Sorry I should have put in the post that I don't want to use Oauth because I want to see what's possible with a non 3rd party auth. I always see the "dont roll

Sorry I should have put in the post that I don't want to use Oauth because I want to see what's possible with a non 3rd party auth. I always see the "dont roll your own auth" message being tossed around, and this site provides a great lab for testing the waters of owning auth: no email to leak, nothing serious to protect.