@[email protected] looks like an issue with the implementation though? with authorized fetch i'd expect fetches to be discarded just as well as pushes or do you mean the api?