Auth
A login screen is a prompt away. The part that matters is whether a request without a valid session is rejected, whether a reset goes to the right person, and whether you can revoke a session. The tools can write that code. Read it, or have someone who can read it read it, before other people depend on it.