Hi Folks Planning to create a widget for client sites that uses jsonp to interact with my server. jsonp because i'll need to skirt the same-origin-policy (don't want to trouble clients with using server redirects), but i realize this limits me to http GET. I'll need users to login/identify themselves before they can interact more with the widget. My server code will also need to know the referring/partner site.
So ... my question ... any reference material on handling site/user identification issues in such a case: something like a site key (where the widget is installed + its a valid widget) coupled with a user key (to identify the actual user of the widget on the client site)?