Yes -- it should only return email addresses when the user you are making the call as has permission to see them.
You can see the user's email address if you have permission to manage users, or if a user allows just friends and you are a friend, or if the user allows anyone see their email address (through the "my settings" > "prefrerences" > "privacy").
Thank you for the response, this clarifies it. When you mention a user needs the ability to manage users, where is this set?
This is set via the Users > Permissions tab in the admin. The permission is called "Manage Users" and it's under the "User Management" section in the permissions list. The best practice is to create a Role and give that role the permissions you need, then add users who should be able to take the action to that role.
