The purpose of this class is to enable me like a *viewer* to check the status of *John* has authorization to some endpoints? 

Looking at this piece of code:

    if(loginName != null){
        return Response.ok(userService.findUserByLoginName(loginName.get())).build();
    }

I can read that "Bob the evil" like a *viewer* could know informations about *John*. Is that true?