No authorization check in EncodingFilter for dsFullMetadata.page if cswUrl and cswProfileId parameters present.
Merge branch 'develop' of https://github.com/Esri/geoportal-server into develop