Summary of security-related issues

[CarlosNZ]

There's a lot of security-related issues outstanding that need to be addressed, so let's write them all in here as we remember them (and tag them with issue if created)

• Restrict access to REST endpoints (some will need to be more locked down than others, but all should require at at least a valid JWT) Authentication for REST endpoints #458 #458 Authentication for REST endpoints #607
• Need a way to add authorization headers to API/GraphQL queries in evaluator (should it be specified per query, or in code?) Evaluator: find a (secure) way to provide authentication in API/GraphQL requests #379 #379 Authentication in Evaluator #610
• Revoking (disabling) permissions needs to be enforced in Row-level permissions (and front-end)
• Update policies with proper CRUD permissions per table Updates to policies #589
• Additional row-level restrictions in Outcomes API Outcomes -- row filtering for new tables #590 #590 Row restrictions on Outcomes #600
• Flood control? (Limit number of requests by IP address?)
• Remove User Switcher and Snapshot controller in Production mode (#993) (PR #998)
• What else? -- I know there's more.