The Research-Practice Gap in User Authentication