So it does not require two more steps to identify the caller as he claimed?
and i would bet they are all the same (use the same database system - terradata)
bottom line is SOMEONE can connect the data and the user - otherwise the data would be of no use - is that one person on the planet? can THAT person be trusted?
one step or 20 - if it can be done the problem is still there