You might want to add a note in here about how these aren't used for authorization purposes. I got a bit thrown off reading this, thinking some sort of valid user was needed.