Looks like you're not sending credentials, neither cookies, neither tokens in the exploiting request, maybe it isn't authenticated after all? Just asking :)