[andrewstuart2]

Developer 102 (or perhaps entrance exam): Never return authorization credentials on an unauthenticated HTTP endpoint.

[f2n]

It says Authorization, but this is really more of an anti-CSRF token, not an actual authorization credential, and anti-CSRF tokens are completely legitimate to return over an unauthenticated HTTP endpoint.