If your site has sensitive data like credit card information or the like, rolling your own auth is the only good way to protect yourself and users from an incident. With openid in particular you have no idea how secure the provider is, and users will blame you if their data's exposed because they don't know better.