When logged in as some user and tampering with the b_id cookie to see another users cart, this seems not to be counted as a passed challenge.

The challenge seems only to be passed (=green ball) when doing to as Guest User.