Jupyterhub 4.0.x with jupyter-collaboration

[ykazakov]

@minrk

In practice, if you don’t elevate permissions then the only real cost of spoofing, assuming full execution access to the server is intended, is in the logs - all the requests made by other users will show up as being made by the original user and you won’t be able to tell if or when a different user is actually performing those operations.

Well, that should be clear since sharing a link with the token does not require another user to be even logged in to the hub (or, let alone, have an account on the hub). This does not seem like a big issue to me. Of course, one can distinguish users by ip addresses, if necessary.