Why can't we use static objects?

The use of a "default" authentication "system" is only acceptable if it can be disabled by the developer.  The developer might not want to use the default authentication and must be allowed to replace it with another auth system.  I think this could be implemented as a simple configuration flag. 

They really wouldn't even need a configuration flag. They could allow it to be overridden just like almost every other class in CodeIgniter, so the replacement could be as simple as dropping a MY_Authentication class into the application.

I agree with the basic idea that CI is best served by staying simple and limiting what's included in the core system, but I think people often overlook how easy CI usually makes it to override and extend the included functionality.

Bonfire

Practical CodeIgniter 3
CodeIgniter Testing Guide