Added format_hash and support HASH_SECRET_KEY
Change login endpoints (support Oauth)
Added logout and ignore webassets