It's also a good idea to make it request only the minimum amount of information from the auth provider (e.g., name and email address). I (and I think others) have become wary of sites that ask for full access when there's no obvious reason for it.