Which two considerations should an architect point out to UC?

Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process.

Which two considerations should an architect point out to UC? Choose 2 answers
A . The web application should be hosted on a secure server.
B. The web server must be able to protect consumer privacy
C. The flow involves passing the user credentials back and forth.
D. The flow will not provide an Oauth refresh token back to the server.

Answer: A,B