All is well if you use it with its own collection of credentials. Things get tricky if you need to integrate with a directory. Running it behind Apache becomes almost a necessity.