open id working. need to change create profile a bit because it also works for GET method so anyone can directly type it to abuse.