@Ryan Hellyer - Well I dont see that the server stores the credentials just that it uses them as part of the original request from the app. Sure it results in two possible hijack attempts instead of just one if the app communicated directly. but disclosure is always best.