* don’t try to implement the hard/annoying bits (strange access detection, account recovery, sending emails, password storage)
* keep ownership of your user list and users’ capabilities
It depends on the use case.
* don’t try to implement the hard/annoying bits (strange access detection, account recovery, sending emails, password storage)
* keep ownership of your user list and users’ capabilities