So the lesson is don't worry so much about authenticating the user, but focus on authenticating the transaction. It would have been a much more useful article if he actually described how (rather than just saying, "do it like the credit card companies").