Admittedly, I’m not very knowledgeable with this type of stuff, but would they have chosen to do this so that the browser extension can still show the user when a login is available without the user having to authenticate (they then authenticate to get the login details)