ministryofjustice/opg-lpa-api — pull request #22 by robmckinnon (2013-12-03 12:27:55+00:00)
Title: Cannot access another person's LPA

* Uses 'X-USER-ID' header to find authenticated user's email
* On applicant creation, sets applicant's email to be authenticated user's email
* Uses authenticated user's email for authorisation
* GET applicant when authenticated user is not the applicant returns 403 Forbidden
* GET lpa when authenticated user is not the applicant returns 403 Forbidden
* Applicant response JSON no longer contains email