Hi Ralf:

My only concern is that it could be used to fill the logs with errors.
But that's an issue we have elsewhere in the code. I don't have a good
solution for it or how to make it easier to respond to.

Logging the username might be useful in tracking down the cause.
But, I think this code is accessible from an anonymous user if
anonymous is granted rest access and the username is useless in
this case.

Maybe logging the IP address to allow firewalling in case of DOS?
I don't think the Client object has that. It would also need to be
proxy aware (see rev 627c5d6a0551 for changes to roundup-server) which
would require a setting to enable/disable.

If none of these seem worthwhile/feasible, I say close it.