> Regarding the ZKPP, it is implemented I'm not sure how that squares with the // TODO: Insert cryptography here comment in the source code of your demo

> Regarding the ZKPP, it is implemented I'm not sure how that squares with the // TODO: Insert cryptography here comment in the source code of your demo app's login endpoint -- which doesn't appear to make use of the user's password at all? Surely that can't be right.