Turns out Flask's json also proxies through `itsdangerous` for handling potentially unsafe data.