Everything OTRI holds for this account, as a JSON download (PRIVACY.md, 'Your rights').

Asks for the password, like every other account action that matters. This was the one that did not, and it is the one worth the most: in a single request it hands over the account, its consents, and every result row the organizer ever uploaded -- each with a runner's name, gender, year of birth and nationality. A session on its own should not be able to take all of that, because a session is what an attacker has.