Facebook adds some advantages like marketing targets and segmentation based on visits, but it could also be blocked by Firefox and Adblockers these days.

Yeah, I have a list of articles I'm meaning to add to the How-To section, that's why I suggested it.

Just need to finish the project I'm currently working on.

Forums is way too difficult to make usable, I'd rather they focus on what's currently in the system.

There's basically only two forums businesses host these days, NodeBB, PHPbb with vBulletin still hanging on. I always recommend NodeBB (Like Appdrag is using now), but it has to be properly managed.

The customization is what what I love most about this system and why we choose it, but the majority of sites we'll create won't need customized authorization.

And I'm sure very few in total will need it. For example, being able to check if the user is currently logged in, inside of an API function, goes a long way and don't need custom authorization layer.

Our process is to always focus first on having fully customizable solutions with source code and with cloud backend
then later we do create plugins based on that.

And for good reason, security issues in the Video guide:

1. The eMail input is not checked for validity.
2. Token is not payload size checked (Doesn't matter in this case)
3. Same with Password input (Probably checked on DB Layer)
4. Token is always the same, should be unique for every session
5. Token can be stolen via javascript (Example, any script you add to the site, like chat, can grab the token and re-use it to authenticate). Better would be a secure cookie, that cannot be stolen using scripting.
6. Session lifetime is infinite, it never expires.
7. Token is in plaintext, should be encrypted and hashed with secret internally to verify it's validity (Preferably use JWT instead).
8. Protecting secret content with javascript, disable javascript and anyone can access the page content.
9. eMail is not verified by link (As should be done with a one-time JWT token)
10. Logins aren't rate-limited, so someone can brute-force it until you run out of API function time - thus, no one can login any more until you pay for more API time, rinse and repeat...

So why am I still using it?
Because we've built our own authentication system that we're going to use.

It's annoying because Appdrag doesn't seem to want to solve it themselves by building it in from the get-go.

The point about rolling our own DIY authentication is a very valid point and concern, even if you do know how to code.