I don't know how this works, but basically, it seems retriggering and classification UI uses different auth systems. This is confusing, because I can be in a state where I can retrigger builds (or at least, get no ldap auth popup and get a 'success' notification) but am not logged in so I can't star failures. That's odd. :-)

Retriggering requires authentication with the buildAPI, while classifying things uses Treeherder/Persona authentication. It'd be nice if one could count for the other, but I'm unsure how easy/secure that'd end up being...

They are indeed separate and I'd like to combine them, it will just require buildapi changes to allow treeherder-service to make requests on a user's behalf, whilst still tracking which user requested the change/checking for permissions etc.