The thread local caching permissionManager maintains a cache of projects for which a user has the browse permission. Unfortunately the cache does not take the user into consideration, and the getProjects(Permission, User) method may return incorrect results if two different users make subsequent requests within the same thread.

This can happen if subscriptions are being mailed out. If two subscriptions for 2 different users are being sent at exactly the same time, one of them may be empty even though it should contain some issues. This happens because the subscription in question, will retrieve projects used for the previous subscription to build up its permissions lucene query.

We should make the ThreadLocalPermissionManager respect the user when caching. We should also make sure the mail sender cleans up threadlocal caches properly when sending mail.