Loot boxes done right? But Ubisoft's been quick to quell pay-to-win concerns - these are cosmetic-only.