Second solution seems pretty optimal for security but not sure if users up for that.