So I had considered an 'application password' approach, like you mention, but decided against it -- was just one more thing to build and the number of people using ancient clients is relatively small.

But, momijizukamori has a super great point below -- we already have that system, it's called API keys. I'm perfectly fine with us making it so you can just paste your API key in as a password and it "works" with challenge-response.

I'll go ahead and take a stab at that before this goes live, and try to make sure that Semagic at least works.