[fluffy](Well, not quite true, during Twitter login it also stores the temporary client credentials in the session but those get revoked as soon as login completes, and the worst that anyone can do with that in the meantime is, uh, post to their own Twitter account)
