We should talk about behavior when a user is authenticated (i.e., the push URL is associated with the authenticated user; no cookies are used).