Scope base64 encodes url as _id for HTTP id parameter; Account hashes password via setter.