Registration allows any user to specify roleId

[SamuelColacchia]

API accepts both a roleID and a organizationID with out performing any authentication.

This may cause unintended security side effects.

Post to API - auth/register

{"key":"email","value":"admin2@admin.co"},
{"key":"password","value":"somepass"},
{"key":"organizationID","value":"1"},
{"key":"roleID","value":"1","description":""},
{"key":"firstName","value":"admin test"},
{"key":"lastName","value":"admin test"}

Response from - auth/register

{
    "userID": 1567,
    "email": "admin2@admin.co",
    "firstName": "admin test",
    "lastName": "admin test",
    "organizationID": 1,
    "role": "Administrator"
}

[AdamVig]

@SamuelColacchia Thank you for letting us know.

I need to rethink the security on that endpoint. It only needs to be used from stockpileapp.co/subscribe, so I could implement CORS to restrict the route to only requests from that domain.

CORS is enabled by default in Restify, so I may have broken it at one point, possibly in ./controllers/options.js.