Oooh, hey this is bad. If you go to http://threewords.me/username.xml http://threewords.me/username.xml you can see the user's Facebook access token, secret, se

Oooh, hey this is bad. If you go to http://threewords.me/username.xml http://threewords.me/username.xml you can see the user's Facebook access token, secret, session key, and hashed password. You should probably remove that view or modify the to_xml in the user model.