[fix bug 835781] Implement session based authorization

* Add the ability to authorize API requests depending on current user session.
* Expose bugzilla email as a restricted field.