Calling Modify or Create REST API methods from external domain - Authentication Options

I was under the impression that if you made a call to the REST API authentication method with the SSO cookie (but not specifying a username or password) that it would authenticate with the SSO cookie and return a valid token that can be used in subsequent calls. This avoids the for the user to browse to the community first.

I've just tested this and seems to be working. However, it could just be that the 'unsafe' cookie authentication is enabled.