This sounds like using whatever API is provided for "make sure the correct user is present", rather than doing "here's a text field, please enter your password"

This sounds like using whatever API is provided for "make sure the correct user is present", rather than doing "here's a text field, please enter your password". Only that second one would really be concerning.