title: Need some help trying to get my ASP.NET MVC 3 Razor "Sign Up" view working
body: <p>I'm playing around with ASP.NET MVC3 and I'm trying to do a simple <em>Sign Up</em> 'form'. Now, the kicker is that I'm trying to make it a Wizard with 2 steps.</p>
  
  <ol>
  <li>Authenticate with Facebook/Twitter/Your Fav OpenId provider.</li>
  <li>Fill in any missing data which I require (eg. email address and name).</li>
  </ol>
  
  <p>Step 1 works 100% great :) So don't worry about that.
  Step 2 is where I have the questions.</p>
  
  <p>So to the questions :-</p>
  
  <ol>
  <li>View is strongly typed. The Model is a Poco <code>USER</code>. It has an <code>ICollection&lt;string&gt;</code> OpenIds. I wish to only display the first one in the Razer View. (which was set in Step 1).</li>
  </ol>
  
  <p>eg.</p>
  
  <pre><code>&lt;div class="editor-label"&gt;
      &lt;label for="Identifier"&gt;Identifier&lt;/label&gt;
  &lt;/div&gt;
  &lt;div class="editor-field"&gt;
      @Html.LabelFor(x =&gt; x.OpenIds.FirstOrDefault())
  &lt;/div&gt;
  </code></pre>
  
  <p>But that gives me the following evil error :-</p>
  
  <blockquote>
    <blockquote>
      <p>Templates can be used only with field access, property access, single-dimension array index, or single-parameter custom indexer expressions.</p>
    </blockquote>
  </blockquote>
  
  <p>Secondly, I'm not sure if there's some security implementations I should consider .. because this is a <code>SignUp</code> wizard to some regards - isn't it possible that the user can jump straight to step 2 (ie. <code>HTTP-GET /authentication/new</code>) and not have provided an OpenId identity OR provide any one .. but because they skipped the first step (which sends the user to the OpenId website and back here again) ... they have avoided authentication. What steps should I provide to protect against this type of hack? I can't use the <code>[Authorize]</code> attribute on either Step 1 or Step 2 because it's only at the end of step 2 (ie <code>HTTP-POST /authentication/create</code>) .. do I finally <code>FormsAuthentication.SignIn(..)</code>.</p>
  
  <p>Phew! Did that make sense?</p>
  
  <p>Cheers :)</p>