It seems to me that the problem is that the backend is treating the XHR like if you were hitting the main site. So sometimes (but not for all endpoints I think), if I were logged out, the XHR would be redirected to the login page.

To me, the API endpoints should behave the same way in a browser as with curl without ever redirecting to the login page.

But, once again, it might have been fixed in the meantime… I haven't tried recently.