If you find the right API endpoint, you can spoof the `Forwarded` header to get different results. Big PII leak IMO but they seem to think it's intended behavior?