Index: .travis.yml
===================================================================
--- .travis.yml	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ .travis.yml	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -3,5 +3,5 @@
 
 script:
- - ./configure --pam=1 --ldap=1
+ - ./configure
  - make check
  - BITLBEE_SKYPE=plugin dpkg-buildpackage -uc -us -d
@@ -29,6 +29,4 @@
     - libpurple-dev
     - check
-    - libpam0g-dev
-    - libldap2-dev
   coverity_scan:
     project:
@@ -36,5 +34,5 @@
       description: "An IRC to other chat networks gateway"
     notification_email: dx@dxzone.com.ar
-    build_command_prepend: ./configure --otr=1 --debug=1 --pam=1 --ldap=1
+    build_command_prepend: ./configure --otr=1 --debug=1
     build_command: make
     branch_pattern: coverity_scan
Index: Makefile
===================================================================
--- Makefile	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ Makefile	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -10,5 +10,5 @@
 
 # Program variables
-objects = bitlbee.o dcc.o help.o ipc.o irc.o irc_im.o irc_cap.o irc_channel.o irc_commands.o irc_send.o irc_user.o irc_util.o nick.o $(OTR_BI) query.o root_commands.o set.o storage.o $(STORAGE_OBJS) auth.o $(AUTH_OBJS) unix.o conf.o log.o
+objects = bitlbee.o dcc.o help.o ipc.o irc.o irc_im.o irc_cap.o irc_channel.o irc_commands.o irc_send.o irc_user.o irc_util.o nick.o $(OTR_BI) query.o root_commands.o set.o storage.o $(STORAGE_OBJS) unix.o conf.o log.o
 headers = $(wildcard $(_SRCDIR_)*.h $(_SRCDIR_)lib/*.h $(_SRCDIR_)protocols/*.h)
 subdirs = lib protocols
Index: th.c
===================================================================
--- auth.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ 	(revision )
@@ -1,65 +1,0 @@
-#define BITLBEE_CORE
-#include "bitlbee.h"
-
-#ifdef WITH_PAM
-extern auth_backend_t auth_pam;
-#endif
-#ifdef WITH_LDAP
-extern auth_backend_t auth_ldap;
-#endif
-
-GList *auth_init(const char *backend)
-{
-	GList *gl = NULL;
-	int ok = backend ? 0 : 1;
-#ifdef WITH_PAM
-	gl = g_list_append(gl, &auth_pam);
-	if (backend && !strcmp(backend, "pam")) {
-		ok = 1;
-	}
-#endif
-#ifdef WITH_LDAP
-	gl = g_list_append(gl, &auth_ldap);
-	if (backend && !strcmp(backend, "ldap")) {
-		ok = 1;
-	}
-#endif
-
-	return ok ? gl : NULL;
-}
-
-storage_status_t auth_check_pass(irc_t *irc, const char *nick, const char *password)
-{
-	GList *gl;
-	storage_status_t status = storage_check_pass(irc, nick, password);
-
-	if (status == STORAGE_CHECK_BACKEND) {
-		for (gl = global.auth; gl; gl = gl->next) {
-			auth_backend_t *be = gl->data;
-			if (!strcmp(be->name, irc->auth_backend)) {
-				status = be->check_pass(nick, password);
-				break;
-			}
-		}
-	} else if (status == STORAGE_NO_SUCH_USER && global.conf->auth_backend) {
-		for (gl = global.auth; gl; gl = gl->next) {
-			auth_backend_t *be = gl->data;
-			if (!strcmp(be->name, global.conf->auth_backend)) {
-				status = be->check_pass(nick, password);
-				/* Save the user so storage_load will pick them up, similar to
-				 * what the register command would do */
-				if (status == STORAGE_OK) {
-					irc->auth_backend = g_strdup(global.conf->auth_backend);
-					storage_save(irc, (char *)password, 0);
-				}
-				break;
-			}
-		}
-	}
-
-	if (status == STORAGE_OK) {
-		irc_setpass(irc, password);
-	}
-
-	return status;
-}
Index: th.h
===================================================================
--- auth.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ 	(revision )
@@ -1,13 +1,0 @@
-#ifndef __BITLBEE_AUTH_H__
-#define __BITLBEE_AUTH_H__
-
-#include "storage.h"
-
-typedef struct {
-	const char *name;
-	storage_status_t (*check_pass)(const char *nick, const char *password);
-} auth_backend_t;
-
-GList *auth_init(const char *backend);
-storage_status_t auth_check_pass(irc_t *irc, const char *nick, const char *password);
-#endif
Index: th_ldap.c
===================================================================
--- auth_ldap.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ 	(revision )
@@ -1,77 +1,0 @@
-#define BITLBEE_CORE
-#define LDAP_DEPRECATED 1
-#include "bitlbee.h"
-#include <ldap.h>
-
-static storage_status_t ldap_check_pass(const char *nick, const char *password)
-{
-	LDAP *ldap;
-	LDAPMessage *msg, *entry;
-	char *dn = NULL;
-	char *filter;
-	char *attrs[1] = { NULL };
-	int ret, count;
-
-	if((ret = ldap_initialize(&ldap, NULL)) != LDAP_SUCCESS) {
-		log_message(LOGLVL_WARNING, "ldap_initialize failed: %s", ldap_err2string(ret));
-		return STORAGE_OTHER_ERROR;
-	}
-
-	/* First we do an anonymous bind to map uid=$nick to a DN*/
-	if((ret = ldap_simple_bind_s(ldap, NULL, NULL)) != LDAP_SUCCESS) {
-		ldap_unbind_s(ldap);
-		log_message(LOGLVL_WARNING, "Anonymous bind failed: %s", ldap_err2string(ret));
-		return STORAGE_OTHER_ERROR;
-	}
-
-
-	/* We search and process the result */
-	filter = g_strdup_printf("(uid=%s)", nick);
-	ret = ldap_search_ext_s(ldap, NULL, LDAP_SCOPE_SUBTREE, filter, attrs, 0, NULL, NULL, NULL, 1, &msg);
-	g_free(filter);
-
-	if(ret != LDAP_SUCCESS) {
-		ldap_unbind_s(ldap);
-		log_message(LOGLVL_WARNING, "uid search failed: %s", ldap_err2string(ret));
-		return STORAGE_OTHER_ERROR;
-	}
-
-	count = ldap_count_entries(ldap, msg);
-	if (count == -1) {
-		ldap_get_option(ldap, LDAP_OPT_ERROR_NUMBER, &ret);
-		ldap_msgfree(msg);
-		ldap_unbind_s(ldap);
-		log_message(LOGLVL_WARNING, "uid search failed: %s", ldap_err2string(ret));
-		return STORAGE_OTHER_ERROR;
-	}
-
-	if (!count) {
-		ldap_msgfree(msg);
-		ldap_unbind_s(ldap);
-		return STORAGE_NO_SUCH_USER;
-	}
-
-	entry = ldap_first_entry(ldap, msg);
-	dn = ldap_get_dn(ldap, entry);
-	ldap_msgfree(msg);
-
-	/* And now we bind as the user to authenticate */
-	ret = ldap_simple_bind_s(ldap, dn, password);
-	g_free(dn);
-	ldap_unbind_s(ldap);
-
-	switch (ret) {
-		case LDAP_SUCCESS:
-			return STORAGE_OK;
-		case LDAP_INVALID_CREDENTIALS:
-			return STORAGE_INVALID_PASSWORD;
-		default:
-			log_message(LOGLVL_WARNING, "Authenticated bind failed: %s", ldap_err2string(ret));
-			return STORAGE_OTHER_ERROR;
-	}
-}
-
-auth_backend_t auth_ldap = {
-	.name = "ldap",
-	.check_pass = ldap_check_pass,
-};
Index: th_pam.c
===================================================================
--- auth_pam.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ 	(revision )
@@ -1,62 +1,0 @@
-#define BITLBEE_CORE
-#include "bitlbee.h"
-#include <security/pam_appl.h>
-
-#define PAM_CHECK(x) do { \
-	ret = (x); \
-	if(ret != PAM_SUCCESS) { \
-		pam_func = #x; \
-		goto pam_error; \
-	} \
-} while(0)
-
-/* This function fills in the password when PAM asks for it */
-int pamconv(int num_msg, const struct pam_message **msg, struct pam_response **resp, void *appdata_ptr) {
-	int i;
-	struct pam_response *rsp = g_new0(struct pam_response, num_msg);
-
-	for (i = 0; i < num_msg; i++) {
-		rsp[i].resp = NULL;
-		rsp[i].resp_retcode = 0;
-		if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF) {
-			rsp[i].resp = g_strdup((char *)appdata_ptr);
-		}
-	}
-	*resp = rsp;
-	return PAM_SUCCESS;
-}
-
-static storage_status_t pam_check_pass(const char *nick, const char *password)
-{
-	int ret;
-	const struct pam_conv pamc = { pamconv, (void*) password };
-	pam_handle_t *pamh = NULL;
-	char *pam_func;
-
-	PAM_CHECK(pam_start("bitlbee", nick, &pamc, &pamh));
-	PAM_CHECK(pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK));
-	PAM_CHECK(pam_acct_mgmt(pamh, 0));
-
-	pam_end(pamh, ret);
-	return STORAGE_OK;
-
-pam_error:
-	switch (ret) {
-		case PAM_AUTH_ERR:
-			pam_end(pamh, ret);
-			return STORAGE_INVALID_PASSWORD;
-		case PAM_USER_UNKNOWN:
-		case PAM_PERM_DENIED:
-			pam_end(pamh, ret);
-			return STORAGE_NO_SUCH_USER;
-		default:
-			log_message(LOGLVL_WARNING, "%s failed: %s", pam_func, pam_strerror(pamh, ret));
-			pam_end(pamh, ret);
-			return STORAGE_OTHER_ERROR;
-	}
-}
-
-auth_backend_t auth_pam = {
-	.name = "pam",
-	.check_pass = pam_check_pass,
-};
Index: bitlbee.conf
===================================================================
--- bitlbee.conf	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ bitlbee.conf	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -52,23 +52,4 @@
 # AuthMode = Open
 
-## AuthBackend
-##
-## By default, the authentication data for a user is stored in the storage
-## backend. If you want to authenticate against another authentication system
-## (e.g. ldap), you can specify that here.
-##
-## Beware that this disables password changes and causes passwords for the
-## accounts people create to be stored in plain text instead of encrypted with
-## their bitlbee password.
-##
-## Currently available backends:
-##
-## - storage (internal storage)
-## - pam (Linux PAM authentication)
-## - ldap (LDAP server configured in the openldap settings)
-#
-# AuthBackend = storage
-#
-
 ## AuthPassword
 ##
@@ -88,11 +69,4 @@
 ## or
 # OperPassword = md5:I0mnZbn1t4R731zzRdDN2/pK7lRX
-
-## AllowAccountAdd
-##
-## Whether to allow registered and identified users to add new accounts using
-## 'account add'
-##
-# AllowAccountAdd 1
 
 ## HostName
Index: bitlbee.h
===================================================================
--- bitlbee.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ bitlbee.h	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -133,5 +133,4 @@
 #include "irc.h"
 #include "storage.h"
-#include "auth.h"
 #include "set.h"
 #include "nogaim.h"
@@ -155,5 +154,4 @@
 	conf_t *conf;
 	GList *storage; /* The first backend in the list will be used for saving */
-	GList *auth;    /* Authentication backends */
 	char *helpfile;
 	int restart;
Index: conf.c
===================================================================
--- conf.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ conf.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -55,8 +55,6 @@
 	conf->runmode = RUNMODE_INETD;
 	conf->authmode = AUTHMODE_OPEN;
-	conf->auth_backend = NULL;
 	conf->auth_pass = NULL;
 	conf->oper_pass = NULL;
-	conf->allow_account_add = 1;
 	conf->configdir = g_strdup(CONFIG);
 	conf->plugindir = g_strdup(PLUGINDIR);
@@ -242,15 +240,4 @@
 					conf->authmode = AUTHMODE_OPEN;
 				}
-			} else if (g_strcasecmp(ini->key, "authbackend") == 0) {
-				if (g_strcasecmp(ini->value, "storage") == 0) {
-					conf->auth_backend = NULL;
-				} else if (g_strcasecmp(ini->value, "pam") == 0 ||
-				         g_strcasecmp(ini->value, "ldap") == 0) {
-					g_free(conf->auth_backend);
-					conf->auth_backend = g_strdup(ini->value);
-				} else {
-					fprintf(stderr, "Invalid %s value: %s\n", ini->key, ini->value);
-					return 0;
-				}
 			} else if (g_strcasecmp(ini->key, "authpassword") == 0) {
 				g_free(conf->auth_pass);
@@ -259,10 +246,4 @@
 				g_free(conf->oper_pass);
 				conf->oper_pass = g_strdup(ini->value);
-			} else if (g_strcasecmp(ini->key, "allowaccountadd") == 0) {
-				if (!is_bool(ini->value)) {
-					fprintf(stderr, "Invalid %s value: %s\n", ini->key, ini->value);
-					return 0;
-				}
-				conf->allow_account_add = bool2int(ini->value);
 			} else if (g_strcasecmp(ini->key, "hostname") == 0) {
 				g_free(conf->hostname);
Index: conf.h
===================================================================
--- conf.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ conf.h	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -37,8 +37,6 @@
 	runmode_t runmode;
 	authmode_t authmode;
-	char *auth_backend;
 	char *auth_pass;
 	char *oper_pass;
-	int allow_account_add;
 	char *hostname;
 	char *configdir;
Index: configure
===================================================================
--- configure	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ configure	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -52,7 +52,4 @@
 ssl=auto
 
-pam=0
-ldap=0
-
 pie=1
 
@@ -136,7 +133,4 @@
 --purple=0/1	Disable/enable libpurple support	$purple
 		(automatically disables other protocol modules)
-
---pam=0/1	Disable/enable PAM authentication	$pam
---ldap=0/1	Disable/enable LDAP authentication	$ldap
 
 --doc=0/1	Disable/enable help.txt generation	$doc
@@ -634,31 +628,4 @@
 done
 echo "STORAGE_OBJS="$STORAGE_OBJS >> Makefile.settings
-
-authobjs=
-authlibs=
-if [ "$pam" = 0 ]; then
-	echo '#undef WITH_PAM' >> config.h
-else
-	if ! echo '#include <security/pam_appl.h>' | $CC -E - >/dev/null 2>/dev/null; then
-		echo 'Cannot find libpam development libraries, aborting. (Install libpam0g-dev?)'
-		exit 1
-	fi
-	echo '#define WITH_PAM' >> config.h
-	authobjs=$authobjs'auth_pam.o '
-	authlibs=$authlibs'-lpam '
-fi
-if [ "$ldap" = 0 ]; then
-	echo '#undef WITH_LDAP' >> config.h
-else
-	if ! echo '#include <ldap.h>' | $CC -E - >/dev/null 2>/dev/null; then
-		echo 'Cannot find libldap development libraries, aborting. (Install libldap2-dev?)'
-		exit 1
-	fi
-	echo '#define WITH_LDAP' >> config.h
-	authobjs=$authobjs'auth_ldap.o '
-	authlibs=$authlibs'-lldap '
-fi
-echo AUTH_OBJS=$authobjs >> Makefile.settings
-echo EFLAGS+=$authlibs >> Makefile.settings
 
 if [ "$strip" = 0 ]; then
Index: irc.h
===================================================================
--- irc.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ irc.h	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -92,5 +92,4 @@
 	                   logging in, this may contain a password we should
 	                   send to identify after USER/NICK are received. */
-	char *auth_backend;
 
 	char umode[8];
Index: irc_cap.c
===================================================================
--- irc_cap.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ irc_cap.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -177,7 +177,4 @@
 
 	} else if (g_strcasecmp(cmd[1], "END") == 0) {
-		if (!(irc->status & USTATUS_CAP_PENDING)) {
-			return;
-		}
 		irc->status &= ~USTATUS_CAP_PENDING;
 
Index: irc_commands.c
===================================================================
--- irc_commands.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ irc_commands.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -97,5 +97,5 @@
 	/* just check the password here to be able to reply with useful numerics
 	 * the actual identification will be handled later */
-	status = auth_check_pass(irc, user, pass);
+	status = storage_check_pass(user, pass);
 
 	if (status == STORAGE_OK) {
Index: protocols/account.c
===================================================================
--- protocols/account.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ protocols/account.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -67,5 +67,5 @@
 
 	s = set_add(&a->set, "password", NULL, set_eval_account, a);
-	s->flags |= SET_NOSAVE | SET_NULL_OK | SET_PASSWORD | ACC_SET_LOCKABLE;
+	s->flags |= SET_NOSAVE | SET_NULL_OK | SET_PASSWORD;
 
 	s = set_add(&a->set, "tag", NULL, set_eval_account, a);
@@ -73,5 +73,5 @@
 
 	s = set_add(&a->set, "username", NULL, set_eval_account, a);
-	s->flags |= SET_NOSAVE | ACC_SET_OFFLINE_ONLY | ACC_SET_LOCKABLE;
+	s->flags |= SET_NOSAVE | ACC_SET_OFFLINE_ONLY;
 	set_setstr(&a->set, "username", user);
 
Index: protocols/account.h
===================================================================
--- protocols/account.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ protocols/account.h	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -63,5 +63,4 @@
 	ACC_SET_OFFLINE_ONLY = 0x02,    /* Allow changes only if the acct is offline. */
 	ACC_SET_ONLINE_ONLY = 0x04,     /* Allow changes only if the acct is online. */
-	ACC_SET_LOCKABLE = 0x08         /* Setting cannot be changed if the account is locked down */
 } account_set_flag_t;
 
@@ -71,5 +70,4 @@
 	ACC_FLAG_HANDLE_DOMAINS = 0x04, /* Contact handles need a domain portion. */
 	ACC_FLAG_LOCAL = 0x08,          /* Contact list is local. */
-	ACC_FLAG_LOCKED = 0x10,         /* Account is locked (cannot be deleted, certain settings can't changed) */
 } account_flag_t;
 
Index: root_commands.c
===================================================================
--- root_commands.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ root_commands.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -143,7 +143,8 @@
 	}
 
-	status = auth_check_pass(irc, irc->user->nick, password);
-	if (load && (status == STORAGE_OK)) {
+	if (load) {
 		status = storage_load(irc, password);
+	} else {
+		status = storage_check_pass(irc->user->nick, password);
 	}
 
@@ -158,4 +159,5 @@
 		irc_rootmsg(irc, "Password accepted%s",
 		            load ? ", settings and accounts loaded" : "");
+		irc_setpass(irc, password);
 		irc->status |= USTATUS_IDENTIFIED;
 		irc_umode_set(irc, "+R", 1);
@@ -266,9 +268,5 @@
 	storage_status_t status;
 
-	status = auth_check_pass(irc, irc->user->nick, cmd[1]);
-	if (status == STORAGE_OK) {
-		status = storage_remove(irc->user->nick);
-	}
-
+	status = storage_remove(irc->user->nick, cmd[1]);
 	switch (status) {
 	case STORAGE_NO_SUCH_USER:
@@ -342,8 +340,4 @@
 		int st;
 
-		if (s && s->flags & SET_LOCKED) {
-			irc_rootmsg(irc, "This setting can not be changed");
-			return 0;
-		}
 		if (s && checkflags && checkflags(irc, s) == 0) {
 			return 0;
@@ -394,7 +388,4 @@
 		irc_rootmsg(irc, "This setting can only be changed when the account is %s-line", "on");
 		return 0;
-	} else if (a->flags & ACC_FLAG_LOCKED && s && s->flags & ACC_SET_LOCKABLE) {
-		irc_rootmsg(irc, "This setting can not be changed for locked accounts");
-		return 0;
 	}
 
@@ -418,9 +409,4 @@
 
 		MIN_ARGS(3);
-
-		if (!global.conf->allow_account_add) {
-			irc_rootmsg(irc, "This server does not allow adding new accounts");
-			return;
-		}
 
 		if (cmd[4] == NULL) {
@@ -561,8 +547,5 @@
 
 	if (len >= 1 && g_strncasecmp(cmd[2], "del", len) == 0) {
-		if (a->flags & ACC_FLAG_LOCKED) {
-			irc_rootmsg(irc, "Account is locked, can't delete");
-		}
-		else if (a->ic) {
+		if (a->ic) {
 			irc_rootmsg(irc, "Account is still logged in, can't delete");
 		} else {
Index: set.h
===================================================================
--- set.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ set.h	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -49,5 +49,4 @@
 	SET_PASSWORD = 0x0400, /* Value shows up in settings list as "********". */
 	SET_HIDDEN_DEFAULT = 0x0800, /* Hide unless changed from default. */
-	SET_LOCKED = 0x1000    /* Setting is locked, don't allow changing it */
 } set_flags_t;
 
Index: storage.c
===================================================================
--- storage.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ storage.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -87,5 +87,5 @@
 }
 
-storage_status_t storage_check_pass(irc_t *irc, const char *nick, const char *password)
+storage_status_t storage_check_pass(const char *nick, const char *password)
 {
 	GList *gl;
@@ -97,5 +97,5 @@
 		storage_status_t status;
 
-		status = st->check_pass(irc, nick, password);
+		status = st->check_pass(nick, password);
 		if (status != STORAGE_NO_SUCH_USER) {
 			return status;
@@ -171,5 +171,5 @@
 }
 
-storage_status_t storage_remove(const char *nick)
+storage_status_t storage_remove(const char *nick, const char *password)
 {
 	GList *gl;
@@ -185,5 +185,5 @@
 		storage_status_t status;
 
-		status = st->remove(nick);
+		status = st->remove(nick, password);
 		ok |= status == STORAGE_OK;
 		if (status != STORAGE_NO_SUCH_USER && status != STORAGE_OK) {
Index: storage.h
===================================================================
--- storage.h	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ storage.h	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -31,5 +31,4 @@
 	STORAGE_NO_SUCH_USER,
 	STORAGE_INVALID_PASSWORD,
-	STORAGE_CHECK_BACKEND,
 	STORAGE_ALREADY_EXISTS,
 	STORAGE_OTHER_ERROR /* Error that isn't caused by user input, such as
@@ -44,9 +43,9 @@
 	void (*init)(void);
 
-	storage_status_t (*check_pass)(irc_t *irc, const char *nick, const char *password);
+	storage_status_t (*check_pass)(const char *nick, const char *password);
 
 	storage_status_t (*load)(irc_t *irc, const char *password);
 	storage_status_t (*save)(irc_t *irc, int overwrite);
-	storage_status_t (*remove)(const char *nick);
+	storage_status_t (*remove)(const char *nick, const char *password);
 
 	/* May be NULL if not supported by backend */
@@ -54,9 +53,9 @@
 } storage_t;
 
-storage_status_t storage_check_pass(irc_t *irc, const char *nick, const char *password);
+storage_status_t storage_check_pass(const char *nick, const char *password);
 
 storage_status_t storage_load(irc_t * irc, const char *password);
 storage_status_t storage_save(irc_t *irc, char *password, int overwrite);
-storage_status_t storage_remove(const char *nick);
+storage_status_t storage_remove(const char *nick, const char *password);
 
 void register_storage_backend(storage_t *);
Index: storage_xml.c
===================================================================
--- storage_xml.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ storage_xml.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -34,7 +34,9 @@
 
 typedef enum {
-	XML_PASS_CHECK = 0,
-	XML_LOAD
-} xml_action;
+	XML_PASS_CHECK_ONLY = -1,
+	XML_PASS_UNKNOWN = 0,
+	XML_PASS_WRONG,
+	XML_PASS_OK
+} xml_pass_st;
 
 /* To make it easier later when extending the format: */
@@ -63,9 +65,7 @@
 {
 	struct xt_node *c;
-	struct set *s;
 
 	for (c = node->children; (c = xt_find_node(c, "setting")); c = c->next) {
 		char *name = xt_find_attr(c, "name");
-		char *locked = xt_find_attr(c, "locked");
 
 		if (!name) {
@@ -80,10 +80,4 @@
 		}
 		set_setstr(head, name, c->text);
-		if (locked && !g_strcasecmp(locked, "true")) {
-			s = set_find(head, name);
-			if (s) {
-				s->flags |= SET_LOCKED;
-			}
-		}
 	}
 }
@@ -92,5 +86,5 @@
 {
 	struct xml_parsedata *xd = data;
-	char *protocol, *handle, *server, *password = NULL, *autoconnect, *tag, *locked;
+	char *protocol, *handle, *server, *password = NULL, *autoconnect, *tag;
 	char *pass_b64 = NULL;
 	unsigned char *pass_cr = NULL;
@@ -105,5 +99,4 @@
 	autoconnect = xt_find_attr(node, "autoconnect");
 	tag = xt_find_attr(node, "tag");
-	locked = xt_find_attr(node, "locked");
 
 	protocol = xt_find_attr(node, "protocol");
@@ -119,33 +112,23 @@
 	if (!handle || !pass_b64 || !protocol || !prpl) {
 		return XT_ABORT;
-	}
-
-	pass_len = base64_decode(pass_b64, (unsigned char **) &pass_cr);
-	if (xd->irc->auth_backend) {
-		password = g_strdup((char *)pass_cr);
+	} else if ((pass_len = base64_decode(pass_b64, (unsigned char **) &pass_cr)) &&
+	           arc_decode(pass_cr, pass_len, &password, xd->given_pass) >= 0) {
+		acc = account_add(xd->irc->b, prpl, handle, password);
+		if (server) {
+			set_setstr(&acc->set, "server", server);
+		}
+		if (autoconnect) {
+			set_setstr(&acc->set, "auto_connect", autoconnect);
+		}
+		if (tag) {
+			set_setstr(&acc->set, "tag", tag);
+		}
+		if (local) {
+			acc->flags |= ACC_FLAG_LOCAL;
+		}
 	} else {
-		pass_len = arc_decode(pass_cr, pass_len, &password, xd->given_pass);
-		if (pass_len < 0) {
-			g_free(pass_cr);
-			g_free(password);
-			return XT_ABORT;
-		}
-	}
-
-	acc = account_add(xd->irc->b, prpl, handle, password);
-	if (server) {
-		set_setstr(&acc->set, "server", server);
-	}
-	if (autoconnect) {
-		set_setstr(&acc->set, "auto_connect", autoconnect);
-	}
-	if (tag) {
-		set_setstr(&acc->set, "tag", tag);
-	}
-	if (local) {
-		acc->flags |= ACC_FLAG_LOCAL;
-	}
-	if (locked && !g_strcasecmp(locked, "true")) {
-		acc->flags |= ACC_FLAG_LOCKED;
+		g_free(pass_cr);
+		g_free(password);
+		return XT_ABORT;
 	}
 
@@ -203,5 +186,5 @@
 };
 
-static storage_status_t xml_load_real(irc_t *irc, const char *my_nick, const char *password, xml_action action)
+static storage_status_t xml_load_real(irc_t *irc, const char *my_nick, const char *password, xml_pass_st action)
 {
 	struct xml_parsedata xd[1];
@@ -245,25 +228,22 @@
 	}
 
-	if (action == XML_PASS_CHECK) {
+	{
 		char *nick = xt_find_attr(node, "nick");
 		char *pass = xt_find_attr(node, "password");
-		char *backend = xt_find_attr(node, "auth_backend");
-
-		if (!nick || !(pass || backend)) {
+
+		if (!nick || !pass) {
 			goto error;
-		}
-
-		if (backend) {
-			g_free(xd->irc->auth_backend);
-			xd->irc->auth_backend = g_strdup(backend);
-			ret = STORAGE_CHECK_BACKEND;
 		} else if ((st = md5_verify_password(xd->given_pass, pass)) != 0) {
 			ret = STORAGE_INVALID_PASSWORD;
-		} else {
-			ret = STORAGE_OK;
-		}
-		goto error;
-	}
-
+			goto error;
+		}
+	}
+
+	if (action == XML_PASS_CHECK_ONLY) {
+		ret = STORAGE_OK;
+		goto error;
+	}
+
+	/* DO NOT call xt_handle() before verifying the password! */
 	if (xt_handle(xp, NULL, 1) == XT_HANDLED) {
 		ret = STORAGE_OK;
@@ -280,10 +260,10 @@
 static storage_status_t xml_load(irc_t *irc, const char *password)
 {
-	return xml_load_real(irc, irc->user->nick, password, XML_LOAD);
-}
-
-static storage_status_t xml_check_pass(irc_t *irc, const char *my_nick, const char *password)
-{
-	return xml_load_real(irc, my_nick, password, XML_PASS_CHECK);
+	return xml_load_real(irc, irc->user->nick, password, XML_PASS_UNKNOWN);
+}
+
+static storage_status_t xml_check_pass(const char *my_nick, const char *password)
+{
+	return xml_load_real(NULL, my_nick, password, XML_PASS_CHECK_ONLY);
 }
 
@@ -300,24 +280,21 @@
 	struct xt_node *root, *cur;
 
+	/* Generate a salted md5sum of the password. Use 5 bytes for the salt
+	   (to prevent dictionary lookups of passwords) to end up with a 21-
+	   byte password hash, more convenient for base64 encoding. */
+	random_bytes(pass_md5 + 16, 5);
+	md5_init(&md5_state);
+	md5_append(&md5_state, (md5_byte_t *) irc->password, strlen(irc->password));
+	md5_append(&md5_state, pass_md5 + 16, 5);   /* Add the salt. */
+	md5_finish(&md5_state, pass_md5);
+	/* Save the hash in base64-encoded form. */
+	pass_buf = base64_encode(pass_md5, 21);
+
 	root = cur = xt_new_node("user", NULL, NULL);
-	if (irc->auth_backend) {
-		xt_add_attr(cur, "auth_backend", irc->auth_backend);
-	} else {
-		/* Generate a salted md5sum of the password. Use 5 bytes for the salt
-		   (to prevent dictionary lookups of passwords) to end up with a 21-
-		   byte password hash, more convenient for base64 encoding. */
-		random_bytes(pass_md5 + 16, 5);
-		md5_init(&md5_state);
-		md5_append(&md5_state, (md5_byte_t *) irc->password, strlen(irc->password));
-		md5_append(&md5_state, pass_md5 + 16, 5);   /* Add the salt. */
-		md5_finish(&md5_state, pass_md5);
-		/* Save the hash in base64-encoded form. */
-		pass_buf = base64_encode(pass_md5, 21);
-		xt_add_attr(cur, "password", pass_buf);
-		g_free(pass_buf);
-	}
-
 	xt_add_attr(cur, "nick", irc->user->nick);
+	xt_add_attr(cur, "password", pass_buf);
 	xt_add_attr(cur, "version", XML_FORMAT_VERSION);
+
+	g_free(pass_buf);
 
 	xml_generate_settings(cur, &irc->b->set);
@@ -330,14 +307,7 @@
 		int pass_len;
 
-		if(irc->auth_backend) {
-			/* If we don't "own" the password, it may change without us
-			 * knowing, so we cannot encrypt the data, as we then may not be
-			 * able to decrypt it */
-			pass_b64 = base64_encode((unsigned char *)acc->pass, strlen(acc->pass));
-		} else {
-			pass_len = arc_encode(acc->pass, strlen(acc->pass), (unsigned char **) &pass_cr, irc->password, 12);
-			pass_b64 = base64_encode(pass_cr, pass_len);
-			g_free(pass_cr);
-		}
+		pass_len = arc_encode(acc->pass, strlen(acc->pass), (unsigned char **) &pass_cr, irc->password, 12);
+		pass_b64 = base64_encode(pass_cr, pass_len);
+		g_free(pass_cr);
 
 		cur = xt_new_node("account", NULL, NULL);
@@ -350,7 +320,4 @@
 			xt_add_attr(cur, "server", acc->server);
 		}
-		if (acc->flags & ACC_FLAG_LOCKED) {
-			xt_add_attr(cur, "locked", "true");
-		}
 
 		g_free(pass_b64);
@@ -397,7 +364,4 @@
 			xt_add_child(cur, xset = xt_new_node("setting", set->value, NULL));
 			xt_add_attr(xset, "name", set->key);
-			if (set->flags & SET_LOCKED) {
-				xt_add_attr(xset, "locked", "true");
-			}
 		}
 	}
@@ -458,7 +422,13 @@
 
 
-static storage_status_t xml_remove(const char *nick)
+static storage_status_t xml_remove(const char *nick, const char *password)
 {
 	char s[512], *lc;
+	storage_status_t status;
+
+	status = xml_check_pass(nick, password);
+	if (status != STORAGE_OK) {
+		return status;
+	}
 
 	lc = g_strdup(nick);
Index: tests/Makefile
===================================================================
--- tests/Makefile	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ tests/Makefile	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -15,5 +15,5 @@
 distclean: clean
 
-main_objs = bitlbee.o conf.o dcc.o help.o ipc.o irc.o irc_cap.o irc_channel.o irc_commands.o irc_im.o irc_send.o irc_user.o irc_util.o irc_commands.o log.o nick.o query.o root_commands.o set.o storage.o storage_xml.o auth.o auth_pam.o auth_ldap.o
+main_objs = bitlbee.o conf.o dcc.o help.o ipc.o irc.o irc_cap.o irc_channel.o irc_commands.o irc_im.o irc_send.o irc_user.o irc_util.o irc_commands.o log.o nick.o query.o root_commands.o set.o storage.o storage_xml.o
 
 test_objs = check.o check_util.o check_nick.o check_md5.o check_arc.o check_irc.o check_help.o check_user.o check_set.o check_jabber_sasl.o check_jabber_util.o
Index: unix.c
===================================================================
--- unix.c	(revision 991c75fbf4c4bc0ab2ae6f8b983a092080630b14)
+++ unix.c	(revision 166a571321826a68626eaf10a59901253237f09e)
@@ -104,10 +104,4 @@
 	}
 
-	global.auth = auth_init(global.conf->auth_backend);
-	if (global.conf->auth_backend && global.auth == NULL) {
-		log_message(LOGLVL_ERROR, "Unable to load authentication backend '%s'", global.conf->auth_backend);
-		return(1);
-	}
-
 	if (global.conf->runmode == RUNMODE_INETD) {
 		log_link(LOGLVL_ERROR, LOGOUTPUT_IRC);
