Also did one security-related fix; if you try to log in with a bad username or password, the message sent back is now the same (it used to send a different error depending on whether the username or password was bad)