Tank Auth v1.0 (CI authentication library)

[eluser]jfouse[/eluser]
This looks to be pretty good stuff, Gromozeka, especially given the auth lib forum thread I believe you worked off of. I'm looking to migrate to it from FreakAuth Light in the near future, probably building a groups/roles bit to sit on top of it. I have a tiny nit to pick though, and a more substantial issue to raise. The minor thing is simply that I notice you've used "authentication" and "authorization" somewhat interchangeably, but they're different things. Authentication concerns who you are, while authorization is about what you have access to. From what you've said, Tank Auth is for authentication and specifically NOT about authorization (roles, access control lists, etc).

The more serious issue was rather surprising to me, given that one of your goals was increased security -- passwords should never be emailed. Period. It's an easy enough fix in your lib -- simply comment out/remove the relevant lines from the html and email views -- so it's not a show stopper as far as I'm concerned, but the error is significant enough to warrant raising it here. I seriously recommend that you re-think that as part of the standard install. It's almost like you've got a good foundation and solid walls, but there's a screen door flapping open on the back porch.