Security vulnerability brought by non-check inventory service

Agenda

To enable user avatar travel from a grid service to another grid service, There are 3 problems to be considered:

1. How to enable foreign user login - Authentication
2. (If a foreign user can login)How to get a foreign user's belongings(including appearance, inventory)
3. Security
   • This is discussed in this page

To achieve the 1st, client side changes are needed. SO, so far, I have only implemented 2nd, and would like to explan my idea: