API calls do not respect namespace restrictions

[bondjimbond]

In an Islandora multisite, a query made to one of the sites (bchdp.arcabc.ca) is returning results from all of the sites (arcabc.ca).

A user requested a count of objects via the API to bchdp.arcabc.ca, and received a response of 712,000 -- which is the count for all of Arca.

This is of course very problematic, as it jumbles up results and sources. Can some code be introduced to respect namespace restrictions?

[bondjimbond]

Example request: https://bchdp.arcabc.ca/islandora/rest/v1/solr/dc.title:*

This site is restricted to certain namespaces, but you can see in the first parts of the response that it's returning items from the "inaccessible" au namespace.