This is great! Like the security changes, this is a little detail that provides a big improvement. Maybe the next little detail with big impact could be better built-in oauth2 support with the WordPress json api? Currently it only works with the login cookie without help of a plugin.