I suppose the endpoint is the problem, that likely has to be exposed, and they could just request it from any modern browser - that would make sense