outlines security flaws (many fixed as a result of this study) that call for some diligence on both the part of identity providers and consumers