Major changes.  Misread the requirements - the whole point of OAuth is so you don't need username and password provided, so everything prior to this was going in the wrong direction.  Implementing OAuth now.