> Twitter just has a broken model where they want to authenticate the application as well as the user...

Can you elaborate? As far as I understand how it works, this is the case by design in OAuth.

(edit: typo)