It is second most hit request on our publish based on your query. Another thing, I checked and this is not whitelisted directly on our application dispatcher i.e <project_domain>/libs/granite/security/currentuser.json doesn't work, but is only allowed in publish filters so https://publish-xxxx-xxxx....