[galaxy-dev] Securing REMOTE_USER against local users