diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5a914d5..8149405 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 We follow the CalVer (https://calver.org/) versioning scheme: YY.MINOR.MICRO.
 
+21.2.0 (04-28-2021)
+===================
+
+newCAS Production Server Release
+
 21.1.5 (04-14-2021)
 ===================
 
diff --git a/README.md b/README.md
index fa44031..e2f26e2 100644
--- a/README.md
+++ b/README.md
@@ -19,14 +19,15 @@ OSF CAS is the centralized authentication and authorization service for the [OSF
 * OSF username and verification key login
 * OSF two-factor authentication
 * Delegated authentication
-  * ORCiD login
-  * **WIP** - CAS client: supports CAS protocol based institution SSO
-  * **WIP** - SAML service provider: supports SAML protocol based institution SSO
-* **TBI** - OAuth authorization server for OSF
+  * OAuth 2.0 client: supports ORCiD login
+  * CAS client: supports institution SSO using the CAS protocol
+  * SAML service provider: supports institution SSO using the SAML protocol
+* OAuth 2.0 authorization server for OSF
+* Authentication failure throttling
 
 # Implementations
 
-The implementation of OSF CAS is based on [Apereo CAS 6.2.x](https://github.com/apereo/cas/tree/6.2.x) via [CAS Overlay Template 6.2.x](https://github.com/apereo/cas-overlay-template/tree/6.2). Refer to [CAS Documentaion 6.2.x](https://apereo.github.io/cas/6.2.x/) for more details.
+The implementation of OSF CAS is based on [Apereo CAS 6.2.8](https://github.com/apereo/cas/tree/v6.2.8) via [CAS Overlay Template 6.2.x](https://github.com/apereo/cas-overlay-template/tree/6.2). Refer to [CAS Documentation 6.2.x](https://apereo.github.io/cas/6.2.x/) for more details.
 
 ## Legacy Implementations
 
@@ -34,20 +35,20 @@ A legacy version can be found at [CAS Overlay](https://github.com/CenterForOpenS
 
 # Versions
 
-- OSF CAS     `20.0.x`
-- Apereo CAS  `6.2.x`
+- OSF CAS     [21.2.x](https://github.com/CenterForOpenScience/osf-cas/releases/latest)
+- Apereo CAS  `6.2.8`
 - PostgreSQL  `9.6`
 - JDK         `11`
 
 # Configure, Build and Run OSF CAS
 
-It is recommended to use the provided scripts to [build](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-build.sh) and [run](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-run.sh) CAS. Refer to Apereo's [README.md](https://github.com/apereo/cas-overlay-template/tree/6.2#cas-overlay-template-) for more options.
+It is recommended to use the provided scripts to [build](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-build.sh) and [run](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-run.sh) CAS. Refer to Apereo [README.md](https://github.com/apereo/cas-overlay-template/tree/6.2#cas-overlay-template-) for more options.
 
 Use [`cas.properties`](https://github.com/CenterForOpenScience/osf-cas/blob/develop/etc/cas/config/cas.properties) and [`Dockerfile`](https://github.com/CenterForOpenScience/osf-cas/blob/develop/Dockerfile) to configure staging and production servers. Use [`cas-local.properties`](https://github.com/CenterForOpenScience/osf-cas/blob/develop/etc/cas/config/local/cas-local.properties) and [`Dockerfile-local`](https://github.com/CenterForOpenScience/osf-cas/blob/develop/Dockerfile-local) for local development. To accelerate developing OSF CAS, use the [reload](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-reload.sh) script to rebuild, reconfigure and restart the running container.
 
 ## OSF
 
-OSF CAS requires a working OSF running locally. Refer to OSF's [README-docker-compose.md](https://github.com/CenterForOpenScience/osf.io/blob/develop/README-docker-compose.md) for how to set up and run OSF with `docker-compose`. Must disable `fakeCAS` to free port `8080`.
+OSF CAS requires a working OSF running locally. Refer to OSF [README-docker-compose.md](https://github.com/CenterForOpenScience/osf.io/blob/develop/README-docker-compose.md) for how to set up and run OSF with `docker-compose`. Must disable `fakeCAS` to free port `8080` for CAS to use.
 
 ### OSF DB
 
@@ -67,7 +68,7 @@ cas.authn.osf-postgres.jpa.dialect=io.cos.cas.osf.hibernate.dialect.OsfPostgresD
 
 ## CAS DB
 
-The implementation of OSF CAS uses the [JPA Ticket Registry](https://apereo.github.io/cas/6.2.x/ticketing/Configuring-Ticketing-Components.html#ticket-registry) for durable ticket storage and thus requires a relational database. Set up a `PostgreSQL@9.6` server and review [JPA Ticket Registry settings](https://github.com/CenterForOpenScience/osf-cas/blob/790cac1ac5a19754c67d6ea1f53afc26e1809d23/etc/cas/config/cas.properties#L90-L138). In most cases, only [Database connections](https://github.com/CenterForOpenScience/osf-cas/blob/790cac1ac5a19754c67d6ea1f53afc26e1809d23/etc/cas/config/cas.properties#L104-L108) need to be updated. In addition, [JDBC settings](https://github.com/CenterForOpenScience/osf-cas/blob/790cac1ac5a19754c67d6ea1f53afc26e1809d23/etc/cas/config/cas.properties#L96-L98) can be adjusted if necessary.
+The implementation of OSF CAS uses the [JPA Ticket Registry](https://apereo.github.io/cas/6.2.x/ticketing/Configuring-Ticketing-Components.html#ticket-registry) for durable ticket storage and thus requires a relational database. Set up a `PostgreSQL@9.6` server and review [JPA Ticket Registry settings](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L127-L173). In most cases, only [Database connections](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L139-L143) need to be updated. Other JDBC and JPA settings can be adjusted if necessary.
 
 Here is an example for local development. Use `192.168.168.167` to access host outside the docker container. Use the port `54321` since the default `5432` one has been used by OSF DB. Update `pg_hba.conf` to grant proper access permission depending on the setup.
 
@@ -90,17 +91,19 @@ host    osf-cas         longzechen      192.168.168.167/24      trust
 
 ## Signing and Encryption Keys
 
-Refer to [signing and encryption settings](https://github.com/CenterForOpenScience/osf-cas/blob/790cac1ac5a19754c67d6ea1f53afc26e1809d23/etc/cas/config/cas.properties#L142-L158) in `cas.properties` for signing and encrypting client sessions and ticket granting cookies. Use the following default keys **for local development only**.
+### CAS Server
 
-```yaml
-# In `cas-local.properties`
+* Refer to [signing and encryption 1](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L175-L190) in `cas.properties` for signing and encrypting client sessions and ticket granting cookies.
 
-cas.webflow.crypto.signing.key=7okipSDHBKuZL2n66cfYU4OH1Z_BRYkmEJazc29hzhXCXbRvws7Hv4_hEVd4E2osMrgIEdykzV2hAVD9CCQpJw
-cas.webflow.crypto.encryption.key=1A9hLtxA-Es-hbQsfxqxxw
+### OAuth Server
 
-cas.tgc.crypto.signing.key=_WTRQmXGuq-mx2pTjNCXuX5971-e8KOCFOa27Mh5I3oBobYSzyUrLS9rfSiXQQDolJrJrWv7jURID1vtouznHg
-cas.tgc.crypto.encryption.key=dcjD5PIfrcqGM8tv4_FGubcay-DbqKPPoz9xQ3IHQi0
-```
+* Refer to [signing and encryption 2](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L291-L295) in `cas.properties` for signing and encrypting OAuth 2.0 registered services.
+
+* You can optionally enable OAuth JWT access tokens, which requires [signing and encryption 3](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L273-L282) to be configured.
+
+### Auto-generate Key Pairs
+
+Set empty values to the above keys and CAS will generate the key pairs automatically. The keys will be re-generated once server restarts. Follow the server warning logs for further actions.
 
 ## Authentication Delegation
 
@@ -112,7 +115,13 @@ For local development, set up a developer app at [ORCiD](https://orcid.org/devel
 
 ### Institution Login
 
-( ... WIP ... )
+#### SAML / Shibboleth
+
+Details coming soon ...
+
+#### CAS / Pac4j
+
+Details coming soon ...
 
 #### `fakeCAS` Login (Local Development Only)
 
@@ -142,3 +151,7 @@ cas.authn.pac4j.cas[2].client-name=fakecas
 cas.authn.pac4j.cas[2].protocol=CAS30
 cas.authn.pac4j.cas[2].callback-url-type=QUERY_PARAMETER
 ```
+
+### OAuth 2.0 Server
+
+Details coming soon ...
diff --git a/etc/cas/config/instn-authn-prod.xsl b/etc/cas/config/instn-authn-prod.xsl
new file mode 100644
index 0000000..0fe3aa6
--- /dev/null
+++ b/etc/cas/config/instn-authn-prod.xsl
@@ -0,0 +1,679 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+    <xsl:template match="/">
+        <provider>
+            <xsl:apply-templates/>
+        </provider>
+    </xsl:template>
+
+    <xsl:template match="auth">
+        <xsl:variable name="delegation-protocol" select="//attribute[@name='delegation-protocol']/@value" />
+        <xsl:choose>
+            <xsl:when test="$delegation-protocol = 'saml-shib'">
+                <xsl:variable name="idp" select="//attribute[@name='shib-identity-provider']/@value" />
+                <idp><xsl:value-of select="$idp"/></idp>
+                <xsl:choose>
+                    <!-- Arizona State University (ASU) -->
+                    <xsl:when test="$idp='urn:mace:incommon:asu.edu'">
+                        <id>asu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Boys Town [PROD & Test] (BT) -->
+                    <!-- Prod and Test IdP of Boys Town share the entity ID but the metadata itself is different. -->
+                    <xsl:when test="$idp='https://sts.windows.net/e2ab7419-36ab-4a95-a19f-ee90b6a9b8ac/'">
+                        <id>bt</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Boston University (BU) -->
+                    <xsl:when test="$idp='https://shib.bu.edu/idp/shibboleth'">
+                        <id>bu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Brown University (BROWN) -->
+                    <xsl:when test="$idp='https://sso.brown.edu/idp/shibboleth'">
+                        <id>brown</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <isMemberOf><xsl:value-of select="//attribute[@name='ismemberof']/@value"/></isMemberOf>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- California Lutheran University (CALLUTHERAN)-->
+                    <xsl:when test="$idp='login.callutheran.edu'">
+                        <id>callutheran</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Carnegie Mellon University (CMU) -->
+                    <xsl:when test="$idp='https://login.cmu.edu/idp/shibboleth'">
+                        <id>cmu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Cornell University (CORNELL) -->
+                    <xsl:when test="$idp='https://shibidp.cit.cornell.edu/idp/shibboleth'">
+                        <id>cornell</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Case Western Reserve University (CWRU) -->
+                    <xsl:when test="$idp='urn:mace:incommon:case.edu'">
+                        <id>cwru</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Duke University (DUKE) -->
+                    <xsl:when test="$idp='urn:mace:incommon:duke.edu'">
+                        <id>duke</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- East Carolina University (ECU) -->
+                    <xsl:when test="$idp='https://sso.ecu.edu/idp/shibboleth'">
+                        <id>ecu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Ferris State University (FERRIS) -->
+                    <xsl:when test="$idp='login.ferris.edu'">
+                        <id>ferris</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Florida State University (FSU) -->
+                    <xsl:when test="$idp='https://idp.fsu.edu'">
+                        <id>fsu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- George Mason University (GMU) -->
+                    <xsl:when test="$idp='https://shibboleth.gmu.edu/idp/shibboleth'">
+                        <id>gmu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- The George Washington University (GWU) -->
+                    <xsl:when test="$idp='https://singlesignon.gwu.edu/idp/shibboleth'">
+                        <id>gwu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Illinois Institute of Technology (IIT) -->
+                    <xsl:when test="$idp='https://login.iit.edu/cas/idp'">
+                        <id>iit</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='email']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Institut Teknologi Bandung (ITB) -->
+                    <xsl:when test="$idp='https://idp.itb.ac.id/idp/shibboleth'">
+                        <id>itb</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='cn']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- James Madison University (JMU) -->
+                    <xsl:when test="$idp='urn:mace:incommon:jmu.edu'">
+                        <id>jmu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displaynameprintable']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Johns Hopkins University (JHU) -->
+                    <xsl:when test="$idp='urn:mace:incommon:johnshopkins.edu'">
+                        <id>jhu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- KU Leuven Libraries (KULEUVEN)-->
+                    <xsl:when test="$idp='urn:mace:kuleuven.be:kulassoc:kuleuven.be'">
+                        <id>kuleuven</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Massachusetts Institute of Technology (MIT) -->
+                    <xsl:when test="$idp='urn:mace:incommon:mit.edu'">
+                        <id>mit</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Macquarie University (MQ) -->
+                    <xsl:when test="$idp='http://www.okta.com/exk2dzwun7KebsDIV2p7'">
+                        <id>mq</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- New York University (NYU) -->
+                    <xsl:when test="$idp='urn:mace:incommon:nyu.edu'">
+                        <id>nyu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- The University of Oklahoma (OU) -->
+                    <xsl:when test="$idp='https://shib.ou.edu/idp/shibboleth'">
+                        <id>ou</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Princeton University (PU) -->
+                    <xsl:when test="$idp='https://idp.princeton.edu/idp/shibboleth'">
+                        <id>pu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Spanish National Research Council (CSIC) -->
+                    <xsl:when test="$idp='https://www.rediris.es/sir/csicidp'">
+                        <id>csic</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='irismailmainaddress']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Temple University (TEMPLE) -->
+                    <xsl:when test="$idp='https://fim.temple.edu/idp/shibboleth'">
+                        <id>temple</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Tufts University (TUFTS) -->
+                    <xsl:when test="$idp='https://shib-idp.tufts.edu/idp/shibboleth'">
+                        <id>tufts</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Universiteit Gent (UGENT) -->
+                    <xsl:when test="$idp='https://identity.ugent.be/simplesaml/saml2/idp/metadata.php'">
+                        <id>ugent</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Arizona (UA) -->
+                    <xsl:when test="$idp='urn:mace:incommon:arizona.edu'">
+                        <id>ua</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                            <departmentRaw><xsl:value-of select="//attribute[@name='department']/@value"/></departmentRaw>
+                            <eduPerson>false</eduPerson>
+                        </user>
+                    </xsl:when>
+                    <!-- University of British Columbia (UBC) -->
+                    <xsl:when test="$idp='https://authentication.ubc.ca'">
+                        <id>ubc</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of California Los Angeles (UCLA) -->
+                    <xsl:when test="$idp='urn:mace:incommon:ucla.edu'">
+                        <id>ucla</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of California San Diego (UCSD) -->
+                    <xsl:when test="$idp='urn:mace:incommon:ucsd.edu'">
+                        <id>ucsd</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of California Riverside (UCR) -->
+                    <xsl:when test="$idp='urn:mace:incommon:ucr.edu'">
+                        <id>ucr</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Cape Town (UCT) -->
+                    <xsl:when test="$idp='http://adfs.uct.ac.za/adfs/services/trust'">
+                        <id>uct</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames />
+                            <suffix/>
+                        </user>
+                    </xsl:when> 
+                    <!-- University of Cincinnati (UC) -->
+                    <xsl:when test="$idp='https://login.uc.edu/idp/shibboleth'">
+                        <id>uc</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Colorado Boulder (COLORADO) -->
+                    <xsl:when test="$idp='https://fedauth.colorado.edu/idp/shibboleth'">
+                        <id>colorado</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Göttingen (UGOE) -->
+                    <xsl:when test="$idp='https://shibboleth-idp.uni-goettingen.de/uni/shibboleth'">
+                        <id>ugoe</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Kent (UNIVERSITYOFKENT) -->
+                    <xsl:when test="$idp='https://sso.id.kent.ac.uk/idp'">
+                        <id>universityofkent</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Macquarie University (MQ) -->
+                    <xsl:when test="$idp='http://www.okta.com/exk1xnftf4QK3mQ592p7'">
+                        <id>mq</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Maryland (UMD)-->
+                    <xsl:when test="$idp='urn:mace:incommon:umd.edu'">
+                        <id>umd</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of North Carolina at Chapel Hill (UNC) -->
+                    <xsl:when test="$idp='urn:mace:incommon:unc.edu'">
+                        <id>unc</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Notre Dame (ND) -->
+                    <xsl:when test="$idp='https://login.nd.edu/idp/shibboleth'">
+                        <id>nd</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Southern California (USC) -->
+                    <xsl:when test="$idp='https://shibboleth.usc.edu/shibboleth-idp'">
+                        <id>usc</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='uscemailprimaryaddress']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='uscdisplaygivenname']/@value"/><xsl:text> </xsl:text><xsl:value-of select="//attribute[@name='uscdisplaysn']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='uscdisplaysn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='uscdisplaygivenname']/@value"/></givenName>
+                            <middleNames><xsl:value-of select="//attribute[@name='uscdisplaymiddlename']/@value"/></middleNames>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!--University of South Carolina Libraries (USC) -->
+                    <xsl:when test="$idp='urn:mace:incommon:sc.edu'">
+                        <id>sc</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- The University of Texas at Dallas (UTDALLAS) -->
+                    <xsl:when test="$idp='https://idp.utdallas.edu/idp/shibboleth'">
+                        <id>utdallas</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Virginia (UVA) -->
+                    <xsl:when test="$idp='urn:mace:incommon:virginia.edu'">
+                        <id>uva</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Washington (UW) -->
+                    <xsl:when test="$idp='urn:mace:incommon:washington.edu'">
+                        <id>uw</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- University of Wisconsin - Stout (UWSTOUT) -->
+                    <xsl:when test="$idp='https://smidp.uwstout.edu/idp/shibboleth'">
+                        <id>uwstout</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Virginia Commonwealth University (VCU) -->
+                    <xsl:when test="$idp='https://shibboleth.vcu.edu/idp/shibboleth'">
+                        <id>vcu</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                            <departmentRaw><xsl:value-of select="//attribute[@name='department']/@value"/></departmentRaw>
+                            <eduPerson>false</eduPerson>
+                        </user>
+                    </xsl:when>
+                    <!-- Virginia Tech (VT) -->
+                    <xsl:when test="$idp='urn:mace:incommon:vt.edu'">
+                        <id>vt</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName/>
+                            <givenName/>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Washington University in St. Louis (WUSTL) -->
+                    <xsl:when test="$idp='https://login.wustl.edu/idp/shibboleth'">
+                        <id>wustl</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='eppn']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Unknown Identity Provider -->
+                    <xsl:otherwise>
+                        <xsl:message terminate="yes">Error: Unknown Identity Provider '<xsl:value-of select="$idp"/>'</xsl:message>
+                    </xsl:otherwise>
+                </xsl:choose>
+            </xsl:when>
+            <xsl:when test="$delegation-protocol = 'cas-pac4j'">
+                <xsl:variable name="idp" select="//attribute[@name='cas-identity-provider']/@value" />
+                <idp><xsl:value-of select="$idp"/></idp>
+                <xsl:choose>
+                    <!-- Concordia College (CORD) -->
+                    <xsl:when test="$idp='cord'">
+                        <id>cord</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
+                            <familyName />
+                            <givenName />
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- OK State University (OKSTATE) -->
+                    <xsl:when test="$idp='okstate'">
+                        <id>okstate</id>
+                        <user>
+                            <username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
+                            <fullname/>
+                            <familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
+                            <givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
+                            <middleNames/>
+                            <suffix/>
+                        </user>
+                    </xsl:when>
+                    <!-- Unknown Identity Provider -->
+                    <xsl:otherwise>
+                        <xsl:message terminate="yes">Error: Unknown Identity Provider '<xsl:value-of select="$idp"/>'</xsl:message>
+                    </xsl:otherwise>
+                </xsl:choose>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:message terminate="yes">Error: Unknown Delegation Protocol '<xsl:value-of select="$delegation-protocol"/>'</xsl:message>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+</xsl:stylesheet>
diff --git a/src/main/java/io/cos/cas/osf/authentication/handler/support/OsfPostgresAuthenticationHandler.java b/src/main/java/io/cos/cas/osf/authentication/handler/support/OsfPostgresAuthenticationHandler.java
index 52db8ae..e149eb5 100644
--- a/src/main/java/io/cos/cas/osf/authentication/handler/support/OsfPostgresAuthenticationHandler.java
+++ b/src/main/java/io/cos/cas/osf/authentication/handler/support/OsfPostgresAuthenticationHandler.java
@@ -130,7 +130,12 @@ protected final AuthenticationHandlerExecutionResult authenticateOsfPostgresInte
 
         final OsfUser osfUser = jpaOsfDao.findOneUserByEmail(username);
         if (osfUser == null) {
-            throw new AccountNotFoundException("User [" + username + "] not found");
+            if (StringUtils.isNoneBlank(plainTextPassword) || StringUtils.isNoneBlank(oneTimePassword)) {
+                throw new AccountNotFoundException("User [" + username + "] not found");
+            }
+            if (StringUtils.isNoneBlank(verificationKey)) {
+                throw new InvalidVerificationKeyException("User [" + username + "] not found");
+            }
         }
         final OsfGuid osfGuid = jpaOsfDao.findGuidByUser(osfUser);
         if (osfGuid == null) {
diff --git a/src/main/java/io/cos/cas/osf/web/flow/config/OsfCasWebflowContextConfiguration.java b/src/main/java/io/cos/cas/osf/web/flow/config/OsfCasWebflowContextConfiguration.java
index 64ac4ac..f2808fd 100644
--- a/src/main/java/io/cos/cas/osf/web/flow/config/OsfCasWebflowContextConfiguration.java
+++ b/src/main/java/io/cos/cas/osf/web/flow/config/OsfCasWebflowContextConfiguration.java
@@ -59,4 +59,13 @@ public CasWebflowConfigurer defaultLogoutWebflowConfigurer() {
         osfCasLogoutWebFlowConfigurer.setOrder(Ordered.HIGHEST_PRECEDENCE);
         return osfCasLogoutWebFlowConfigurer;
     }
+
+    // TODO: Move all server-specific URLs, endpoints and other attributes to a dedicated class and initialize it as a
+    //       bean. ThymeLeaf templates can access Spring beans, which solves the issue of CasConfigurationProperties
+    //       accessibility in templates. For more details, refer to section "Spring Beans" in the following guide:
+    //       https://www.thymeleaf.org/doc/articles/springmvcaccessdata.html for details
+    @Bean(name="casServerLoginUrl")
+    public String casServerLoginUrl() {
+        return casProperties.getServer().getName() + "/login";
+    }
 }
diff --git a/src/main/java/org/pac4j/scribe/builder/api/OrcidApi20.java b/src/main/java/org/pac4j/scribe/builder/api/OrcidApi20.java
index ecb7a6b..5ed3dff 100644
--- a/src/main/java/org/pac4j/scribe/builder/api/OrcidApi20.java
+++ b/src/main/java/org/pac4j/scribe/builder/api/OrcidApi20.java
@@ -19,7 +19,7 @@
  */
 public class OrcidApi20 extends DefaultApi20 {
 
-    private static final String AUTH_URL = "http://www.orcid.org/oauth/authorize";
+    private static final String AUTH_URL = "https://orcid.org/oauth/authorize";
     private static final String TOKEN_URL = "https://orcid.org/oauth/token";
 
     @Override
diff --git a/src/main/resources/messages.properties b/src/main/resources/messages.properties
index 51317f8..99f2066 100644
--- a/src/main/resources/messages.properties
+++ b/src/main/resources/messages.properties
@@ -593,7 +593,7 @@ screen.institutionlogin.osf=Sign in with your OSF account
 screen.unsupp-instn.heading=I can't find my institution
 screen.unsupp-instn.message=Signing into the OSF with institutional credentials is enabled for <a href="{0}">OSF Institutions members</a>. If your institution is not yet an OSFI member, choose one of the following sign-in methods.
 screen.unsupp-instn.existing.heading=I already have an OSF account
-screen.unsupp-instn.existing.message=If you have already have an OSF password, you can sign in to the OSF
+screen.unsupp-instn.existing.message=If you already have an OSF password, you can sign in to the OSF
 screen.unsupp-instn.existing.button=Sign in with OSF
 screen.unsupp-instn.existing.setpw.message=If you have not yet set an OSF password for your account, create a password
 screen.unsupp-instn.existing.setpw.button=Set a password
@@ -603,7 +603,7 @@ screen.unsupp-instn.existing.setpw.label.email.accesskey=e
 # Generic login and logout success page
 #
 screen.generic.logoutsuccess.title=Signed-out
-screen.generic.logoutsuccess.tip=Oops! Redirection didn't happen ...
+screen.generic.logoutsuccess.tips=Auto-redirection didn't happen ...
 screen.generic.logoutsuccess.heading=Logout successful
 screen.generic.logoutsuccess.message=You have successfully logged out of OSF. However, you are seeing this page \
   because the automatic redirection somehow didn't happen. Please click the button below to go back to OSF.
@@ -611,7 +611,7 @@ screen.generic.logoutsuccess.button.continue=Back to OSF
 screen.generic.logoutsuccess.link.login=Login again
 #
 screen.generic.loginsuccess.title=Signed-in
-screen.generic.loginsuccess.tips=Oops! Redirection didn't happen ...
+screen.generic.loginsuccess.tips=Auto-redirection didn't happen ...
 screen.generic.loginsuccess.heading=Login successful
 screen.generic.loginsuccess.message=You have successfully logged into OSF! However, you are seeing this page because \
   the automatic redirection somehow didn't happen. Please click the button below to continue to OSF.
@@ -647,6 +647,7 @@ screen.authnerror.tips=Oops! Something went wrong ...
 screen.authnerror.tips.devmode=Developer mode only !!!
 screen.authnerror.button.resendosfconfirmation=Resend confirmation email
 screen.authnerror.button.backtoosf=Exit login
+screen.authnerror.button.logout=Log out
 screen.blocked.message=You are being throttled for attempting to login too frequently in a short amount of time. \
   Please wait for a few minutes before trying again. If you believe this is an error, please contact \
   <a style="white-space: nowrap" href="mailto:support@osf.io">support@osf.io</a> for help.
@@ -676,9 +677,9 @@ screen.service.error.message=The application you attempted to authenticate to is
 screen.invaliduserstatus.heading=Account not valid
 screen.invaliduserstatus.message=Cannot log in to an invalid account. If you believe this should not happen, please \
   contact <a style="white-space: nowrap" href="mailto:support@osf.io">OSF Support</a>.
-screen.invalidverificationkey.heading=Invalid verification key
-screen.invalidverificationkey.message=Automatic login has failed due to invalid one-time verification key. This key \
-  may have expired or have already been used.
+screen.invalidverificationkey.heading=Verification key login failed
+screen.invalidverificationkey.message=Automatic login has failed due to invalid username or verification key. \
+  The username may not exist, the one-time verification key may have expired, or it may has already been used.
 screen.onetimepasswordrequired.heading=OSF Two-factor Authentication
 screen.onetimepasswordrequired.message=Two-factor authentication has been enabled for this OSF account. Please enter \
   the one-time password generated by the authentication app. If you believe this should not happen, please contact <a \
diff --git a/src/main/resources/static/css/cas.css b/src/main/resources/static/css/cas.css
index ec16778..7219052 100644
--- a/src/main/resources/static/css/cas.css
+++ b/src/main/resources/static/css/cas.css
@@ -942,6 +942,13 @@ body {
     padding: 0;
 }
 
+.login-error-card #errorInfo,
+.login-error-card #authnAttr {
+    margin-top: 1rem;
+    padding: 0 1rem;
+    border: solid #e7e7e7;
+}
+
 .login-instn-card .form-button {
     margin: 1rem 0;
 }
diff --git a/src/main/resources/templates/casAccountDisabledView.html b/src/main/resources/templates/casAccountDisabledView.html
index c6f32d3..a93cc52 100644
--- a/src/main/resources/templates/casAccountDisabledView.html
+++ b/src/main/resources/templates/casAccountDisabledView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -33,7 +33,7 @@ <h2 th:utext="#{screen.accountdisabled.heading}"></h2>
                     </a>
                 </section>
                 <hr class="my-4" />
-                <section class="text-with-mdi" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section class="text-with-mdi" th:with="loginUrl=@{${@casServerLoginUrl}(casRedirectSource=cas)}">
                     <span><a th:href="@{/logout(service=${loginUrl})}" th:utext="#{screen.error.page.loginagain}"></a></span>
                 </section>
             </section>
diff --git a/src/main/resources/templates/casAccountNotConfirmedIdPView.html b/src/main/resources/templates/casAccountNotConfirmedIdPView.html
index c803b06..78ff2ce 100644
--- a/src/main/resources/templates/casAccountNotConfirmedIdPView.html
+++ b/src/main/resources/templates/casAccountNotConfirmedIdPView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
diff --git a/src/main/resources/templates/casAccountNotConfirmedOsfView.html b/src/main/resources/templates/casAccountNotConfirmedOsfView.html
index 5e757c0..bde0aa2 100644
--- a/src/main/resources/templates/casAccountNotConfirmedOsfView.html
+++ b/src/main/resources/templates/casAccountNotConfirmedOsfView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
diff --git a/src/main/resources/templates/casGenericSuccessView.html b/src/main/resources/templates/casGenericSuccessView.html
index c1b5105..2e3d7ac 100644
--- a/src/main/resources/templates/casGenericSuccessView.html
+++ b/src/main/resources/templates/casGenericSuccessView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -19,7 +19,7 @@
                         <a href="fragments/osfbannerui.html"></a>
                     </div>
                 </section>
-                <section class="text-without-mdi text-center text-bold text-large margin-large-vertical title-danger">
+                <section class="text-without-mdi text-center text-bold text-large margin-large-vertical title">
                     <span th:utext="#{screen.generic.loginsuccess.tips}"></span>
                 </section>
                 <hr class="my-4" />
@@ -27,6 +27,13 @@
                     <h2 th:utext="#{screen.generic.loginsuccess.heading}"></h2>
                     <div th:utext="#{screen.generic.loginsuccess.message}"></div>
                 </section>
+                <section id="authnAttr" class="pre-formatted-small word-break-all">
+                    <pre th:unless="${#strings.isEmpty(authentication.principal.attributes.get('username'))}" th:utext="${'Email: ' + authentication.principal.attributes.get('username')}"></pre>
+                    <pre th:unless="${#strings.isEmpty(authentication.principal.attributes.get('givenName')) or #strings.isEmpty(authentication.principal.attributes.get('familyName'))}" th:utext="${'Name: ' + authentication.principal.attributes.get('givenName') + ' ' + authentication.principal.attributes.get('familyName')}"></pre>
+                    <pre th:unless="${#strings.isEmpty(authentication.principal.attributes.get('osfGuid'))}" th:utext="${'User ID: ' + authentication.principal.attributes.get('osfGuid')}"></pre>
+                    <pre th:unless="${#strings.isEmpty(authentication.principal.id)}" th:utext="${'Principal ID: ' + authentication.principal.id}"></pre>
+                    <pre th:utext="${'Timestamp: ' + #dates.formatISO(#dates.createNow())}"></pre>
+                </section>
                 <section class="form-button">
                     <a class="mdc-button mdc-button--raised button-osf-blue" th:href="@{${osfUrl.dashboard}}">
                         <span class="mdc-button__label" th:utext="#{screen.generic.loginsuccess.button.continue}"></span>
@@ -36,8 +43,8 @@ <h2 th:utext="#{screen.generic.loginsuccess.heading}"></h2>
                 <section class="text-with-mdi">
                     <span><a th:href="@{/logout(service=${osfUrl.logout})}" th:utext="#{screen.generic.loginsuccess.link.cancel}"></a></span>
                 </section>
+                <!--
                 <section>
-                <!-- <section th:if="${osfCasLoginContext.devMode}"> -->
                     <hr class="my-4" />
                     <section class="text-without-mdi text-center text-bold text-large margin-large-vertical title-danger">
                         <span th:utext="#{screen.authnerror.tips.devmode}"></span>
@@ -83,6 +90,7 @@ <h2 th:utext="#{screen.generic.loginsuccess.heading}"></h2>
                         </div>
                     </section>
                 </section>
+                -->
             </section>
         </div>
 
diff --git a/src/main/resources/templates/casInstitutionLoginView.html b/src/main/resources/templates/casInstitutionLoginView.html
index 56ba4d7..0d84a5f 100644
--- a/src/main/resources/templates/casInstitutionLoginView.html
+++ b/src/main/resources/templates/casInstitutionLoginView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge"/>
diff --git a/src/main/resources/templates/casInstitutionSsoFailedView.html b/src/main/resources/templates/casInstitutionSsoFailedView.html
index 7ad60af..ea61c1a 100644
--- a/src/main/resources/templates/casInstitutionSsoFailedView.html
+++ b/src/main/resources/templates/casInstitutionSsoFailedView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -27,7 +27,7 @@
                     <h2 th:utext="#{screen.institutionssofailed.heading}"></h2>
                     <p th:utext="#{screen.institutionssofailed.message}"></p>
                 </section>
-                <section class="form-button" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section class="form-button" th:with="loginUrl=@{${@casServerLoginUrl}(casRedirectSource=cas)}">
                     <a class="mdc-button mdc-button--raised button-osf-blue" th:href="@{/logout(service=${loginUrl})}">
                         <span class="mdc-button__label" th:utext="#{screen.error.page.loginagain}"></span>
                     </a>
diff --git a/src/main/resources/templates/casInvalidUserStatusView.html b/src/main/resources/templates/casInvalidUserStatusView.html
index 895975a..e5b4077 100644
--- a/src/main/resources/templates/casInvalidUserStatusView.html
+++ b/src/main/resources/templates/casInvalidUserStatusView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -33,7 +33,7 @@ <h2 th:utext="#{screen.invaliduserstatus.heading}"></h2>
                     </a>
                 </section>
                 <hr class="my-4" />
-                <section class="text-with-mdi" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section class="text-with-mdi" th:with="loginUrl=@{${@casServerLoginUrl}(casRedirectSource=cas)}">
                     <span><a th:href="@{/logout(service=${loginUrl})}" th:utext="#{screen.error.page.loginagain}"></a></span>
                 </section>
             </section>
diff --git a/src/main/resources/templates/casInvalidVerificationKeyView.html b/src/main/resources/templates/casInvalidVerificationKeyView.html
index c6fd85d..d2737f1 100644
--- a/src/main/resources/templates/casInvalidVerificationKeyView.html
+++ b/src/main/resources/templates/casInvalidVerificationKeyView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -33,7 +33,7 @@ <h2 th:utext="#{screen.invalidverificationkey.heading}"></h2>
                     </a>
                 </section>
                 <hr class="my-4" />
-                <section class="text-with-mdi" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section class="text-with-mdi" th:with="loginUrl=@{${@casServerLoginUrl}(casRedirectSource=cas)}">
                     <span><a th:href="@{/logout(service=${loginUrl})}" th:utext="#{screen.error.page.loginagain}"></a></span>
                 </section>
             </section>
diff --git a/src/main/resources/templates/casLoginView.html b/src/main/resources/templates/casLoginView.html
index db87cd5..8250123 100644
--- a/src/main/resources/templates/casLoginView.html
+++ b/src/main/resources/templates/casLoginView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
diff --git a/src/main/resources/templates/casLogoutView.html b/src/main/resources/templates/casLogoutView.html
index 1e0a5d7..f4c32d3 100644
--- a/src/main/resources/templates/casLogoutView.html
+++ b/src/main/resources/templates/casLogoutView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -19,8 +19,8 @@
                         <a href="fragments/osfbannerui.html"></a>
                     </div>
                 </section>
-                <section class="text-without-mdi text-center text-bold text-large margin-large-vertical title-danger">
-                    <span th:utext="#{screen.generic.loginsuccess.tips}"></span>
+                <section class="text-without-mdi text-center text-bold text-large margin-large-vertical title">
+                    <span th:utext="#{screen.generic.logoutsuccess.tips}"></span>
                 </section>
                 <hr class="my-4" />
                 <section class="card-message">
@@ -33,7 +33,7 @@ <h2 th:utext="#{screen.generic.logoutsuccess.heading}"></h2>
                     </a>
                 </section>
                 <hr class="my-4" />
-                <section class="text-with-mdi" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section class="text-with-mdi">
                     <span><a th:href="@{/login(casRedirectSource=cas)}" th:utext="#{screen.generic.logoutsuccess.link.login}"></a></span>
                 </section>
             </section>
diff --git a/src/main/resources/templates/casOAuth20ErrorView.html b/src/main/resources/templates/casOAuth20ErrorView.html
index 57e5b3e..0cce26a 100644
--- a/src/main/resources/templates/casOAuth20ErrorView.html
+++ b/src/main/resources/templates/casOAuth20ErrorView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
diff --git a/src/main/resources/templates/casServiceErrorView.html b/src/main/resources/templates/casServiceErrorView.html
index 3b0c12c..588b507 100644
--- a/src/main/resources/templates/casServiceErrorView.html
+++ b/src/main/resources/templates/casServiceErrorView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -27,7 +27,7 @@
                     <h2 th:utext="#{screen.service.error.heading}"></h2>
                     <p th:if="${rootCauseException != null and rootCauseException.code != null}" th:utext="#{${rootCauseException.code}}"></p>
                 </section>
-                <section class="form-button" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section class="form-button" th:with="loginUrl=@{${@casServerLoginUrl}(casRedirectSource=cas)}">
                     <a class="mdc-button mdc-button--raised button-osf-blue" th:href="@{/logout(service=${loginUrl})}">
                         <span class="mdc-button__label" th:utext="#{screen.error.page.loginagain}"></span>
                     </a>
diff --git a/src/main/resources/templates/casTermsOfServiceConsentView.html b/src/main/resources/templates/casTermsOfServiceConsentView.html
index 0dd7163..4fb66e2 100644
--- a/src/main/resources/templates/casTermsOfServiceConsentView.html
+++ b/src/main/resources/templates/casTermsOfServiceConsentView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
diff --git a/src/main/resources/templates/casTwoFactorLoginView.html b/src/main/resources/templates/casTwoFactorLoginView.html
index c630bf1..c559d27 100644
--- a/src/main/resources/templates/casTwoFactorLoginView.html
+++ b/src/main/resources/templates/casTwoFactorLoginView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
diff --git a/src/main/resources/templates/casUnsupportedInstitutionLoginView.html b/src/main/resources/templates/casUnsupportedInstitutionLoginView.html
index 67a3bd3..e41053c 100644
--- a/src/main/resources/templates/casUnsupportedInstitutionLoginView.html
+++ b/src/main/resources/templates/casUnsupportedInstitutionLoginView.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge"/>
diff --git a/src/main/resources/templates/error.html b/src/main/resources/templates/error.html
index d276769..296f7e9 100644
--- a/src/main/resources/templates/error.html
+++ b/src/main/resources/templates/error.html
@@ -27,17 +27,23 @@
                     <h2 th:utext="#{screen.unavailable.heading}"></h2>
                     <div th:utext="#{screen.unavailable.message}"></div>
                 </section>
-                <section class="form-button" th:with="loginUrl=@{/login(casRedirectSource=cas)}">
+                <section id="errorInfo" class="pre-formatted-small word-break-all">
+                    <pre id="initiatorUrl"></pre>
+                    <pre th:utext="${'Error: ' + status + ' - ' + error}"></pre>
+                    <pre th:utext="${'Timestamp: ' + #dates.formatISO(#dates.createNow())}"></pre>
+                    <pre th:text="${'Message: ' + message}"></pre>
+                </section>
+                <section class="form-button" th:with="loginUrl=@{${@casServerLoginUrl}(casRedirectSource=cas)}">
                     <a class="mdc-button mdc-button--raised button-osf-blue" th:href="@{/logout(service=${loginUrl})}">
                         <span class="mdc-button__label" th:utext="#{screen.error.page.loginagain}"></span>
                     </a>
                 </section>
                 <hr class="my-4" />
                 <section class="text-with-mdi">
-                    <span><a th:href="@{/logout(service=${osfUrl.logout})}" th:utext="#{screen.authnerror.button.backtoosf}"></a></span>
+                    <span><a th:href="@{/logout}" th:utext="#{screen.authnerror.button.logout}"></a></span>
                 </section>
+                <!--
                 <section>
-                <!-- <section th:if="${devMode}"> -->
                     <hr class="my-4" />
                     <section class="text-without-mdi text-center text-bold text-large margin-large-vertical title-danger">
                         <span th:utext="#{screen.authnerror.tips.devmode}"></span>
@@ -64,11 +70,13 @@ <h2 th:utext="#{screen.unavailable.heading}"></h2>
                         <pre th:utext="${#strings.escapeXml(trace)}"></pre>
                     </section>
                 </section>
+                -->
             </section>
         </div>
 
         <script type="text/javascript">
             disableSignUpButton();
+            document.getElementById("initiatorUrl").innerHTML = "Request URL: " + window.location.href;
         </script>
 
         <script type="text/javascript">
diff --git a/src/main/resources/templates/error/401.html b/src/main/resources/templates/error/401.html
index c18ef4b..2d91710 100644
--- a/src/main/resources/templates/error/401.html
+++ b/src/main/resources/templates/error/401.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutFlowless}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
 
 <head>
     <meta charset="UTF-8">
diff --git a/src/main/resources/templates/error/403.html b/src/main/resources/templates/error/403.html
index 015c2e6..ffbf557 100644
--- a/src/main/resources/templates/error/403.html
+++ b/src/main/resources/templates/error/403.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutFlowless}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
 
 <head>
     <meta charset="UTF-8">
diff --git a/src/main/resources/templates/error/404.html b/src/main/resources/templates/error/404.html
index bf8f1a8..8dc0a8e 100644
--- a/src/main/resources/templates/error/404.html
+++ b/src/main/resources/templates/error/404.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutFlowless}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
 
 <head>
     <meta charset="UTF-8">
diff --git a/src/main/resources/templates/error/405.html b/src/main/resources/templates/error/405.html
index f5e43cb..fcfbb23 100644
--- a/src/main/resources/templates/error/405.html
+++ b/src/main/resources/templates/error/405.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutFlowless}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
 
 <head>
     <meta charset="UTF-8">
diff --git a/src/main/resources/templates/error/423.html b/src/main/resources/templates/error/423.html
index 504ab71..d347a42 100644
--- a/src/main/resources/templates/error/423.html
+++ b/src/main/resources/templates/error/423.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutFlowless}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
 
 <head>
     <meta charset="UTF-8">
diff --git a/src/main/resources/templates/fragments/header.html b/src/main/resources/templates/fragments/header.html
index cb393f9..9b353e8 100644
--- a/src/main/resources/templates/fragments/header.html
+++ b/src/main/resources/templates/fragments/header.html
@@ -20,16 +20,16 @@
                         <img class="cas-logo" src="/images/osf-logo-white.png">
                     </span>
                     <div class="cas-brand-text">
-                        <a class="navbar-link" th:href="@{${osfUrl.home}}">
+                        <a class="navbar-link" th:href="@{/login(casRedirectSource=tomcat)}">
                             <span class="cas-brand-name hidden-narrow" >OSF </span>
-                            <span class="cas-brand-name" >HOME</span>
+                            <span class="cas-brand-name" >CAS</span>
                         </a>
                     </div>
                 </section>
 
                 <section class="mdc-top-app-bar__section mdc-top-app-bar__section--align-center">
                     <div class="form-button form-button-navbar">
-                        <a id="osfRegister" class="mdc-button mdc-button--raised button-osf-green" th:href="@{${osfUrl.register}}">
+                        <a class="mdc-button mdc-button--raised button-osf-disabled">
                             <span class="mdc-button__label">Sign up</span>
                         </a>
                     </div>
diff --git a/src/main/resources/templates/fragments/headerflowless.html b/src/main/resources/templates/fragments/headerosf.html
similarity index 71%
rename from src/main/resources/templates/fragments/headerflowless.html
rename to src/main/resources/templates/fragments/headerosf.html
index 3120b47..46321cd 100644
--- a/src/main/resources/templates/fragments/headerflowless.html
+++ b/src/main/resources/templates/fragments/headerosf.html
@@ -10,7 +10,7 @@
 </head>
 
 <body>
-    <div th:fragment="headerflowless">
+    <div th:fragment="headerosf">
 
         <header id="app-bar" class="mdc-top-app-bar mdc-top-app-bar--fixed mdc-elevation--z4">
             <nav class="mdc-top-app-bar__row">
@@ -20,16 +20,16 @@
                         <img class="cas-logo" src="/images/osf-logo-white.png">
                     </span>
                     <div class="cas-brand-text">
-                        <a class="navbar-link" th:href="@{/login(casRedirectSource=tomcat)}">
+                        <a class="navbar-link" th:href="@{${osfUrl.home}}">
                             <span class="cas-brand-name hidden-narrow" >OSF </span>
-                            <span class="cas-brand-name" >CAS</span>
+                            <span class="cas-brand-name" >HOME</span>
                         </a>
                     </div>
                 </section>
 
                 <section class="mdc-top-app-bar__section mdc-top-app-bar__section--align-center">
                     <div class="form-button form-button-navbar">
-                        <a class="mdc-button mdc-button--raised button-osf-disabled">
+                        <a id="osfRegister" class="mdc-button mdc-button--raised button-osf-green" th:href="@{${osfUrl.register}}">
                             <span class="mdc-button__label">Sign up</span>
                         </a>
                     </div>
@@ -38,6 +38,19 @@
             </nav>
         </header>
 
+        <script type="text/javascript">
+            function disableSignUpButton() {
+                let signUpButton = document.getElementById("osfRegister");
+                if (signUpButton != null) {
+                    signUpButton.removeAttribute("href");
+                    signUpButton.style.opacity = "0.8";
+                    signUpButton.style.cursor = "not-allowed";
+                    signUpButton.style.backgroundColor = "#efefef";
+                    signUpButton.style.color = "#cccccc";
+                }
+            }
+        </script>
+
         <script type="text/javascript">
             (function (material) {
                 var header = {
diff --git a/src/main/resources/templates/fragments/tosloginform.html b/src/main/resources/templates/fragments/tosloginform.html
index 3397ce9..66aae11 100644
--- a/src/main/resources/templates/fragments/tosloginform.html
+++ b/src/main/resources/templates/fragments/tosloginform.html
@@ -99,6 +99,10 @@
                     }
                 </script>
 
+                <script type="text/javascript">
+                    disableSignUpButton();
+                </script>
+
                 <script type="text/javascript" th:inline="javascript">
                     /*<![CDATA[*/
                         var i = /*[[@{#{screen.generic.button.wip}}]]*/ 'One moment please...';
diff --git a/src/main/resources/templates/fragments/totploginform.html b/src/main/resources/templates/fragments/totploginform.html
index eec2f1e..9247cb8 100644
--- a/src/main/resources/templates/fragments/totploginform.html
+++ b/src/main/resources/templates/fragments/totploginform.html
@@ -133,6 +133,10 @@
                     </span>
                 </section>
 
+                <script type="text/javascript">
+                    disableSignUpButton();
+                </script>
+
                 <script type="text/javascript" th:inline="javascript">
                     /*<![CDATA[*/
                         var i = /*[[@{#{screen.generic.button.wip}}]]*/ 'One moment please ...' ;
diff --git a/src/main/resources/templates/layoutFlowless.html b/src/main/resources/templates/layoutosf.html
similarity index 93%
rename from src/main/resources/templates/layoutFlowless.html
rename to src/main/resources/templates/layoutosf.html
index efebe67..d440c72 100644
--- a/src/main/resources/templates/layoutFlowless.html
+++ b/src/main/resources/templates/layoutosf.html
@@ -21,8 +21,8 @@
 <body>
     <script th:replace="fragments/scripts"></script>
 
-    <div th:replace="fragments/headerflowless :: headerflowless">
-        <a href="fragments/headerflowless.html"></a>
+    <div th:replace="fragments/headerosf :: headerosf">
+        <a href="fragments/headerosf.html"></a>
     </div>
 
     <div class="mdc-drawer-scrim"></div>
diff --git a/src/main/resources/templates/protocol/oauth/confirm.html b/src/main/resources/templates/protocol/oauth/confirm.html
index 7093369..822948f 100644
--- a/src/main/resources/templates/protocol/oauth/confirm.html
+++ b/src/main/resources/templates/protocol/oauth/confirm.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layout}">
+<html xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorate="~{layoutosf}">
 
 <head>
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />