It's definitely not an apiRoot, it's really just '/ghost/forgotten/', can't be an API patch since the user is not even logged in yet...