> That's a good point but I claim it boils down to an (interesting) UI problem. In > any case, separating the authentication factors (using the post-login handler > or whatever) permits some interesting flows that are currently not possible. Definitely!