I just read up the thread. Sorry - I thought it was simple lead capture you were doing.. if you're logging users in you'll need the full solution I reckon. One VERY big warning. Ensure that you reuse the token in authenticating with SF (e.g. don't log in for each API request) - we hit the SF limit during the client's busiest period and it just locked the third party payment system out. My stuff was build to reuse the token so we copied that logic over.