@brianhw Both of our external functions set retfun, so this can't be hit without calling _external_signup directly.  Should I make an "artificial" call with retfun set to None to test, or be bold and remove the safety redirect?