steps to reproduce:

• On a repository where a certain Issue A can only be viewed for users being logged in:
• (works best with firefox)
• login
• navigate to issue A
• click "XML" and copy URL
• click logout
• paste URL in address field and hit enter
• observe what is presented, clearly not XML
• (in firefox) rightclick page and select page info
• observer "text/html" as type

Downloading that file using wget and overriding the HTTP header to gzip type reveals that in fact a gz of a "not logged in" site is returned.
The type returned should match the type specified in the HTTP header...

This happens on 4.0.0 beta 2 as well as 3.13.