started converting to database-backed authentication
added list of things to try now that security is broken
moved registration endpoint to a known default unsecured url for now