maybe the end user is someone sending curl requests?