Authentication is the sort of thing that gets set up very early in the life of the application, and usually doesn't run into issues or need new features. When I

Authentication is the sort of thing that gets set up very early in the life of the application, and usually doesn't run into issues or need new features. When I've read production authentication/authorization code for apps I've worked on, it's usually been out of interest, not necessity. I feel like many, many people could work on that application, understand clear text passwords are wrong, and just not know that the application works that way.