Which (I believe) carries on the session using the cookie and retrieves the OMPL XML. The response I receive is valid OMPL, but appears to be some default/boilerplate feed list – in other words, it’s not mine.
Well, if you’re passing that cookie, then NewsBlur should consider you authenticated. Try inspecting your web requests and seeing the cookies being sent. Just steal that cookie and see if it makes any difference.