OAuth – Why it doesn't work, and how to Zero-day attack existing services (insanecoding.blogspot.com)