In MobileFrontend we have support for requesting cross domain tokens using centralauth token. We've had to use this code for Wikigrok work and are likely to need it gain.
To kill MobileFrontend we should move this api code to a more logical place. As @Legoktm rightly points out core is not necessarily the right place for this, but CentralAuth may be.