it looks like the jsapi is just adding a unique throwaway parameter '_ts' and setting it with a timestamp to dirty up their requests.
we could do the same thing here:
var params = {
_ts: Date().now(),
bbox: [sw.x, sw.y, ne.x, ne.y].join(','),
// ...
};
if you can log an issue in our repository in github, i'd be happy to help.