out.

Edit: OpenMRS Subscription Module requires an API token, so this change should not affect them. We should be clear to move this forwrard.

[snyaggarwal]

this is deployed on all environments

[jamlung-ri]

This is working well!