Not everyone has a Gmail account, so if your app is of any consequence, you won't use Google auth on GAE. You'll roll your own.

GAE won't let you upload and run modules that are C-based, so bcrypt is out of the question.