added pwdhash to password reset payload to prevent reuse of link
removed google/facebook logins that were never finished
fix hash of oldhash in password reset.