Is using the Streaming API, or other application-only APIs, inadvisable directly from the user client? The user would need the app’s OAuth tokens which would expose them to every user and make them insecure. Are there any alternatives to keeping the tokens secure or using the Streaming API differently?