To my thinking, auth is hard and the complexities shouldn't be glossed over. And you don't want to bog a newbie down by making them understand what rainbow tables and replay attacks are. So it's better to skip that and circle back around later once they get some familiarity with web dev in general.