For the delete we would, but for the get? There's any type of info that they couldn't easily find via other means (dom inspection) and this provides a decent debugging tool (we can ask them to invoke the org.course/orphan url and send us the result). I have no problem clamping down on this tighter if you think it's important tho.