I wonder whether the DataProtectionScope should be configurable. Currently anything running on the same machine can unprotect this data (I realize this is not the SystemWeb implementation, but still). Maybe scope of CurrentUser is better for the default implementation, considering it's most likely to be used in self-host, running under a particular user account (Windows service, cmd line app, etc.).