I changed the error that's thrown when credentials fail, which apparently had the side effect of not blocking the request from going through. Hence why the credentials are bypassed.
Regarding the JSON, if you call it from jQuery or other frameworks, it abstracts it from you like I mentioned. Load it int he browser directly (click this link):
http://localhost/CastleOS/service/web/GetAllGroups/And you get this:
[{"key":"Default","value":"0"},{"key":"Ecobee Devices","value":"12"},{"key":"Hue Devices","value":"5"},{"key":"Living Room","value":"11"},{"key":"Living Room Chandelier","value":"8"},{"key":"Master Bedroom","value":"10"},{"key":"Nest Devices","value":"2"},{"key":"Office","value":"9"},{"key":"Sonos Devices","value":"1"},{"key":"Test 4","value":"7"},{"key":"Test Group 2","value":"6"},{"key":"WeMo Devices","value":"3"},{"key":"Z-Wave Devices","value":"4"}]