Very interesting.  Thanks for posting the URL.  I also found the
following paragraph to be very interesting and follows my philosophy
of just using the user id.

"And now a word from the System Admin (aka the BOFH): The process of
collecting credentials from a user-mode application can provide a
possible security hole in a network computing environment (as well as
being annoying to a user). The Unified Logon requirement (which
specifies that the user should only have to type his or her
credentials once, at the logon screen), was added to the Microsoft
BackOffice logo requirements for these reasons. It is important to
ascertain whether your application's design really must rely on asking
for a user's complete credentials, or whether a more secure method of
credential validation is not more appropriate, for example by
reconfirming just the user name as shown in Verifying a User Account
using LookupAccountName . Regardless of the validation, it is strongly
recommended that all developers consult both the local system
administrator as well as security documentation in the Platform SDK
for guidance.:"

Tony