Users are not authenticated before the LoginUser Web service is called, so there is no specific security policy recommendation for this service.