I know that I've found that above the base features that many frameworks provide such as DJango - if you start pulling the thread on features like forgot passwo

I know that I've found that above the base features that many frameworks provide such as DJango - if you start pulling the thread on features like forgot password / reset password - I quickly find there is a lot of coding to be done. Click reset, store a unique id, send the user an email with a link including the unique id, verify that ID on the request and then allow a password change. Then to be secure that unique id needs to be timed out once it is generated to ensure the link is only good for a short period of time, etc. Not to say anyone couldn't code all of that, but some of the simple features once fully thought out end up being fairly complex. In my experience many of the out of the box options still need to be extended to be fully realized for enterprise usage. I don't have a ton of experience with DJango specifically so I could be mistaken - perhaps it does more than I know.