Hmm… that may be the case on some instances (e.g. pixelfed.social), but I know an account is not required on others because I’ve tested it on several instances without registering. The only one it breaks on is pixelfed.social, which unfortunately is also the largest instance.

But still good to know, thanks for pointing that out. It’s too bad the unauthenticated discovery is still broken, though.