it’s a security style.

the OG “goat” style says the only things that can request the server are those that get their badges from the server (or some place the server trusts) beforehand.

then comes the client that wants to be able to supply their own badges.