- being able to register, probably requiring a valid email address to confirm the registration (if email is used to register at all)
- being able to recover a lost password
- Using a recovery email with a one-time token
- Using a SMS to a known mobile number, if applicable
- Using an answer to a secret question (which probably needs to be guarded as tightly as the password itself)
- being able to disable or delete an account
- being able to upload an avatar and then crop it online
- being able to delete said avatar
- being able to log out
- being able to log out from all sessions
- having a "remember me" functionality that doesn't span too far when sensitive data is being edited
- being able to create an account by logging in from a social network
- being able to link a social network account to an existing profile
- being able to unlink a social network account
- being able to use 2-factor authentication to log in (like a code sent to email address or an SMS) or do something sensitive after logging in
- being able to grab missing profile information from a social network account and apply it but only if it was missing originally
That makes it quite a lot, actually.
