bug: case-sensitive email comparison blocks authorized users

[dgokeeffe]

Problem

The authorization check in app.py compares current_user != app_owner using exact string matching. Email addresses are case-insensitive (RFC 5321), but Databricks SSO may return different casing in X-Forwarded-Email than what's stored as the app owner.

For example, RC.Guan@databricks.com from SSO doesn't match rc.guan@databricks.com stored in the app description, causing a 403 for the rightful owner.

Affected code

• app.py:check_authorization() — HTTP auth check
• app.py:_check_ws_authorization() — WebSocket auth check
• app.py:get_token_owner() — owner resolution (all return paths)
• app.py:get_request_user() — request user extraction

Fix

Normalize all emails to .lower() at ingestion points.

PR: #114

[datasciencemonkey]

Fixed in #123 (v0.17.1) — all email comparisons normalized to .lower() at ingestion points (get_token_owner(), get_request_user(), WebSocket auth). Credit: @dgokeeffe.