What are the security risks with this? Doesn't this open users up to giving payment access to people who aren't qualified to handle access tokens?