(incomplete) Secure Design Pattern - Login