That is also another goal I would like to add - is the ability to cross-check passwords against the API so you can prevent users from using them.