A3M - Account Authentication & Authorization Module

[eluser]Peng Kong[/eluser]
i must mention that a3m has some controversial design decisions in terms of usability.
which not everyone will agree upon. but based on certain principles, i choose to take that path. off my head the two most controversial design decisions is...

1) for traditional authentication, one can only login with username/password
not email. the reason is emails can be repeated. meaning two users can have the same email. which stems from another design decision. should we ask users to go thru that painful 'verify email' process? why do we want users to verify emails? yada yada... i think there's a long ass discussion on this somewhere in this thread. but basically the a3m conclusion is that. one of the main ideas of a3m is to super charge the sign in and sign up process in terms of usability. the question i keep asked myself is "What is the easiest and most pain free way to do this." no one likes sign in and sign up so we should make it as pain free as possible. even if it means giving up a bit of security.. that's acceptable (save your flames

2) you don't need to type ur existing password to change a password
juz be signed in and you can change ur password. we can sit here and argue all day on this and still not come to agreement, but after careful consideration, survey conducted internally, we decided it's not necessary. I say "we" becuz my colleagues helped me brainstorm many of these decision thru and thru.

users are users at the end of the day, all the want is to get something done. they won't care even if they write their password down and tell it to their friend, bah bah... all the things which geeks and security dude would jump at. So the disclaimer is a3m isn't designed for your internet banking website.. it's designed for your social websites and community portals, etc. basically if someone loses his acc there's no heart stopping repercussions. admin simply helps him reset his password! Don't punish 95% of users with bad usability becuz of 5% of users who are going to lose their password. Somewhat that's the idea.