Can we restrict who can call this to known fxa-auth-server hosts?