Yes. Another site could use this endpoint to make its own auto-complete, thereby using our resources. If there were more endpoints with sensitive data, I would move the header in the appropriate endpoints only.