Jira APIs return an incorrect timezone value when the user profile restricted the visibility

Issue Summary

Jira APIs return the site timezone (instead of the user timezone) when the user profile restricted the visibility of the timezone field.

Steps to Reproduce

1. Set the timezone to +5 for a Jira instance

1. Create a new user with timezone +0 that belongs to an organization.

1. Run the following command (manually or via a REST API request performed by an app)

curl 'https://{jira_instance}.atlassian.net/rest/api/2/myself' \
-H 'ap-client-key: {existing_and_installed_app_key}' \
-H 'cookie: {created_user_cookie}' \ 
-compressed

Expected Results

The api returns an indication that the timezone field is restricted (e.g. an empty value).

Actual Results

The api returns the site timezone (+5 in this example) instead of the user one or an empty value.

Notes

If the request is performed without the ap-client-key , then the user setting value is returned. (note: the header is present in the requests performed via connect apps).

Workaround

Follow the App Privacy Documentation and use AP.user.getTimeZone javascript API to get the current user timezone.