fixed bug in http strategy, to return identity instead of username
update_last_login and is_locked_out done