Creating a user information microservice

We could implement user authentication and accounts by simply adding a user model, and a few routes and views to the existing Notes application. While it would be accomplishable, is this what we would do in a real-world production application?

Consider the high value of user identity information, and the super-strong need for robust and reliable user authentication. Website intrusions happen regularly, and it seems the item most frequently stolen is user identities. 

Can you design and build a user authentication system with the required level of security?  One that is probably safe against all kinds of intruders?

As with so many other software development problems, it's best to use a pre-existing authentication library, preferably one with a long track record, where significant bugs have been fixed already.

Another issue is architectural choices to promote security. Bugs will occur and the talented miscreants will break in. Walling off the user information...