We should have a lab where the students focus on designing user authentication. This is better than current state of passwd/pwdpolicies, where they just focus on passwords for user authentication.
We can provide a few scenarios for which the students should design the needed authentication --- after first identity the needs.