JC-1634: fixed unauthorized access to /outbox/