It's possible to request data a user has not be granted to. It violates the Statement in docs "It is only possible to request a tile within a bounding box that is fully accessible."
I will provide further details per mail on request.
Ubuntu 14.04 / Jetty