One coder used framework he didn't completely understand. Originally there wasn't password requirement for users. But when site got more confidential data passw

One coder used framework he didn't completely understand. Originally there wasn't password requirement for users. But when site got more confidential data password feature had to be added. Well how it was done? When user gave login and clicked ok, came page asking for password. But if you changed url at this point, everything worked. When I checked the actual code, the user form logged user in and password form logged user out if password was incorrect. Oh boy, I did praise that guy. Same guy used base64 encryption, so urls would be unguessable. Guess if there's real authentication at all if you modify the url content correctly. - Well, of course there isn't. Btw. Why there aren't negative recommendations at linkedin?