Don't require authentication to approve/deny a copy request. Possession of the token is sufficient.

dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/RequestItemRepository.java

@@ -218,7 +218,7 @@ public class RequestItemRepository
     }
 
     @Override
-    @PreAuthorize("isAuthenticated()")
+    @PreAuthorize("permitAll()")
     public RequestItemRest put(Context context, HttpServletRequest request,
             String apiCategory, String model, String token, JsonNode requestBody)
             throws AuthorizeException {