It was a long time ago, but just in case someone stumbles upon it, as I did today.
Sending a user's email as a URL parameter is completely unsafe. Anyone who uses curl or their browser can make requests pretending to be an arbitrary user. If users can change data using their queries or if they cannot see each other's data, you should not follow this approach.
Instead, you should use the GAE cookie-based user service:
Nioan source share