I've got a JIRA instance which recently had its permissions radically simplified in order to increase performance (seconds were being taken for basic actions).
However, at some point during this, unauthenticated users now have the permission to see the activity stream and to comment on issues. My reasoning was, that a user that had no ability log in or look at an issue would have no ability to comment on it either, but apparently this isn't 100% right.
Ideally, a user that is not logged in would see nothing on the system dashboard other than the login box (or even better, they'd be redirected straight to login.jsp)
What is the exact permission bit that controls these things? I've got "browse projects" restricted to an LDAP group, yet the dashboard is still populated when logged out.
