Yes, call me paranoid, on that part.
Yeah, I suggested OAuth for milkshake_, but I guess it was too much.
I'm more of the type who can suggest something, but ultimately leaves the decision to others and follows with it. I'm not really security expert nor design person by any means.