It is a little bit weird to me having a rule of first unauthenticated client side request winning here

Eh, he probably hit Fable’s guardrails when he promoted “secure this project”