this could absolutely have been a trivial oversight; if they're a rails app it's as simple as a stray line putting an "is_authenticated" before_filter or something on the controller. easily the kind of thing you'd have while dark-launched and then forget to remove later.