You could use third party auth, like facebooks. you could use an iFrame on another domain to setup all the secure stuff, and then use something like easyXDM to

You could use third party auth, like facebooks. you could use an iFrame on another domain to setup all the secure stuff, and then use something like easyXDM to communicate with that iFrame.