In addition to what was said: there is always a tradeoff between usability and security and I trust that the Google engineers did a very throughout evaluation of the different options - which they possibly could share with you so that you can push back on the auditors.
Attila -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To unsubscribe from this group and stop receiving emails from it, send an email to google-appengine+unsubscr...@googlegroups.com. To post to this group, send email to google-appengine@googlegroups.com. Visit this group at https://groups.google.com/group/google-appengine. To view this discussion on the web visit https://groups.google.com/d/msgid/google-appengine/911e93b9-969f-47d8-9f06-affe84475902%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
