Key part: "to any web app". You'll need some kind of OAuth provider on top so people can just plug it in right next to their Google, Twitter or Facebook providers.