Privacy and account protection requirements.
Production implementation should include HTTPS/SSL, secure password hashing, optional two-factor authentication, account change/delete controls, cookie consent, registration consent, password reset, session timeout and regular database backups.