Not sure what all jdporter had in mind, but bcrypted passwords seems like it is towards the top of the list. And emailing password reset links instead of passwords is kind of a prerequisite for that.
--
A math joke: r = | |csc(θ)|+|sec(θ)| |-| |csc(θ)|-|sec(θ)| |