I believe the maintainers regard authentication, rightly or wrongly, as a business-level feature. Not so much the mechanics of checking a user's credentials but how you want to steer the different authentication flows.