This needs to be an SSA token. We shouldn't allow anyone but an authenticated user (and potentially admins, eventually) to access a user's purchase history.