An unauthenticated client should not receive non-public events

[audreywl]

For Olin IP addresses, send back events with 'public' and 'olin' visibility. For all other, send back just 'public'

Depending on the order of tasks, it may be expedient to skip this and go straight to #216.

[newsch]

This could be done by checking the headers of the request:

• https://stackoverflow.com/questions/22868900/how-do-i-safely-get-the-users-real-ip-address-in-flask-using-mod-wsgi
• http://esd.io/blog/flask-apps-heroku-real-ip-spoofing.html
• https://stackoverflow.com/questions/12770950/flask-request-remote-addr-is-wrong-on-webfaction-and-not-showing-real-user-ip
• http://werkzeug.pocoo.org/docs/0.12/contrib/fixers/#werkzeug.contrib.fixers.ProxyFix

[osteele]

@songbird175 I don't know if we still want this approach, but if we do this at all, it looks related to the are you're working on.