Hi cblown!
Our security team asked us to add this restriction in, because without it, it's possible (although unlikely) that an attacker could use http.client as an attack vector. This was before we started using api.lithium.com and it would be nice if we relaxed the restriction to allow this host name to be used.
We have the rest freemarker object for making REST API calls to the community you are on. If you want to get a user via freemarker, you can make the following call:
rest("2.0", "/users/5")
We don't currently support doing REST V2 POST, PUT, or DELETE calls in freemarker. You don't want to in components, because they are meant for displaying page content only. It would be nice to add support for page initialization and endpoints to be able to make POST, PUT, or DELETE REST V2 calls, but we don't support this now. I believe you are able to create and edit users in Freemarker via REST V1 calls:
There is no REST V1 call to close a user's account (delete), so there is not a way to delete a user via Freemarker (it would have to be done via HTTP).
-Doug
GavinD ChhamaJ YuriK