Move the interesting bits into the Diaspora controller.
Third user for checking privacy.
Use the private key to verify the password - if the user can't unlock
the key then they can't post anything.