Comment by badrequest

IMHO not rolling your own auth is asking for stuff like this to happen.