Yes, this was previously authenticated by session. Now it is authenticated by session or key. 

Although in both cases a rejecting response is needed for sure. Error on not authorized is definitely an oversight!