问为什么bitbucket服务器检查令牌，即使它被阻塞了？

EN

$url = "http://10.77.78.235:7990/rest/api/1.0/projects/HAL/repos/crm-2/branches";

$headers = array(
    'cache-control: max-age=0',
    'upgrade-insecure-requests: 1',
    'user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36',
    'sec-fetch-user: ?1',
    'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
    'x-compress: null',
    'sec-fetch-site: none',
    'sec-fetch-mode: navigate',
    'accept-encoding: deflate, br',
    'accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7',
    "Content-Type: application/json",
    'X-Atlassian-Token: no-check',
);

$post_data = array (
    "name" => "bar",
    "startPoint" => "52005525378526ac3d5e5bcffc48fc9a82ebca76",
    "message" => "Submit"
);

$ch = curl_init();

curl_setopt($ch, CURLOPT_USERPWD, "myuser:mypassword");
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_UNRESTRICTED_AUTH, 1);

$output = curl_exec($ch);

curl_close($ch);

echo $output;

XSRF check failed