ditto: this is an internal only API call from browserid (with only DB read access) to dbwriter. if it's a POST, we must forward cookies and CSRF tokens, which seems meaningless. what do you think?