On 12 Sep 2010, at 00:25, Felix Meschberger wrote: > There is one situation where an admin session is always retrieved: The > CreeateUser servlet. This is probably a bug and should only use an admin > session for self-registration.
+1, I think we have modified out CreateUser servlet to do this, and added a hook to allow control over self registration, we use that hook to look for things like reCaptcha tokens. Is that something that should be in Sling ? Ian
