In a post launch revision of this, it would be good to 1) return the badge information with some sort of token (?) and then 2) allow the user to accept the badge. Which I think is how we did the issuer api way back when. For now though, I think this is fine.