That’s a very good point and indeed it is a potential attack vector. I’ll have to think about that. Perhaps I can get away with not tying the passport hash to

That’s a very good point and indeed it is a potential attack vector. I’ll have to think about that. Perhaps I can get away with not tying the passport hash to a particular user.