I was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a re

I was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a reset every time anyway.