@robconery I agree that for a paid service, OpenID *alone* is much too risky. I totally concede that point.