I tried this on a newly installed separate browser. And blocked cookies. I'm getting below on the very first json payload (after receiving the initial error)
{"result":"fail","session":"013827cf59683e410c2f1d2c675d7a8c","data":{"auth-exempt":false,"reason":"missing response"}}