Because there are a million different ways to do user authentication and authorization: LDAP, OAuth, cookies, federated logins, challenge-response devices, etc.

Because there are a million different ways to do user authentication and authorization: LDAP, OAuth, cookies, federated logins, challenge-response devices, etc. A framework or library that tries to handle all these scenarios becomes abstract, hard to use, and not very powerful because it can only rely on the greatest common denominator. Django's auth is reasonable to get started, but probably not what you want to use for a production-ready website.