For builder and perf. we switched to two legged oAuth. For creating webapps from external sites, we'll need to switch back to three legged oAuth. I think that's all there in the code, from before, hopefully this is just a matter of turning the code back on. Let's put this behind a flag.
I don't want to go near piston again and I don't think we need to worry about this. The marketplace API is where it's at these days.