During request processing, graphoid anonymously calls allowed public wikis (e.g. en.wikipedia.org), without forwarding any user session data. In order to allow graphoid use on the private wikis, it needs to forward the session state to the private wikis.

This implies that:

• Vega library needs to keep the context of the rendering request so that the data loader could forward relevant session data
• We need a plan how to keep graphoid in the same security zone as the private wiki
  • Possible ideas - one graphoid instance per private wiki, e.g. zero.wikimedia.org => graphoid.zero.wikimedia.org, plus custom rules that allow session data to be forwarded only to zero.wikimedia.org, but make anonymous calls to all other allowed wikis.