sessions.json doesn't require authentication, discloses hubbIT data openly

[abjugard]

As the title says, the route sessions.json does not require authentication at the moment, I don't know how we've missed this, but it's a serious oversight and needs to be fixed immediately.

[Kalior]

I believe this is by design? @lindskogen

[abjugard]

Then why is the sessions route protected? Seems like a bug. In any case it is undesired behaviour.

I mean, I'm fine with other IT students participating in the program knowing whether I am in Hubben, but I don't want that information available openly on the internet.

[lindskogen]

It's a feature!™