Refactored ext auth code. now Google & Facebook return email address. Also moved secret data to machine.config. Ext logins can now only be done on production.
see previous commit