Auth via Device Id

If Auth via Cookie fails, auth via device id is attempted.  I am ok chaining those requests because once a user auths via device id, they will be cookied so the chained requests will not happen again (unless they were to sign out... now that I think about it, signing out will be difficult!)

next steps will be to combine user accounts, e.g., a user auths via device id, then logs in; an organization pre-populates our database with users, we email them a registration link, and combine the pre-populated user, the device id, and the (yet to be created) profile