Require oauth state/redirect consistency, fail closed on missing proxy, and remove password login from create/reauth UI (admin-only password path stays off by default).
Require oauth state/redirect consistency, fail closed on missing proxy, and remove password login from create/reauth UI (admin-only password path stays off by default).