I just upgraded the server that runs this website to Debian 9 (finally). This broke some things (old KSES html cleaning code).
I found a version I half worked on from ~5 years ago and did an upgrade to that (uses new htmlpurifier and replaces KSES).
That version had a half written new authentication hash system (thanks Michael from 2014).
So that broke login.
That is now somewhat fixed!
Honestly not too bad considering the code is almost 15 years old!