strong auth via CRAM-SHA256 draft

In this case I'd like to modify our standard workflow to involve someone from infosec in the review process after you ack it and before you merge it to master.