Sounds like you first need to really hammer out specs. A mailing list might be helpful. Security items like this shouldn't be developed ad-hoc. I'm sure people like merlyn and perrin, among others, might have a few things to say on the topic.