Isn't the server giving you permission to view the data? Not give?

EG, if it returns an image - it doesn't imply I can use the image anywhere I want.