I'm writing a management system that will, initially, only have 3 users but there's one more guy who needs access. The system integrates with our accounting package and they need to be authenticated against it so it makes sense to use their oAuth. However, there's one more guy who will need access to one set of screens but we don't want to give him access to the accounting package and therefore he can't authenticate. He has literacy problems so it needs to be really simple. My options appear to be: add a second method of authentication (google?) leave the screens he needs open (and risk the influx of spam) send him a text confirmation code he has to enter leave the screens open but have a "safeword" he has to enter but is there something else I've missed? If we were all on Android I'd just write him an app but the fees are ridiculous to do the app store as well.