Good implementations like for TDCanadaTrust have you authenticate and then it keeps a token on your account that allows you to continue updating your accounts for a while but you do need to eventually authenticate again.  Sounds like RBC and Scotia both did it the dumb way (not surprising).