PhabricatorFileDataController class handRequest doesn't have valid viewer/user for CDN file request

I was thinking of adding some code to phabricator to set the phusr cookie for alternate-file-domain (aws cloudfront) when a user login as well in order for me to track user download of software packages in the file application. What is the security risk involve in doing this? Is there a better way of capturing a userid when they download a file being served from a CDN?