See also: Using the web service 

The (comma-separated) authorized clients of the web services are set in /properties/config.properties with this property:

#webService.authorizedClientNames=host1.domain.edu,host2.domain.edu

When this property is left empty, no access control is set, which is a potential security hole.