I think they don't include it not because you should roll your own (you really shouldn't) but because they don't make the assumption that you'll need it. Once they start adding that stuff by default they'll no longer be a 'microframework'.

But yes, definitely grab a third party extension for auth :)