If a filter were to be used on wp_authenticate, why would the function need to be in pluggable.php (save for backwards compatibility)? -- http://scribu.net