Enterprise Authentication: Understanding the Security/Simplicity Trade-off