rm form based login
rm unused js libs
be explicit about transitive deps