don't require user to enter a password when registering
update composer to pull newer patched hwi/oauth