A method performed by a reverse proxy server operated by a content delivery network service provider that serves web application content on behalf of a plurality of web application providers who are customers of the CDN service provider, the method comprising, at the reverse proxy server: executing a transport layer security handshake with a user's client device, said execution of the TLS handshake comprising sending the user's client device a TLS certificate for a domain name of a web application provider customer of a CDN service provider, the CDN service provider operating the reverse proxy server; receiving, from the user's client device and over a publicly-accessible network, an application layer message directed to the domain name of the web application provider customer; examining the content of the application layer message to find a user credential; associating the user credential with a credential policy defined by a credential owner, the credential owner having issued the user credential to the user of the user's client device, and the credential owner being distinct from the web application provider customer; applying the credential policy, comprising: generating a verification message to verify whether the use of the user credential is permitted by the credential owner; sending the verification message to a remote computer that was designated by the credential owner; receiving a response to the verification message, the response comprising: (a) a directive to allow the application layer message or (b) a directive to block the application layer message; or (d) a directive to initiate a two factor authentication process with the user associated with the user credential; and/or (c) a directive to generate an alert; applying the received directive to the application layer message, said application comprising: for (a) a directive to allow the application layer message, processing the application layer message in accord with a configuration associated with the web application provider customer; for (b) a directive to block the application layer message, blocking the application layer message; for (c) a directive to generate an alert about the application layer message, generating and sending an alert in accord with any of: the directive and the credential policy; and for (d) a directive to initiate a two factor authentication process with the user associated with the user credential, sending a two factor authentication request to the user. executing a transport layer security handshake with a user's client device, said execution of the TLS handshake comprising sending the user's client device a TLS certificate for a domain name of a web application provider customer of a CDN service provider, the CDN service provider operating the reverse proxy server; receiving, from the user's client device and over a publicly-accessible network, an application layer message directed to the domain name of the web application provider customer; examining the content of the application layer message to find a user credential; associating the user credential with a credential policy defined by a credential owner, the credential owner having issued the user credential to the user of the user's client device, and the credential owner being distinct from the web application provider customer; applying the credential policy, comprising: generating a verification message to verify whether the use of the user credential is permitted by the credential owner; sending the verification message to a remote computer that was designated by the credential owner; receiving a response to the verification message, the response comprising: (a) a directive to allow the application layer message or (b) a directive to block the application layer message; or (d) a directive to initiate a two factor authentication process with the user associated with the user credential; and/or (c) a directive to generate an alert; (a) a directive to allow the application layer message or (b) a directive to block the application layer message; or (d) a directive to initiate a two factor authentication process with the user associated with the user credential; and/or (c) a directive to generate an alert; applying the received directive to the application layer message, said application comprising: for (a) a directive to allow the application layer message, processing the application layer message in accord with a configuration associated with the web application provider customer; for (b) a directive to block the application layer message, blocking the application layer message; for (c) a directive to generate an alert about the application layer message, generating and sending an alert in accord with any of: the directive and the credential policy; and for (d) a directive to initiate a two factor authentication process with the user associated with the user credential, sending a two factor authentication request to the user. for (a) a directive to allow the application layer message, processing the application layer message in accord with a configuration associated with the web application provider customer; for (b) a directive to block the application layer message, blocking the application layer message; for (c) a directive to generate an alert about the application layer message, generating and sending an alert in accord with any of: the directive and the credential policy; and for (d) a directive to initiate a two factor authentication process with the user associated with the user credential, sending a two factor authentication request to the user.