We should consider doing an audit of all codesites that trigger a signin + sync flow, whether they actually require sync (or later unity), or just a gaia identity.