Poor man's OAuth