Although it might looks like a weird design choice, an installed app was the only possible choice not to store the user credentials on our servers. I have elaborated this in another post.