Ah -- if you're logged in and have requested to download your data, it produces a PDF with a bunch of private account info, looks vaguely like that's publicly exposed, but it's probably not.
Might have given someone a fright, until they realized what was happening, and that it was dynamic content, of course.
{"errors":[{"code":410,"message":"You need to verify your password before you can view this content."}]}