[Timothee]

It seems to me that the problem is that the backend is treating the XHR like if you were hitting the main site. So sometimes (but not for all endpoints I think), if I were logged out, the XHR would be redirected to the login page.

To me, the API endpoints should behave the same way in a browser as with curl without ever redirecting to the login page.

But, once again, it might have been fixed in the meantime… I haven't tried recently.

[geemus]

Sure. I haven't tried either. Its on my list of stuff to dig into and sort out, so hopefully we have a better answer soon.