You should add this. Savvy people will be positively surprised to see a company actually caring about doing password authentication right.