Showing an error from merging seems to work.
withCredentials, of course.

Though I think the CRX doesn't appear to need it.
Need cookie permissions to figure out who you are.
Major steps towards getting identity from cookie.

Gonna call epiquery to get the user ID once username is found.
Now actually goes and gets user.
Don't load people until we have a login.