Koha Devs --
I've been looking at fixing the autopopulation of fields (dateaccessioned, barcode, etc) in cataloging. The architecture is a bit screwy. Some of the scripts in cataloguing/value_builder/ are designed to run as stand-alones and others are called by a "do" statement in additem.pl. Anyway, that's just background.
There are two scripts that break security by passing authnotrequired => 1 to get_template_and_user: