a normal user can get other user's ec2credential

[wanghong]

https://github.com/openstack/keystone/blob/master/etc/policy.json#L65
Note that owner is only check if the user owns the passed token. In fact, we should also check if the user owns the credential. The correct policy should be the one ec2_delete_credential uses:
https://github.com/openstack/keystone/blob/master/etc/policy.json#L68

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/152444

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/152444
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=7b4a81fb3ded30beee9f84ebff640d8f0263ecce
Submitter: Jenkins
Branch: master

commit 7b4a81fb3ded30beee9f84ebff640d8f0263ecce
Author: wanghong <email address hidden>
Date: Tue Feb 3 17:36:05 2015 +0800

    make credential policy check ownership of credential

    Currently, policy.json and policy.v3cloudsample.json only check if
    the user from token matchs the user from url. However, we should
    also check if the user owns the credential.

    Change-Id: I5c8bbb6736b028d6cb693d2a35e018f28caeaa57
    Closes-Bug: #1417366
    Closes-Bug: #1417522