Also if the tokens can be used for 3rd party “Sign in through Facebook” authentication this just compromised millions of people’s entire digital identities for everything from dating sites to financial logins.