I am currently developing a Silverlight 3 app that needs some sort of user authentication, because the data pulled from a WCF service is user specific. Target audience is the regular Internet - so there is no AD to authenticate against.

Here are some of the questions I have concerning that situation:

* Is there a framework or other mechanism that would support me?
* Would you recommend authentication within the Silverlight app or via outside mechanisms like forms auth? Which is more secure?
* What about out-of-browser support?