[daguava]

The only hole I found was if you bypass UI hashing you can create an account that can never be logged in to, but... that's the most secure account I can think of.