Jeez. In any product, this should be a showstopper.
Claiming to provide authentication and putting it in the client while ignoring issues that point it out is MUCH worse that just stating they don't provide authentication.
The illusion of security is often more dangerous than no security, because even security-conscious users can be fooled.
