"We only need to consult the database for the user's secret..." , which kinda defeats the purpose.