title: Deployd: How to implement dpd-passport and securely authenticate
body: <p>Let me start by saying I really like <a href="http://www.deployd.com/">Deployd</a>. I want to use it in production, but I want to incorporate OAuth and social logins, so I installed the <a href="https://www.npmjs.com/package/dpd-passport">dpd-passport</a> module. It works great, except for two little (big) problems:</p>
  
  <ol>
  <li>When a user signs in via an OAuth provider (e.g. Facebook, Twitter, Github) a new user record is created...but if the same user clears their cookies or uses a different browser to log in, a new user record is created.</li>
  <li>If I do something clever (read: hacky) and assign users with social logins an ID based on the socialAccount and socialAccountId (something unique but constant for each social account), someone could use the standard method of user creation to spoof a user by making a POST request to the <code>/users</code> endpoint if they knew that user's socialAccount and socialAccountId.</li>
  </ol>
  
  <p>My question is: How can I A) prevent #1 from occurring, or B) disable the standard method of user creation <em>without</em> also preventing OAuth user creation?</p>
  
  <p>Has anyone ever successfully used <code>Deployd</code> and <code>dpd-passport</code> in production? If so, I want to speak with you...</p>
  
  <p>Thanks in advance! </p>