Add TODO for OAuth workaround.
Refactor authentication with flash messages.