That call should be anonymous, we don't need user authentication. You should add the following to `helpers` in `hearth/media/js/helpers.js`:
```
    anonApi: require('urls').api.unsigned.url,
```

And then use `anonApi()` in your template.