Some good points. Other links of interest: http://tools.ietf.org/html/rfc6819 and OWASP cheat sheets, including ones on authentication in general: https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series amongst other resources on Google ;-)