I have opened https://issues.apache.org/jira/browse/SHINDIG-1557. The gadget security token is not being used on rpc calls. The container one is. Thus calls like appdata and userprefs do not have access to the gadget information as they need.
In the meantime I'm going to try to work around this in my own container. Does anyone have any ideas how to get a hold of the requesting gadget inside of jsonrpctransport? Thanks, doug
