Examine your HTTP headers in the response – you might have an X-Warning header telling you that your auth is actually invalid but that since you’re requesting a method not explicitly requiring auth, we’re serving it to you in an unauthenticated context to satisfy your request. Most likely there is something subtle causing invalid auth for you.