From what I can see he crawls the website as a user would do. He logs in to Google just via https://accounts.google.com/ServiceLogin?service=mail&continue=https

From what I can see he crawls the website as a user would do. He logs in to Google just via https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/ https://accounts.google.com/ServiceLogin?service=mail&contin..., two-factor authentication might involve user interaction. Session information (about other sessions) from for example Facebook can be obtained through https://www.facebook.com/ajax/settings/security/sessions.php https://www.facebook.com/ajax/settings/security/sessions.php