cabennett85/gittest — Issue #811: security hole in allowing fb email addresses on our system to register
Author: cabennett85
Created: 2012-03-02 00:17:51+00:00
State: open

Scenario:
1. Loren does facebook action - saves email on our server, then does twitter action - saves access token info in same row
2. Stan pretends to be Loren and creates a nonprofit with Loren's email, this will allow stan to be logged in as loren.
3. Once Stan is logged in he can now tweet on behalf of Loren