Ideally workflow would be some kind of Oauth with token expirations and some kind of mobile notification for refresh