Awesome! Unguessable auth is the answer. You could even have the server generate a uuid token and have the user paste it into the browser extension.