Got Stripe metadata security working!! It will now only get/set it if the Google/Microsoft access token is valid & points to the correct email address.