tbh this is where something like RGB / Taro could come in. give them an access token in their wallet. offload almost all user account behavior to wallets. less liability on the web app owners