I feel that all authentication standards are bloated. Maybe there are reasons why they are like that.