You can wrap a telnet session in TLS pretty easily which then protects the plain text password floating by.
I've also been playing around with OAuth inside of a telnet session, but it's a little wonky as you might guess. If you're signed into Grapevine (mentioned above as well) this link will have you auto signed into a telnet session: https://grapevine.haus/games/Spigot/play
Hey, I'm the developer behind Grapevine, thanks for the mention! If anyone is interested in how the Grapevine web client works, it's all open source and written in Elixir with the front end being React/Redux.
I've also been playing around with OAuth inside of a telnet session, but it's a little wonky as you might guess. If you're signed into Grapevine (mentioned above as well) this link will have you auto signed into a telnet session: https://grapevine.haus/games/Spigot/play
This is my draft spec (it's not completely filled in but the idea is there) https://gist.github.com/oestrich/1fc022a448c36ac2aa5a099f4ca...
Spigot and Grapevine are also open source if you wanted to poke around.