The main change is passing in a `WaivedAuthContext`, which is to say, all auth checks have been done, and even though it's not authenticated, it's been ok'd (since it's a demo_user submission that only touches demo cases or a device report)