My biggest concern is that as it sits, this will not work for users using the data bag method of populating credentials. I'd rather:

1) Most of this be moved into libraries/ -- even if it's not combined with the existing cm object for the reasons you say
2) This support all methods of providing authentication credentials