[tools] Add no auth FIXME.
[tools] Authenticate purchase request.

The purchase request is always signed but adding authentication to the
request enables the full receipt to be returned.