Fix: return correct URIs for private loadouts in query API.
Use branded cURL for external requests.