Hi Ralf:

I am considering committing this change. Bern was uncertain
about the security implications of adding:

  p = db.security.addPermission(name='Search', klass='user')
  db.security.addPermissionToRole ('Anonymous', p)

to schemas to allow the "Unassigned Tickets" link to be
useful to the anonymous user.

I suppose this is a way of doing a username guessing attack against
a roundup install. Submit a search url to the tracker with a username
to see if you get any hits. But I am not sure that is a problem.

As anon you can see who a ticket is assigned to and the nosy list
usernames so ....