[bostik]

> JSON location payload instead of an XML payload. For whatever reason, that bypassed the usual consent check

To me that sounds like you stumbled upon an unauthenticated development/debug mode.