Rip out session-based Passport login/account creation. Start moving towards using OAuth for everything.
Move all static assets off into a separate directory.
Rip out some more of the session and templating logic that are no longer used.