This should *definitely* be using the API route, because we're expecting backend to go through the API rather than duplicating the code in the backend too.