title: Unexpected behavior with Cash.Commands.Issue()
body: <p>I need some help understanding something I noticed with Cash.Commands.Issue.  During some testing I discovered that by using Cash.Commands.Issue an issuer can take cash away (consume a Cash.State) from the party that owns that Cash.State without their consent.</p>
  
  <p>I was rewriting CashTests.kt in Java for practice:</p>
  
  <p><a href="https://github.com/corda/corda/blob/master/finance/contracts/src/test/kotlin/net/corda/finance/contracts/asset/CashTests.kt" rel="nofollow noreferrer">https://github.com/corda/corda/blob/master/finance/contracts/src/test/kotlin/net/corda/finance/contracts/asset/CashTests.kt</a></p>
  
  <p>...when I came across this behavior.  The test:<code>extended issue examples</code> demonstrates using an Issue command an issuer can consume an existing Cash.State and create a new one with a larger Amount.  This makes sense as long as the only thing that changes is the increased Amount.</p>
  
  <p>For fun I tried changing the Owner of the new Cash.State expecting it to fail - it didn't.  It creates the new Cash.State with the new Owner and the higher amount while consuming the original Cash.State leaving the original Owner with nothing.  Is this correct?  My interpretation of this transaction is the issuer of a Cash.State can take cash away from the owning party without their permission.</p>
  
  <pre><code>Amount&lt;Currency&gt; amountCurrency = DOLLARS(1000);
  
  Amount&lt;Issued&lt;Currency&gt;&gt; amountIssuedCurrency = new Amount&lt;Issued&lt;Currency&gt;&gt; (
       amountCurrency.getQuantity(),
       new Issued&lt;Currency&gt;(megaCorp.ref("123".getBytes()), amountCurrency.getToken())
  );
  
  Cash.State initialCashState = new Cash.State(amountIssuedCurrency, alice.getParty());
  
  Cash.State doubleInitialCashStateAndNewOwner = 
      initialCashState.copy(initialCashState.getAmount().times(2), charlie.getParty());
  
  NodeTestUtils.ledger(megaCorpServices, dummyNotary.getParty(), l -&gt; {
  
      l.transaction("megaCorp issues alice money", tx -&gt; {
          tx.attachment(Cash.PROGRAM_ID);
          tx.output(Cash.PROGRAM_ID, "alice money", initialCashState);
          tx.command(megaCorp.getPublicKey(), new Cash.Commands.Issue());
          return tx.verifies();
      });
  
      // Here we will extend "alice money" to double the amount but switch the 
      // owner to charlie  (this is the part that confuses me)
      l.transaction("megaCorp extends issue and changes owner", tx -&gt; {
          tx.attachment(Cash.PROGRAM_ID);
          tx.input("alice money");
          tx.output(Cash.PROGRAM_ID, "charlie money", doubleInitialCashStateAndNewOwner);
          tx.command(megaCorp.getPublicKey(), new Cash.Commands.Issue());
          return tx.verifies();
      });
  
      l.verifies();
      return Unit.INSTANCE;
  });
  </code></pre>