Just a suggestion, but wouldn't it be better to get Nova users to send through read-only api keys so you can check balances rather than having to login as them? Would be easier all around and safer I would think.