I reject the tradeoff that your internal customer support 'impersonate user' web app would be available via simple password on the open internet.