Security pros have made progress in mitigating identification and authentication failures — but that doesn't mean we can takes our eyes off the ball.