Should be the pins stored in the db and verifiable.  Really need to get some authentication middleware sorted.