[api] avoid one DoS warning
[api] missing pieces for bugowner notifications
[api] request state can not be a login name...