Practical Security Guidance for Authentication-System Designers