We have finished "Update Layers to HTTPS" and have turned on the option "Allow access to the organization through HTTPS only", which is supposed to be equivalent to the change after Dec 8. However, the http link
http://www.arcgis.com/sharing/rest/content/items/<web map id>/data
still can work.
We want to know why this http request still can work.