Interesting, but I hope there is clear direction to never use 1 legged OAuth in production. Because that's a bad time.