Authentication plugins should be handled through the extension system (as outlined in the RFC as well), currently the plugins are "hard included" into session.php making it impossible to include authentication plugins not located into /includes/auth/. See also: http://area51.phpbb.com/phpBB/viewtopic.php?f=84&p=236841#p236841