> Then what's the point of having the cookie authentication provider? 

The way I see it the authentication providers are there for you when you use curl. 
However, when you call the handler from inside Drupal and you didn't explicitly set ``$handler->setAccount()``, then I would expect it to use the current user.