You Happen to be on position re: data leakage and this should be an essential thing to consider for any person rolling their unique authentication/authorization scheme. +one for mentioning OWASP. This is so simple as it gets, but could be incriminating if there is even a slight slip-up. A destructive http://pigpgs.com