this is an internal only API call from browserid (with only DB read access) to dbwriter.  if it's a POST, we must forward cookies and CSRF tokens, which seems meaningless.  what do you think?