You should also add an API for session management, so I can always see what sessions are active under my account and kick them out if they look suspicious.