IssueTracker

This X-GoogApps-Allowed-Domains header is supposed to be available to restrict access to consumer gmail accounts.

When you insert this header on a gmail attachment upload (e.g. POST /_/upload) to block the attachment upload, the header is ignored and the upload is successful.  

We want to permit our corporate users to read/compose personal gmail messages, but block attachment uploads.  Other gmail http endpoints apparently honor this X-GoogApps-Allowed-Domains header but we only want to insert it on the attachment uploads (e.g. when X-Goog-Upload-Command is observed).