i suppose the main reason is that we don't want clients to handle user creds such as passwords, but we do want them to a. authz to write as the user, b. authn user w/ a DID. similar setting to indieauth where the AS is not known by the client in advance & global user id from the AS requires a check.