@searls I've been fixing an inherited app which did a disturbing amount of username and password validation on the client side - which had been done by a separate team from the backend. Total mess. PW stored in MD5 after all that too FML