Security concerns and a desire to have an integrated authn/authz combination nobbled it. Nothing is as simple or elegant :-(