If you're going to be accessing user data, you need to be using oath authorisation. There are other ways to handle it but after a lot of research and trial and error, in the end this was the best way I found.