I guess API authentication for non-task URLs has been broken for a while.