Authentication looks easy, until you build it for real users.