There have been a lot. I remember one that was essentially “send the request without an Authorization header.”