@feditips if that thread is correct, then Mastodon's implementation of Authorized Fetch is broken. When it's working, attempting to access anything through a web browser should return a 403 / similar error unless you log in. That's also how it works on Pleroma and Misskey.