Well, try the demo. The google login works with a mechanism on googles servers asking you explicitly to grant access to the referring site. If the user doesn't check the address on the target ... well ... :/

I've spotted another weakness though on the facebook login. The username's are generated as facebook_$firstname, which will lead to duplicates on big sites quite fast. I'd like to see a mechanism asking the users to chose a username.