I know this is my fault because I showed you this bit, but can we pull the API call out into a variable? It's the second most important thing that happens in the whole controller and it's easy to miss that we're making the authBrowser call when it's just an argument to the getCookies call.

    val authResult = api.authBrowser(EmailPassword(email, password), omnitureData)
    signinService.getCookies(authResult, ... etc

Only a little thing, sorry to be a bug-a-boo.