We don't keep our keys to ourselves - we go fetch them from wherever a token tells us to look. Host your own. We'll come knocking. That login form? Purely light side stuff. Let the anger and the outbound HTTP requests flow through you.