I'm puzzled. For the kind of service they want to offer, to have such newbie security vulnerabilities makes you wonder if it even works. It's the kind of flaw that any moderately experienced developer never leaves opened.