Which two considerations should an architect point out to UC?

Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process .

Which two considerations should an architect point out to UC? Choose 2 answers
A . The web application should be hosted on a secure server.
B . The web server must be able to protect consumer privacy
C . The flow involves passing the user credentials back and forth.
D . The flow will not provide an Oauth refresh token back to the server.

Answer: A,B