It uses the smart proxy auth to authenticate, so it runs as 'admin' and therefore authorisation passes because it's an admin user, no?