Accept access_token and deviceId from header in addition to cookie
Added reference to oauth login page customization package
Fixed some syntax
Merge branch 'release-2.4.0'