A check has been added to the API. So you will be getting "Not allowed" as response now. I won't state what the check is, that would be an arms race. But it was fun for a day.