Good call. I'm slightly worried about this https://github.com/mozilla/webpay/blob/master/webpay/auth/decorators.py#L46 because it could create a redirect loop. I saw it once during testing but I cleared my cookies (repeatedly) and couldn't ever reproduce it.