This is a little confusing; elsewhere, I get the impression that we're using FxA for auth. For this use case, we can either use FxA (if the user is logged in), or presumably, we can also use the cookie discussed above. This needs to be explained better.