[BUG] The data is publicly accessible

Thanks for the report @amielucha. It seems that for some reason, adding additional slashes to the requested route simply evaluated as an empty route. That was messing up our logic when checking “is a route being asked for right now”, so the “disable the response” wasn’t happening.

I’m still kicking the tires a bit before pushing out to everyone (the last thing I want to do is cause any OTHER unintended side effects), but if you’d like to test the latest changes you can find them at github https://github.com/dmchale/disable-json-api