I would generally assume it's much closer to "code, code, code, cookie[key] = crypt(password), code, code". Many (most?) crypto libraries have incredibly accid

I would generally assume it's much closer to "code, code, code, cookie[key] = crypt(password), code, code". Many (most?) crypto libraries have incredibly accident-prone APIs. When presented with both `crypt(input) -> encrypted` and `crypt(input, iv, nonce, secret, etc, wtf, abc | 23 << 2) -> encrypted`, which do you choose?