FxA web flow (bug 1033694)

it's a CSRF token, sort of thing. So that should be just fine.