Permission of the autocomplete callback path

Fixed in 6.x-1.1

I thought that adding

    'access callback' => 'user_access',
    'access arguments' => array('use realname'),

in realname_userreference_menu() would be OK, but it's not working... If I grant NO permission for "use realname" to the anonymous user, http://mysite.com/realname_userreference/autocomplete still can be accessed.

Does someone have an idea of what's happening ?

See also #840964: Permission of the autocomplete callback path

The Drupal security team discussed this and decided that it was not a security hole, since Realname's data in intended to be public.

Since what I did in #4 and in -6-1 does not improve anything, I'm reverting to

    'access arguments' => array('access content'),

Marking that as "won't fix", but I'm open to patches that improve the situation, and will consider #840964: Permission of the autocomplete callback path.

Marking as "duplicate", instead.