You Happen to be on level re: information leakage and this should be a vital thought for anyone rolling their particular authentication/authorization scheme. +1 for mentioning OWASP. Educate end users and notify them about the newest hacking traits so that they can prepare them selves and not become a victims http://pigpgs.com