[fix bug 835781] Implement session based authorization.

* Add the ability to authorize API requests depending on current user session
* Expose bugzilla email as a restricted field