Comment 4 for bug 1009262

That authenticate_user_account function has to stick around for a while, because third party auth plugins rely on it. But it doesn't need to be called on any of the auth methods in core, we could add some new function that takes an object, as Craig suggested, and only call authenticate_user_account for those auth methods that don't implement the new function (or something like that). Might be a good thing to do anyway, because some auth methods don't want to see a password.