several bug fixes to password encoding and oauth refreshes