For some reason bicing.com decided that it would a good idea to make it harder to get the current state of the stations.
The “localizaciones” page is now on a SSL page and I think they use the session to make sure that it is someone browsing the page.
A pity really.
UPDATE: that was not so bad, just SSL and user agent check. I still think they should provide a proper API with some kind of user agreement, so that you don’t use it to make money or poll it every couple of seconds.