dumb sucks

there's a nigh infinite variety of login / authn / auyhz user interfaces, ui flows, and they all kind of suck, and nothing can tell you or prove to you that the hurdles you have to go through are for valid security reasons rather than just lameness.