do we want accessTokens to gate access to suri-rails?

[ndushay]

or some other way to give it greater security?

I'm totally fine with the answer being "no" but thought I should ask, since it came up in a slack conversation I had with Justin Coyne.

[jcoyne]

I think we can fix the security with firewalls as requested here: https://github.com/sul-dlss/operations-tasks/issues/2271

[jmartin-sul]

i would think so. the biggest security risks would seem to be

1. something DoS-ish, e.g. someone accidentally or maliciously using up identifiers.
2. minor information leakage -- seeing which IDs were already used.

i can't think of anything terrible that results from either, since the IDs are all random, though cleaning up after the first issue sounds like a pain.

so prob not super urgent, but seems like the right thing to do, and we have a pretty easy/established pattern at this point.