Bug CVEs not available to anonymous API users

[Martin Prpic]

When looking up CVE information of a bug, the returned collections are always empty, e.g.:

```
$ py
3.7.1 (default, Nov 23 2018, 10:01:49)

In [1]: from launchpadlib.launchpad import Launchpad

In [2]: launchpad = Launchpad.login_anonymously('just testing', 'production', './cache/', version='devel')

In [3]: bug = launchpad.bugs[1529836]

In [4]: list(bug.cves)
Out[4]: []
```

Same with direct API query:

```
$ http --body https://api.launchpad.net/devel/bugs/1529836/cves
{
    "entries": [],
    "resource_type_link": "https://api.launchpad.net/devel/#cve-page-resource",
    "start": 0,
    "total_size": 1
}
```

Visiting the actual web URL (https://bugs.launchpad.net/kwapi/+bug/1529836) shows CVE-2016-0738 listed under "CVE References". I'd expect this CVE to be listed in both responses above. Is the CVE information available somewhere else? Or is it simply missing?

[Colin Watson (cjwatson)]

It works if you're logged in (login_with rather than login_anonymously). ICve's security declarations probably need to be looked at a bit more carefully.