not blocking or anything, but could that test account be made to work over https? then we'd enforce https no matter what, which is a win IMHO.