> If you want to securely create a new user account, you POST to Stormpath’s API. And I must trust you handle it properly. If I understood correctly, Stormpath

> If you want to securely create a new user account, you POST to Stormpath’s API. And I must trust you handle it properly. If I understood correctly, Stormpath saves the password for me for my users? If so, no. If I were to do that, I would have enable oauth and openid (which is a pain in the ass to find a library that actually passes security audit today!) or I'd just switch to Persona myself. To solve real authentication issue, we need a layer that works nice. Pyramid has a nice authentication layer, though I find that layer poorly documented or just confusing to work with (I have conquered that hurtle but to be honest, it was hard!). There is a real reason why I prefer the Django style. It built a basic authentication layer for me (username password default). The downside is ORM and user are tightly coupled with Django. There is a tradeoff, obviously. But if there were a single API call which I could use to map to any openID, oauth, that'd be really great. Does stormpath do it? That's what I need as a library. Why can't we make oauth, openid like network protocol having layered protocol design? It's still quite a mess to me that we don't have a standard reference implementation for major languages well enough to be trusted (both consumer and provider). Last year for a project I almost had to implement my own oauth provider implementation because other existing projects are either incomplete or dead.