I see no real problem with this. They just have to write dummy AGPLed adapter module, querying proprietary RPC service (or they can even use OpenID/OAuth intern

I see no real problem with this. They just have to write dummy AGPLed adapter module, querying proprietary RPC service (or they can even use OpenID/OAuth internally). There won't be anything confidential more than curious user can find out, inspecting his browser's requests with completely proprietary service.