Use the architecture of Unhosted apps

[b1conrad]

to display information about affiliates other than the affiliate who is looking at the alphabetic list.

This needs to use a separate ECI so that it can be easily revoked. This means that each affiliate needs to present an API through a channel that allows read-only access to just the information each one is willing to share in that way.

The ECI becomes a combination of a client ID and a person ID in that it authorizes the client (the unhosted app) to access the personal API and also identifies the particular person whose API is being called. We are lacking any equivalent to a client secret.