Use secure cookies.
groupfinder should at least return an empty list or else the user is considered invalid.