I believe that auth is in Derby, although it has just yet to be documented formally...
This is correct. We have been developing and testing auth with our own app, and we'll publish a simple example using it soon.
Only because I'm the nitpicky type...
> The majority of apps (and games) require the ability to show one user X+Y and another user Y+Z
That's authorization, not authentication.
Looking now, I see a vague reference to server-side logic (in the context of recommending against it!), but nothing about auth specifically. Has anything changed or improved on this front, or are there any plans to do so?