Can fake openid string and get looked up in User db

We can send REMOTE_AUTHID:https://paulbrian.myopenid.com as HTTP HDR
and it will accept that as logged in and resolve user against dbase
and put in g and session