I don't know how big of a liability this is, but it allows two things.

First, it lets other webmaker servers with the basicauth credentials access these routes. Second, it allows the unit-tests (as they currently exist) to access these routes during testing.