Well, i can't have them on the same page if i allow a person to login from a client's website, because then the client could intercept their core account password; however, even on ionisis.com i don't want them on the same page for now, because i have no SSL (well, i DO, but it's self signed), so someone could intercept it there if it was plain text. This way the password is encrypted before the user enters the email, and then the encrypted password and plain text email are sent together for the login.
Fun stuff, when working systems over an api  .
|