diff --git a/.gitignore b/.gitignore
index 8b66a5f3..258c0c62 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,9 +12,7 @@ msbuild.binlog
 *.idea
 
 Oqtane.Server/appsettings.json
-Oqtane.Server/Data/*.mdf
-Oqtane.Server/Data/*.ldf
-Oqtane.Server/Data/*.db
+Oqtane.Server/Data
 
 /Oqtane.Server/Properties/PublishProfiles/FolderProfile.pubxml
 Oqtane.Server/Content
@@ -22,3 +20,10 @@ Oqtane.Server/Packages
 Oqtane.Server/wwwroot/Content
 Oqtane.Server/wwwroot/Packages/*.log
 
+Oqtane.Server/wwwroot/Modules
+!Oqtane.Server/wwwroot/Modules/Oqtane.Modules.*
+!Oqtane.Server/wwwroot/Modules/Templates
+
+Oqtane.Server/wwwroot/Themes
+!Oqtane.Server/wwwroot/Themes/Oqtane.Themes.*
+!Oqtane.Server/wwwroot/Themes/Templates
diff --git a/Oqtane.Client/Installer/Controls/MySQLConfig.razor b/Oqtane.Client/Installer/Controls/MySQLConfig.razor
index 7de576b0..735285d4 100644
--- a/Oqtane.Client/Installer/Controls/MySQLConfig.razor
+++ b/Oqtane.Client/Installer/Controls/MySQLConfig.razor
@@ -28,7 +28,7 @@
 <div class="row mb-1 align-items-center">
     <Label Class="col-sm-3" For="pwd" HelpText="Enter the password to use for the database" ResourceKey="Pwd">Password:</Label>
     <div class="col-sm-9">
-        <input id="pwd" type="password" class="form-control" @bind="@_pwd" />
+        <input id="pwd" type="password" class="form-control" @bind="@_pwd" autocomplete="new-password" />
     </div>
 </div>
 
diff --git a/Oqtane.Client/Installer/Controls/PostgreSQLConfig.razor b/Oqtane.Client/Installer/Controls/PostgreSQLConfig.razor
index d3ff4eca..652e55dc 100644
--- a/Oqtane.Client/Installer/Controls/PostgreSQLConfig.razor
+++ b/Oqtane.Client/Installer/Controls/PostgreSQLConfig.razor
@@ -40,7 +40,7 @@
     <div class="row mb-1 align-items-center">
         <Label Class="col-sm-3" For="pwd" HelpText="Enter the password to use for the database" ResourceKey="Pwd">Password:</Label>
         <div class="col-sm-9">
-            <input id="pwd" type="password" class="form-control" @bind="@_pwd" />
+            <input id="pwd" type="password" class="form-control" @bind="@_pwd" autocomplete="new-password" />
         </div>
     </div>
 }
diff --git a/Oqtane.Client/Installer/Controls/SqlServerConfig.razor b/Oqtane.Client/Installer/Controls/SqlServerConfig.razor
index 021ba776..12c4b981 100644
--- a/Oqtane.Client/Installer/Controls/SqlServerConfig.razor
+++ b/Oqtane.Client/Installer/Controls/SqlServerConfig.razor
@@ -35,7 +35,7 @@
     <div class="row mb-1 align-items-center">
         <Label Class="col-sm-3" For="pwd" HelpText="Enter the password to use for the database" ResourceKey="Pwd">Password:</Label>
         <div class="col-sm-9">
-            <input id="pwd" type="password" class="form-control" @bind="@_pwd" />
+            <input id="pwd" type="password" class="form-control" @bind="@_pwd" autocomplete="new-password" />
         </div>
     </div>
 }
diff --git a/Oqtane.Client/Installer/Installer.razor b/Oqtane.Client/Installer/Installer.razor
index fc404d7f..5630b592 100644
--- a/Oqtane.Client/Installer/Installer.razor
+++ b/Oqtane.Client/Installer/Installer.razor
@@ -62,13 +62,19 @@
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="password" HelpText="Provide a password for the primary user account" ResourceKey="Password">Password:</Label>
                     <div class="col-sm-9">
-                        <input id="password" type="password" class="form-control" @bind="@_hostPassword" />
+						<div class="input-group">
+							<input id="password" type="@_passwordtype" class="form-control" @bind="@_hostPassword" autocomplete="new-password" />
+							<button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+						</div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="confirm" HelpText="Please confirm the password entered above by entering it again" ResourceKey="Confirm">Confirm:</Label>
                     <div class="col-sm-9">
-                        <input id="confirm" type="password" class="form-control" @bind="@_confirmPassword" />
+						<div class="input-group">
+							<input id="confirm" type="@_passwordtype" class="form-control" @bind="@_confirmPassword" autocomplete="new-password" />
+							<button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+						</div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
@@ -104,6 +110,8 @@
 
 	private string _hostUsername = string.Empty;
 	private string _hostPassword = string.Empty;
+	private string _passwordtype = "password";
+	private string _togglepassword = string.Empty;
 	private string _confirmPassword = string.Empty;
 	private string _hostEmail = string.Empty;
 	private bool _register = true;
@@ -112,6 +120,7 @@
 
 	protected override async Task OnInitializedAsync()
 	{
+		_togglepassword = SharedLocalizer["ShowPassword"];
 		_databases = await DatabaseService.GetDatabasesAsync();
 		if (_databases.Exists(item => item.IsDefault))
 		{
@@ -218,4 +227,18 @@
             _message = Localizer["Message.Require.DbInfo"];
         }
     }
+
+	private void TogglePassword()
+	{
+		if (_passwordtype == "password")
+		{
+			_passwordtype = "text";
+			_togglepassword = SharedLocalizer["HidePassword"];
+		}
+		else
+		{
+			_passwordtype = "password";
+			_togglepassword = SharedLocalizer["ShowPassword"];
+		}
+	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Languages/Index.razor b/Oqtane.Client/Modules/Admin/Languages/Index.razor
index 947cddc7..e98db7d9 100644
--- a/Oqtane.Client/Modules/Admin/Languages/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Languages/Index.razor
@@ -84,7 +84,7 @@ else
             var package = _packages.Where(item => item.PackageId == (Constants.PackageId + ".Client." + code)).FirstOrDefault();
             if (package != null)
             {
-                upgradeavailable = (Version.Parse(package.Version).CompareTo(Version.Parse(Constants.Version)) > 0);
+                upgradeavailable = (Version.Parse(package.Version).CompareTo(Version.Parse(Constants.Version)) == 0);
             }
 
         }
diff --git a/Oqtane.Client/Modules/Admin/Login/Index.razor b/Oqtane.Client/Modules/Admin/Login/Index.razor
index 80d4f5e4..6b4d02e1 100644
--- a/Oqtane.Client/Modules/Admin/Login/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Login/Index.razor
@@ -95,7 +95,7 @@
 	{
 		try
 		{
-			_togglepassword = Localizer["ShowPassword"];
+			_togglepassword = SharedLocalizer["ShowPassword"];
 
 			if (PageState.Site.Settings.ContainsKey("LoginOptions:AllowSiteLogin") && !string.IsNullOrEmpty(PageState.Site.Settings["LoginOptions:AllowSiteLogin"]))
 			{
@@ -117,22 +117,47 @@
 				_username = PageState.QueryString["name"];
 			}
 
-			if (PageState.QueryString.ContainsKey("token"))
+			if (PageState.QueryString.ContainsKey("token") && !string.IsNullOrEmpty(_username))
 			{
 				var user = new User();
 				user.SiteId = PageState.Site.SiteId;
 				user.Username = _username;
-				user = await UserService.VerifyEmailAsync(user, PageState.QueryString["token"]);
 
-				if (user != null)
+				if (PageState.QueryString.ContainsKey("key"))
 				{
-					await logger.LogInformation(LogFunction.Security, "Email Verified For For Username {Username}", _username);
-					AddModuleMessage(Localizer["Success.Account.Verified"], MessageType.Info);						
+					user = await UserService.LinkUserAsync(user, PageState.QueryString["token"], PageState.Site.Settings["ExternalLogin:ProviderType"], PageState.QueryString["key"], PageState.Site.Settings["ExternalLogin:ProviderName"]);
+					if (user != null)
+					{
+						await logger.LogInformation(LogFunction.Security, "External Login Linkage Successful For Username {Username}", _username);
+						AddModuleMessage(Localizer["Success.Account.Linked"], MessageType.Info);						
+					}
+					else
+					{
+						await logger.LogError(LogFunction.Security, "External Login Linkage Failed For Username {Username}", _username);
+						AddModuleMessage(Localizer["Message.Account.NotLinked"], MessageType.Warning);						
+					}
+					_username = "";
 				}
 				else
 				{
-					await logger.LogError(LogFunction.Security, "Email Verification Failed For Username {Username}", _username);
-					AddModuleMessage(Localizer["Message.Account.NotVerfied"], MessageType.Warning);						
+					user = await UserService.VerifyEmailAsync(user, PageState.QueryString["token"]);
+					if (user != null)
+					{
+						await logger.LogInformation(LogFunction.Security, "Email Verified For For Username {Username}", _username);
+						AddModuleMessage(Localizer["Success.Account.Verified"], MessageType.Info);						
+					}
+					else
+					{
+						await logger.LogError(LogFunction.Security, "Email Verification Failed For Username {Username}", _username);
+						AddModuleMessage(Localizer["Message.Account.NotVerified"], MessageType.Warning);						
+					}
+				}
+			}
+			else
+			{
+				if (PageState.QueryString.ContainsKey("status"))
+				{
+					AddModuleMessage(Localizer["ExternalLoginStatus." + PageState.QueryString["status"]], MessageType.Info);
 				}
 			}
 		}
@@ -163,7 +188,7 @@
 
 				if (!twofactor)
 				{
-					user = await UserService.LoginUserAsync(user, false, false);
+					user = await UserService.LoginUserAsync(user);
 				}
 				else
 				{
@@ -174,23 +199,14 @@
 				{
 					await logger.LogInformation(LogFunction.Security, "Login Successful For Username {Username}", _username);
 
-					if (PageState.Runtime == Oqtane.Shared.Runtime.Server)
-					{
-						// server-side Blazor needs to post to the Login page so that the cookies are set correctly
-						var fields = new { __RequestVerificationToken = SiteState.AntiForgeryToken, username = _username, password = _password, remember = _remember, returnurl = _returnUrl };
-						string url = Utilities.TenantUrl(PageState.Alias, "/pages/login/");
-						await interop.SubmitForm(url, fields);
-					}
-					else
-					{
-						var authstateprovider = (IdentityAuthenticationStateProvider)ServiceProvider.GetService(typeof(IdentityAuthenticationStateProvider));
-						authstateprovider.NotifyAuthenticationChanged();
-						NavigationManager.NavigateTo(NavigateUrl(_returnUrl, true));
-					}
+					// post back to the Login page so that the cookies are set correctly
+					var fields = new { __RequestVerificationToken = SiteState.AntiForgeryToken, username = _username, password = _password, remember = _remember, returnurl = _returnUrl };
+					string url = Utilities.TenantUrl(PageState.Alias, "/pages/login/");
+					await interop.SubmitForm(url, fields);
 				}
 				else
 				{
-					if (user.TwoFactorRequired)
+					if (PageState.Site.Settings["LoginOptions:TwoFactor"] == "required" || user.TwoFactorRequired)
 					{
 						twofactor = true;
 						validated = false;
@@ -282,12 +298,12 @@
 		if (_passwordtype == "password")
 		{
 			_passwordtype = "text";
-			_togglepassword = Localizer["HidePassword"];
+			_togglepassword = SharedLocalizer["HidePassword"];
 		}
 		else
 		{
 			_passwordtype = "password";
-			_togglepassword = Localizer["ShowPassword"];
+			_togglepassword = SharedLocalizer["ShowPassword"];
 		}
 	}
 
diff --git a/Oqtane.Client/Modules/Admin/ModuleDefinitions/Create.razor b/Oqtane.Client/Modules/Admin/ModuleDefinitions/Create.razor
index dda4087c..1af77986 100644
--- a/Oqtane.Client/Modules/Admin/ModuleDefinitions/Create.razor
+++ b/Oqtane.Client/Modules/Admin/ModuleDefinitions/Create.razor
@@ -81,7 +81,7 @@
     private List<Template> _templates;
     private string _template = "-";
     private string[] _versions;
-    private string _reference = Constants.Version;
+    private string _reference = "local";
     private string _minversion = "2.0.0";
     private string _location = string.Empty;
 
diff --git a/Oqtane.Client/Modules/Admin/ModuleDefinitions/Index.razor b/Oqtane.Client/Modules/Admin/ModuleDefinitions/Index.razor
index 4648e900..049582c6 100644
--- a/Oqtane.Client/Modules/Admin/ModuleDefinitions/Index.razor
+++ b/Oqtane.Client/Modules/Admin/ModuleDefinitions/Index.razor
@@ -50,9 +50,12 @@ else
                 @((MarkupString)PurchaseLink(context.PackageName))
             </td>
             <td>
-                @if (UpgradeAvailable(context.PackageName, context.Version))
+				@{ 
+					var version = UpgradeAvailable(context.PackageName, context.Version);
+				} 
+                @if (version != context.Version)
                 {
-                    <button type="button" class="btn btn-success" @onclick=@(async () => await DownloadModule(context.PackageName, context.Version))>@SharedLocalizer["Upgrade"]</button>
+                    <button type="button" class="btn btn-success" @onclick=@(async () => await DownloadModule(context.PackageName, version))>@SharedLocalizer["Upgrade"]</button>
                 }
             </td>
         </Row>
@@ -60,62 +63,60 @@ else
 }
 
 @code {
-    private List<ModuleDefinition> _moduleDefinitions;
-    private List<Package> _packages;
+	private List<ModuleDefinition> _moduleDefinitions;
+	private List<Package> _packages;
 
-    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Host;
+	public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Host;
 
-    protected override async Task OnParametersSetAsync()
-    {
-        try
-        {
-            _moduleDefinitions = await ModuleDefinitionService.GetModuleDefinitionsAsync(PageState.Site.SiteId);
-            _packages = await PackageService.GetPackagesAsync("module");
+	protected override async Task OnParametersSetAsync()
+	{
+		try
+		{
+			_moduleDefinitions = await ModuleDefinitionService.GetModuleDefinitionsAsync(PageState.Site.SiteId);
+			_packages = await PackageService.GetPackagesAsync("module");
+		}
+		catch (Exception ex)
+		{
+			if (_moduleDefinitions == null)
+			{
+				await logger.LogError(ex, "Error Loading Modules {Error}", ex.Message);
+				AddModuleMessage(Localizer["Error.Module.Load"], MessageType.Error);
+			}
+		}
+	}
+
+	private string PurchaseLink(string packagename)
+	{
+		string link = "";
+		if (!string.IsNullOrEmpty(packagename) && _packages != null)
+		{
+			var package = _packages.Where(item => item.PackageId == packagename).FirstOrDefault();
+			if (package != null)
+			{
+				if (package.ExpiryDate != null && package.ExpiryDate.Value.Date != DateTime.MaxValue.Date)
+				{
+					link += "<span>" + package.ExpiryDate.Value.Date.ToString("MMM dd, yyyy") + "</span>";
+					if (!string.IsNullOrEmpty(package.PaymentUrl))
+					{
+						link += "&nbsp;&nbsp;<a class=\"btn btn-primary\" style=\"text-decoration: none !important\" href=\"" + package.PaymentUrl + "\" target=\"_new\">" + SharedLocalizer["Extend"] + "</a>";
+					}
+				}
+			}
+		}
+		return link;
+	}
+
+	private string UpgradeAvailable(string packagename, string version)
+	{
+		if (!string.IsNullOrEmpty(packagename) && _packages != null)
+		{
+			var package = _packages.Where(item => item.PackageId == packagename).FirstOrDefault();
+			if (package != null && Version.Parse(package.Version).CompareTo(Version.Parse(version)) > 0)
+			{
+				return package.Version;
+			}
         }
-        catch (Exception ex)
-        {
-            if (_moduleDefinitions == null)
-            {
-                await logger.LogError(ex, "Error Loading Modules {Error}", ex.Message);
-                AddModuleMessage(Localizer["Error.Module.Load"], MessageType.Error);
-            }
-        }
-    }
-
-    private string PurchaseLink(string packagename)
-    {
-        string link = "";
-        if (!string.IsNullOrEmpty(packagename) && _packages != null)
-        {
-            var package = _packages.Where(item => item.PackageId == packagename).FirstOrDefault();
-            if (package != null)
-            {
-                if (package.ExpiryDate != null && package.ExpiryDate.Value.Date != DateTime.MaxValue.Date)
-                {
-                    link += "<span>" + package.ExpiryDate.Value.Date.ToString("MMM dd, yyyy") + "</span>";
-                    if (!string.IsNullOrEmpty(package.PaymentUrl))
-                    {
-                        link += "&nbsp;&nbsp;<a class=\"btn btn-primary\" style=\"text-decoration: none !important\" href=\"" + package.PaymentUrl + "\" target=\"_new\">" + SharedLocalizer["Extend"] + "</a>";
-                    }
-                }
-            }
-        }
-        return link;
-    }
-
-    private bool UpgradeAvailable(string packagename, string version)
-    {
-        var upgradeavailable = false;
-        if (!string.IsNullOrEmpty(packagename) && _packages != null)
-        {
-            var package = _packages.Where(item => item.PackageId == packagename).FirstOrDefault();
-            if (package != null)
-            {
-                upgradeavailable = (Version.Parse(package.Version).CompareTo(Version.Parse(version)) > 0);
-            }
-
-        }
-        return upgradeavailable;
+        return version;
     }
 
     private async Task DownloadModule(string packagename, string version)
diff --git a/Oqtane.Client/Modules/Admin/Register/Index.razor b/Oqtane.Client/Modules/Admin/Register/Index.razor
index 66ec29e5..24ca61b5 100644
--- a/Oqtane.Client/Modules/Admin/Register/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Register/Index.razor
@@ -27,19 +27,25 @@
                     <div class="row mb-1 align-items-center">
                         <Label Class="col-sm-3" For="password" HelpText="Please choose a sufficiently secure password and enter it here" ResourceKey="Password"></Label>
                         <div class="col-sm-9">
-                            <input id="password" type="password" class="form-control" @bind="@_password" autocomplete="new-password" required />
+							<div class="input-group">
+								<input id="password" type="@_passwordtype" class="form-control" @bind="@_password" autocomplete="new-password" required />
+								<button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+							</div>
                         </div>
                     </div>
                     <div class="row mb-1 align-items-center">
                         <Label Class="col-sm-3" For="confirm" HelpText="Enter your password again to confirm it matches the value entered above" ResourceKey="Confirm"></Label>
                         <div class="col-sm-9">
-                            <input id="confirm" type="password" class="form-control" @bind="@_confirm" autocomplete="new-password" required />
+							<div class="input-group">
+								<input id="confirm" type="@_passwordtype" class="form-control" @bind="@_confirm" autocomplete="new-password" required />
+								<button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+							</div>
                         </div>
                     </div>
                     <div class="row mb-1 align-items-center">
                         <Label Class="col-sm-3" For="email" HelpText="Your email address where you wish to receive notifications" ResourceKey="Email"></Label>
                         <div class="col-sm-9">
-                            <input id="email" class="form-control" @bind="@_email" maxlength="256" required />
+							<input id="email" class="form-control" @bind="@_email" maxlength="256" required />
                         </div>
                     </div>
                     <div class="row mb-1 align-items-center">
@@ -62,15 +68,22 @@ else
 }
 
 @code {
-    private string _username = string.Empty;
-    private ElementReference form;
-    private bool validated = false;
-    private string _password = string.Empty;
-    private string _confirm = string.Empty;
-    private string _email = string.Empty;
-    private string _displayname = string.Empty;
+	private string _username = string.Empty;
+	private ElementReference form;
+	private bool validated = false;
+	private string _password = string.Empty;
+	private string _passwordtype = "password";
+	private string _togglepassword = string.Empty;
+	private string _confirm = string.Empty;
+	private string _email = string.Empty;
+	private string _displayname = string.Empty;
 
-    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Anonymous;
+	public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Anonymous;
+
+	protected override void OnParametersSet()
+	{
+		_togglepassword = SharedLocalizer["ShowPassword"];
+	}
 
     private async Task Register()
     {
@@ -134,4 +147,18 @@ else
     {
         NavigationManager.NavigateTo(NavigateUrl(string.Empty));
     }
+
+    private void TogglePassword()
+	{
+		if (_passwordtype == "password")
+		{
+			_passwordtype = "text";
+			_togglepassword = SharedLocalizer["HidePassword"];
+		}
+		else
+		{
+			_passwordtype = "password";
+			_togglepassword = SharedLocalizer["ShowPassword"];
+		}
+	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Reset/Index.razor b/Oqtane.Client/Modules/Admin/Reset/Index.razor
index 00eac54d..07556105 100644
--- a/Oqtane.Client/Modules/Admin/Reset/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Reset/Index.razor
@@ -16,13 +16,19 @@
         <div class="row mb-1 align-items-center">
             <Label Class="col-sm-3" For="password" HelpText="The new password. It must satisfy complexity rules for the site." ResourceKey="Password">Password: </Label>
             <div class="col-sm-9">
-                <input id="password" type="password" class="form-control" @bind="@_password" required />
+				<div class="input-group">
+					<input id="password" type="@_passwordtype" class="form-control" @bind="@_password" autocomplete="new-password" required />
+					<button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+				</div>
             </div>
         </div>
         <div class="row mb-1 align-items-center">
             <Label Class="col-sm-3" For="confirm" HelpText="Enter the password again. It must exactly match the password entered above." ResourceKey="Confirm">Confirm: </Label>
             <div class="col-sm-9">
-                <input id="confirm" type="password" class="form-control" @bind="@_confirm" required />
+				<div class="input-group">
+					<input id="confirm" type="@_passwordtype" class="form-control" @bind="@_confirm" autocomplete="new-password" required />
+					<button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+				</div>
             </div>
         </div>
     </div>
@@ -36,12 +42,16 @@
 	private bool validated = false;
 	private string _username = string.Empty;
 	private string _password = string.Empty;
+	private string _passwordtype = "password";
+	private string _togglepassword = string.Empty;
 	private string _confirm = string.Empty;
 
 	public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Anonymous;
 
 	protected override async Task OnInitializedAsync()
 	{
+		_togglepassword = SharedLocalizer["ShowPassword"];
+
 		if (PageState.QueryString.ContainsKey("name") && PageState.QueryString.ContainsKey("token"))
         {
             _username = PageState.QueryString["name"];
@@ -110,4 +120,18 @@
     {
         NavigationManager.NavigateTo(NavigateUrl(string.Empty));
     }
+
+    private void TogglePassword()
+	{
+		if (_passwordtype == "password")
+		{
+			_passwordtype = "text";
+			_togglepassword = SharedLocalizer["HidePassword"];
+		}
+		else
+		{
+			_passwordtype = "password";
+			_togglepassword = SharedLocalizer["ShowPassword"];
+		}
+	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Roles/Users.razor b/Oqtane.Client/Modules/Admin/Roles/Users.razor
index c96221e3..359bc113 100644
--- a/Oqtane.Client/Modules/Admin/Roles/Users.razor
+++ b/Oqtane.Client/Modules/Admin/Roles/Users.razor
@@ -95,11 +95,7 @@ else
             roleid = Int32.Parse(PageState.QueryString["id"]);
             Role role = await RoleService.GetRoleAsync(roleid);
             name = role.Name;
-            users = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId);
-            users = users
-                .Where(u => u.Role.Name == RoleNames.Registered)
-                .OrderBy(u => u.User.DisplayName)
-                .ToList();
+            users = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId, RoleNames.Registered);
             await GetUserRoles();
         }
         catch (Exception ex)
@@ -113,8 +109,7 @@ else
     {
         try
         {
-            userroles = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId);
-            userroles = userroles.Where(item => item.RoleId == roleid).ToList();
+            userroles = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId, name);
         }
         catch (Exception ex)
         {
diff --git a/Oqtane.Client/Modules/Admin/Site/Index.razor b/Oqtane.Client/Modules/Admin/Site/Index.razor
index 252213c6..3d0ce023 100644
--- a/Oqtane.Client/Modules/Admin/Site/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Site/Index.razor
@@ -341,7 +341,7 @@
 				_smtpssl = SettingService.GetSetting(settings, "SMTPSSL", "False");
 				_smtpusername = SettingService.GetSetting(settings, "SMTPUsername", string.Empty);
 				_smtppassword = SettingService.GetSetting(settings, "SMTPPassword", string.Empty);
-				_togglesmtppassword = Localizer["Show"];
+				_togglesmtppassword = SharedLocalizer["ShowPassword"];
 				_smtpsender = SettingService.GetSetting(settings, "SMTPSender", string.Empty);
 				_retention = SettingService.GetSetting(settings, "NotificationRetention", "30");
 
@@ -407,7 +407,7 @@
 		{
 			try
 			{
-				if (_name != string.Empty && _urls != string.Empty && _themetype != "-" && _containertype != "-")
+				if (_name != string.Empty && _themetype != "-" && _containertype != "-")
 				{
 					var unique = true;
 					if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host))
@@ -656,12 +656,12 @@
 		if (_smtppasswordtype == "password")
 		{
 			_smtppasswordtype = "text";
-			_togglesmtppassword = Localizer["Hide"];
+			_togglesmtppassword = SharedLocalizer["HidePassword"];
 		}
 		else
 		{
 			_smtppasswordtype = "password";
-			_togglesmtppassword = Localizer["Show"];
+			_togglesmtppassword = SharedLocalizer["ShowPassword"];
 		}
 	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Sites/Add.razor b/Oqtane.Client/Modules/Admin/Sites/Add.razor
index 14cbc5f0..7f1e12bd 100644
--- a/Oqtane.Client/Modules/Admin/Sites/Add.razor
+++ b/Oqtane.Client/Modules/Admin/Sites/Add.razor
@@ -156,7 +156,7 @@ else
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="hostPassword" HelpText="Enter the password of an existing host user" ResourceKey="HostPassword">Host Password:</Label>
                     <div class="col-sm-9">
-                        <input id="hostPassword" type="password" class="form-control" @bind="@_hostpassword" required />
+                        <input id="hostPassword" type="password" class="form-control" @bind="@_hostpassword" autocomplete="new-password" required />
                     </div>
                 </div>
             }
@@ -307,7 +307,7 @@ else
                             user.SiteId = PageState.Site.SiteId;
                             user.Username = _hostusername;
                             user.Password = _hostpassword;
-                            user = await UserService.LoginUserAsync(user, false, false);
+                            user = await UserService.LoginUserAsync(user);
                             if (user.IsAuthenticated)
                             {
                                 var connectionString = String.Empty;
diff --git a/Oqtane.Client/Modules/Admin/Themes/Create.razor b/Oqtane.Client/Modules/Admin/Themes/Create.razor
index d472047c..ef3ab372 100644
--- a/Oqtane.Client/Modules/Admin/Themes/Create.razor
+++ b/Oqtane.Client/Modules/Admin/Themes/Create.razor
@@ -72,7 +72,7 @@
     private List<Template> _templates;
     private string _template = "-";
     private string[] _versions;
-    private string _reference = Constants.Version;
+    private string _reference = "local";
     private string _minversion = "2.0.0";
     private string _location = string.Empty;
 
diff --git a/Oqtane.Client/Modules/Admin/Themes/Index.razor b/Oqtane.Client/Modules/Admin/Themes/Index.razor
index 5c089dfa..90213b9e 100644
--- a/Oqtane.Client/Modules/Admin/Themes/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Themes/Index.razor
@@ -40,9 +40,12 @@ else
                 @((MarkupString)PurchaseLink(context.PackageName))
             </td>
             <td>
-                @if (UpgradeAvailable(context.PackageName, context.Version))
+				@{ 
+					var version = UpgradeAvailable(context.PackageName, context.Version);
+				} 
+                @if (version != context.Version)
                 {
-                    <button type="button" class="btn btn-success" @onclick=@(async () => await DownloadTheme(context.PackageName, context.Version))>@SharedLocalizer["Upgrade"]</button>
+                    <button type="button" class="btn btn-success" @onclick=@(async () => await DownloadTheme(context.PackageName, version))>@SharedLocalizer["Upgrade"]</button>
                 }
             </td>
             <td></td>
@@ -94,18 +97,17 @@ else
         return link;
     }
 
-    private bool UpgradeAvailable(string packagename, string version)
-    {
-        var upgradeavailable = false;
-        if (!string.IsNullOrEmpty(packagename) && _packages != null)
-        {
-            var package = _packages.Where(item => item.PackageId == packagename).FirstOrDefault();
-            if (package != null)
-            {
-                upgradeavailable = (Version.Parse(package.Version).CompareTo(Version.Parse(version)) > 0);
-            }
+	private string UpgradeAvailable(string packagename, string version)
+	{
+		if (!string.IsNullOrEmpty(packagename) && _packages != null)
+		{
+			var package = _packages.Where(item => item.PackageId == packagename).FirstOrDefault();
+			if (package != null && Version.Parse(package.Version).CompareTo(Version.Parse(version)) > 0)
+			{
+				return package.Version;
+			}
         }
-        return upgradeavailable;
+        return version;
     }
 
     private async Task DownloadTheme(string packagename, string version)
diff --git a/Oqtane.Client/Modules/Admin/UserProfile/Index.razor b/Oqtane.Client/Modules/Admin/UserProfile/Index.razor
index 6bcf5f4a..a2aeb314 100644
--- a/Oqtane.Client/Modules/Admin/UserProfile/Index.razor
+++ b/Oqtane.Client/Modules/Admin/UserProfile/Index.razor
@@ -31,14 +31,20 @@ else
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="password" HelpText="If you wish to change your password you can enter it here. Please choose a sufficiently secure password." ResourceKey="Password"></Label>
-                    <div class="col-sm-9">
-                        <input id="password" type="password" class="form-control" @bind="@password" autocomplete="new-password" />
+					<div class="col-sm-9">
+                        <div class="input-group">
+						    <input id="password" type="@_passwordtype" class="form-control" @bind="@_password" autocomplete="new-password" />
+						    <button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+					    </div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="confirm" HelpText="If you are changing your password you must enter it again to confirm it matches" ResourceKey="Confirm"></Label>
                     <div class="col-sm-9">
-                        <input id="confirm" type="password" class="form-control" @bind="@confirm" autocomplete="new-password" />
+                        <div class="input-group">
+							<input id="confirm" type="@_passwordtype" class="form-control" @bind="@confirm" autocomplete="new-password" />
+						    <button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+					    </div>
                     </div>
                 </div>
 				@if (allowtwofactor)
@@ -205,6 +211,8 @@ else
                     </Detail>
                 </Pager>
             }
+            <br />
+            <ActionDialog Header="Clear Notifications" Message="Are You Sure You Wish To Permanently Delete All Notifications ?" Action="Delete All Notifications" Security="SecurityAccessLevel.Admin" Class="btn btn-danger" OnClick="@(async () => await DeleteAllNotifications())" ResourceKey="DeleteAllNotifications" />
             <br /><hr />
             <select class="form-select" @onchange="(e => FilterChanged(e))">
                 <option value="to">@Localizer["Inbox"]</option>
@@ -216,122 +224,126 @@ else
 <br /><br />
 
 @code {
-	private string username = string.Empty;
-	private string password = string.Empty;
-	private string confirm = string.Empty;
-	private bool allowtwofactor = false;
-	private string twofactor = "False";
-	private string email = string.Empty;
-	private string displayname = string.Empty;
-	private FileManager filemanager;
-	private int folderid = -1;
-	private int photofileid = -1;
-	private File photo = null;
-	private List<Profile> profiles;
-	private Dictionary<string, string> settings;
-	private string category = string.Empty;
-	private string filter = "to";
-	private List<Notification> notifications;
+    private string username = string.Empty;
+    private string _password = string.Empty;
+	private string _passwordtype = "password";
+	private string _togglepassword = string.Empty;
+    private string confirm = string.Empty;
+    private bool allowtwofactor = false;
+    private string twofactor = "False";
+    private string email = string.Empty;
+    private string displayname = string.Empty;
+    private FileManager filemanager;
+    private int folderid = -1;
+    private int photofileid = -1;
+    private File photo = null;
+    private List<Profile> profiles;
+    private Dictionary<string, string> settings;
+    private string category = string.Empty;
+    private string filter = "to";
+    private List<Notification> notifications;
 
-	public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.View;
+    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.View;
 
-	protected override async Task OnParametersSetAsync()
-	{
-		try
-		{
-			if (PageState.Site.Settings.ContainsKey("LoginOptions:TwoFactor") && !string.IsNullOrEmpty(PageState.Site.Settings["LoginOptions:TwoFactor"]))
-			{
-				allowtwofactor = bool.Parse(PageState.Site.Settings["LoginOptions:TwoFactor"]);
-			}
+    protected override async Task OnParametersSetAsync()
+    {
+        try
+        {
+            _togglepassword = SharedLocalizer["ShowPassword"];
 
-			if (PageState.User != null)
-			{
-				username = PageState.User.Username;
-				twofactor = PageState.User.TwoFactorRequired.ToString();
-				email = PageState.User.Email;
-				displayname = PageState.User.DisplayName;
+            if (PageState.Site.Settings.ContainsKey("LoginOptions:TwoFactor") && !string.IsNullOrEmpty(PageState.Site.Settings["LoginOptions:TwoFactor"]))
+            {
+                allowtwofactor = (PageState.Site.Settings["LoginOptions:TwoFactor"] == "true");
+            }
 
-				// get user folder
-				var folder = await FolderService.GetFolderAsync(ModuleState.SiteId, PageState.User.FolderPath);
-				if (folder != null)
-				{
-					folderid = folder.FolderId;
-				}
+            if (PageState.User != null)
+            {
+                username = PageState.User.Username;
+                twofactor = PageState.User.TwoFactorRequired.ToString();
+                email = PageState.User.Email;
+                displayname = PageState.User.DisplayName;
 
-				if (PageState.User.PhotoFileId != null)
-				{
-					photofileid = PageState.User.PhotoFileId.Value;
-					photo = await FileService.GetFileAsync(photofileid);
-				}
-				else
-				{
-					photofileid = -1;
-					photo = null;
-				}
+                // get user folder
+                var folder = await FolderService.GetFolderAsync(ModuleState.SiteId, PageState.User.FolderPath);
+                if (folder != null)
+                {
+                    folderid = folder.FolderId;
+                }
 
-				profiles = await ProfileService.GetProfilesAsync(ModuleState.SiteId);
-				settings = await SettingService.GetUserSettingsAsync(PageState.User.UserId);
+                if (PageState.User.PhotoFileId != null)
+                {
+                    photofileid = PageState.User.PhotoFileId.Value;
+                    photo = await FileService.GetFileAsync(photofileid);
+                }
+                else
+                {
+                    photofileid = -1;
+                    photo = null;
+                }
 
-				await LoadNotificationsAsync();
-			}
-			else
-			{
-				AddModuleMessage(Localizer["Message.User.NoLogIn"], MessageType.Warning);
-			}
-		}
-		catch (Exception ex)
-		{
-			await logger.LogError(ex, "Error Loading User Profile {Error}", ex.Message);
-			AddModuleMessage(Localizer["Error.Profile.Load"], MessageType.Error);
-		}
-	}
+                profiles = await ProfileService.GetProfilesAsync(ModuleState.SiteId);
+                settings = await SettingService.GetUserSettingsAsync(PageState.User.UserId);
 
-	private async Task LoadNotificationsAsync()
-	{
-		notifications = await NotificationService.GetNotificationsAsync(PageState.Site.SiteId, filter, PageState.User.UserId);
-		notifications = notifications.Where(item => item.DeletedBy != PageState.User.Username).ToList();
-	}
+                await LoadNotificationsAsync();
+            }
+            else
+            {
+                AddModuleMessage(Localizer["Message.User.NoLogIn"], MessageType.Warning);
+            }
+        }
+        catch (Exception ex)
+        {
+            await logger.LogError(ex, "Error Loading User Profile {Error}", ex.Message);
+            AddModuleMessage(Localizer["Error.Profile.Load"], MessageType.Error);
+        }
+    }
 
-	private string GetProfileValue(string SettingName, string DefaultValue)
-		=> SettingService.GetSetting(settings, SettingName, DefaultValue);
+    private async Task LoadNotificationsAsync()
+    {
+        notifications = await NotificationService.GetNotificationsAsync(PageState.Site.SiteId, filter, PageState.User.UserId);
+        notifications = notifications.Where(item => item.DeletedBy != PageState.User.Username).ToList();
+    }
 
-	private async Task Save()
-	{
-		try
-		{
-			if (username != string.Empty && email != string.Empty && ValidateProfiles())
-			{
-				if (password == confirm)
-				{
-					var user = PageState.User;
-					user.Username = username;
-					user.Password = password;
-					user.TwoFactorRequired = bool.Parse(twofactor);
-					user.Email = email;
-					user.DisplayName = (displayname == string.Empty ? username : displayname);
-					user.PhotoFileId = filemanager.GetFileId();
-					if (user.PhotoFileId == -1)
-					{
-						user.PhotoFileId = null;
-					}
-					if (user.PhotoFileId != null)
-					{
-						photofileid = user.PhotoFileId.Value;
-						photo = await FileService.GetFileAsync(photofileid);
-					}
-					else
-					{
-						photofileid = -1;
-						photo = null;
-					}
+    private string GetProfileValue(string SettingName, string DefaultValue)
+        => SettingService.GetSetting(settings, SettingName, DefaultValue);
 
-					await UserService.UpdateUserAsync(user);
-					await SettingService.UpdateUserSettingsAsync(settings, PageState.User.UserId);
-					await logger.LogInformation("User Profile Saved");
+    private async Task Save()
+    {
+        try
+        {
+            if (username != string.Empty && email != string.Empty && ValidateProfiles())
+            {
+                if (_password == confirm)
+                {
+                    var user = PageState.User;
+                    user.Username = username;
+                    user.Password = _password;
+                    user.TwoFactorRequired = bool.Parse(twofactor);
+                    user.Email = email;
+                    user.DisplayName = (displayname == string.Empty ? username : displayname);
+                    user.PhotoFileId = filemanager.GetFileId();
+                    if (user.PhotoFileId == -1)
+                    {
+                        user.PhotoFileId = null;
+                    }
+                    if (user.PhotoFileId != null)
+                    {
+                        photofileid = user.PhotoFileId.Value;
+                        photo = await FileService.GetFileAsync(photofileid);
+                    }
+                    else
+                    {
+                        photofileid = -1;
+                        photo = null;
+                    }
 
-					AddModuleMessage(Localizer["Success.Profile.Update"], MessageType.Success);
-					StateHasChanged();
-				}
+                    await UserService.UpdateUserAsync(user);
+                    await SettingService.UpdateUserSettingsAsync(settings, PageState.User.UserId);
+                    await logger.LogInformation("User Profile Saved");
+
+                    AddModuleMessage(Localizer["Success.Profile.Update"], MessageType.Success);
+                    StateHasChanged();
+                }
                 else
                 {
                     AddModuleMessage(Localizer["Message.Password.Invalid"], MessageType.Warning);
@@ -413,4 +425,47 @@ else
         StateHasChanged();
     }
 
+    private async Task DeleteAllNotifications()
+    {
+        try
+        {
+            foreach(var Notification in notifications)
+            {
+                if (!Notification.IsDeleted)
+                {
+                    Notification.IsDeleted = true;
+                    await NotificationService.UpdateNotificationAsync(Notification);
+                }
+                else
+                {
+                    await NotificationService.DeleteNotificationAsync(Notification.NotificationId);
+                }
+                await logger.LogInformation("Notification Deleted {Notification}", Notification);
+            } 
+            await logger.LogInformation("Notifications Permanently Deleted");
+            await LoadNotificationsAsync();
+            StateHasChanged();            
+        }
+        catch (Exception ex)
+        {
+            await logger.LogError(ex, "Error Deleting Notifications {Error}", ex.Message);
+            AddModuleMessage(ex.Message, MessageType.Error);
+        }
+    
+    }
+
+    private void TogglePassword()
+	{
+		if (_passwordtype == "password")
+		{
+			_passwordtype = "text";
+			_togglepassword = SharedLocalizer["HidePassword"];
+		}
+		else
+		{
+			_passwordtype = "password";
+			_togglepassword = SharedLocalizer["ShowPassword"];
+		}
+	}
+
 }
diff --git a/Oqtane.Client/Modules/Admin/Users/Add.razor b/Oqtane.Client/Modules/Admin/Users/Add.razor
index 4cde0a47..ee0fdc8e 100644
--- a/Oqtane.Client/Modules/Admin/Users/Add.razor
+++ b/Oqtane.Client/Modules/Admin/Users/Add.razor
@@ -20,14 +20,20 @@
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="password" HelpText="The user's password. Please choose a password which is sufficiently secure." ResourceKey="Password"></Label>
-                    <div class="col-sm-9">
-                        <input id="password" type="password" class="form-control" @bind="@password" />
+					<div class="col-sm-9">
+                        <div class="input-group">
+						    <input id="password" type="@_passwordtype" class="form-control" @bind="@_password" autocomplete="new-password" required />
+						    <button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+					    </div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="confirm" HelpText="Please enter the password again to confirm it matches with the value above" ResourceKey="Confirm"></Label>
                     <div class="col-sm-9">
-                        <input id="confirm" type="password" class="form-control" @bind="@confirm" />
+                        <div class="input-group">
+							<input id="confirm" type="@_passwordtype" class="form-control" @bind="@confirm" autocomplete="new-password" required />
+						    <button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+					    </div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
@@ -88,7 +94,9 @@
 
 @code {
     private string username = string.Empty;
-    private string password = string.Empty;
+    private string _password = string.Empty;
+	private string _passwordtype = "password";
+	private string _togglepassword = string.Empty;
     private string confirm = string.Empty;
     private string email = string.Empty;
     private string displayname = string.Empty;
@@ -102,6 +110,7 @@
     {
         try
         {
+            _togglepassword = SharedLocalizer["ShowPassword"];
             profiles = await ProfileService.GetProfilesAsync(ModuleState.SiteId);
             settings = new Dictionary<string, string>();
         }
@@ -119,9 +128,9 @@
     {
         try
         {
-            if (username != string.Empty && password != string.Empty && confirm != string.Empty && email != string.Empty && ValidateProfiles())
+            if (username != string.Empty && _password != string.Empty && confirm != string.Empty && email != string.Empty && ValidateProfiles())
             {
-                if (password == confirm)
+                if (_password == confirm)
                 {
                     var user = await UserService.GetUserAsync(username, PageState.Site.SiteId);
                     if (user == null)
@@ -129,7 +138,7 @@
                         user = new User();
                         user.SiteId = PageState.Site.SiteId;
                         user.Username = username;
-                        user.Password = password;
+                        user.Password = _password;
                         user.Email = email;
                         user.DisplayName = string.IsNullOrWhiteSpace(displayname) ? username : displayname;
                         user.PhotoFileId = null;
@@ -193,4 +202,17 @@
         settings = SettingService.SetSetting(settings, SettingName, value);
     }
 
+    private void TogglePassword()
+	{
+		if (_passwordtype == "password")
+		{
+			_passwordtype = "text";
+			_togglepassword = SharedLocalizer["HidePassword"];
+		}
+		else
+		{
+			_passwordtype = "password";
+			_togglepassword = SharedLocalizer["ShowPassword"];
+		}
+	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Users/Edit.razor b/Oqtane.Client/Modules/Admin/Users/Edit.razor
index 167adc8d..fa05cc6e 100644
--- a/Oqtane.Client/Modules/Admin/Users/Edit.razor
+++ b/Oqtane.Client/Modules/Admin/Users/Edit.razor
@@ -29,14 +29,20 @@ else
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="password" HelpText="The user's password. Please choose a password which is sufficiently secure." ResourceKey="Password"></Label>
-                    <div class="col-sm-9">
-                        <input id="password" type="password" class="form-control" @bind="@password" />
+					<div class="col-sm-9">
+                        <div class="input-group">
+						    <input id="password" type="@_passwordtype" class="form-control" @bind="@_password" autocomplete="new-password" />
+						    <button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+					    </div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
                     <Label Class="col-sm-3" For="confirm" HelpText="Please enter the password again to confirm it matches with the value above" ResourceKey="Confirm"></Label>
                     <div class="col-sm-9">
-                        <input id="confirm" type="password" class="form-control" @bind="@confirm" />
+                        <div class="input-group">
+							<input id="confirm" type="@_passwordtype" class="form-control" @bind="@confirm" autocomplete="new-password" />
+						    <button type="button" class="btn btn-secondary" @onclick="@TogglePassword">@_togglepassword</button>
+					    </div>
                     </div>
                 </div>
                 <div class="row mb-1 align-items-center">
@@ -133,7 +139,9 @@ else
 @code {
     private int userid;
     private string username = string.Empty;
-    private string password = string.Empty;
+    private string _password = string.Empty;
+	private string _passwordtype = "password";
+	private string _togglepassword = string.Empty;
     private string confirm = string.Empty;
     private string email = string.Empty;
     private string displayname = string.Empty;
@@ -157,9 +165,9 @@ else
     {
         try
         {
-            // OnParametersSetAsync is called when the edit modal is closed - in which case there is no id parameter
             if (PageState.QueryString.ContainsKey("id"))
             {
+                _togglepassword = SharedLocalizer["ShowPassword"];
                 profiles = await ProfileService.GetProfilesAsync(PageState.Site.SiteId);
                 userid = Int32.Parse(PageState.QueryString["id"]);
                 var user = await UserService.GetUserAsync(userid, PageState.Site.SiteId);
@@ -205,12 +213,12 @@ else
         {
             if (username != string.Empty && email != string.Empty && ValidateProfiles())
             {
-                if (password == confirm)
+                if (_password == confirm)
                 {
                     var user = await UserService.GetUserAsync(userid, PageState.Site.SiteId);
                     user.SiteId = PageState.Site.SiteId;
                     user.Username = username;
-                    user.Password = password;
+                    user.Password = _password;
                     user.Email = email;
                     user.DisplayName = string.IsNullOrWhiteSpace(displayname) ? username : displayname;
                     user.PhotoFileId = null;
@@ -268,4 +276,17 @@ else
         settings = SettingService.SetSetting(settings, SettingName, value);
     }
 
+    private void TogglePassword()
+	{
+		if (_passwordtype == "password")
+		{
+			_passwordtype = "text";
+			_togglepassword = SharedLocalizer["HidePassword"];
+		}
+		else
+		{
+			_passwordtype = "password";
+			_togglepassword = SharedLocalizer["ShowPassword"];
+		}
+	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Users/Index.razor b/Oqtane.Client/Modules/Admin/Users/Index.razor
index 650d9c54..c39888b1 100644
--- a/Oqtane.Client/Modules/Admin/Users/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Users/Index.razor
@@ -6,8 +6,9 @@
 @inject ISiteService SiteService
 @inject IStringLocalizer<Index> Localizer
 @inject IStringLocalizer<SharedResources> SharedLocalizer
+@inject SiteState SiteState
 
-@if (userroles == null)
+@if (users == null)
 {
     <p>
         <em>@SharedLocalizer["Loading"]</em>
@@ -30,13 +31,16 @@ else
 					</div>
 				</div>
 			</div>
-			<Pager Items="@userroles">
+			<Pager Items="@users" RowClass="align-middle">
 				<Header>
 				<th style="width: 1px;">&nbsp;</th>
 				<th style="width: 1px;">&nbsp;</th>
 				<th style="width: 1px;">&nbsp;</th>
 				<th>@SharedLocalizer["Name"]</th>
 				<th>@SharedLocalizer["Username"]</th>
+				<th>@Localizer["LastLoginOn"]</th>
+				<th>@Localizer["LastIPAddress"]</th>
+				<th>@Localizer["CreatedOn"]</th>
 				</Header>
 				<Row>
 					<td>
@@ -50,6 +54,10 @@ else
 					</td>
 					<td>@context.User.DisplayName</td>
 					<td>@context.User.Username</td>
+					<td>@string.Format("{0:dd-MMM-yyyy HH:mm:ss}",context.User.LastLoginOn)</td>
+                    <td>@context.User.LastIPAddress</td>
+                    <td>@string.Format("{0:dd-MMM-yyyy HH:mm:ss}",context.User.CreatedOn)</td>
+
 				</Row>
 			</Pager>
 	</TabPanel>
@@ -86,250 +94,254 @@ else
 							</div>
 						</div>						
 					}
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="twofactor" HelpText="Do you want to allow users to use two factor authentication? Note that the Notification Job in Scheduled Jobs needs to be enabled for this option to work properly." ResourceKey="TwoFactor">Allow Two Factor?</Label>
-						<div class="col-sm-9">
-							<select id="twofactor" class="form-select" @bind="@_twofactor">
-								<option value="true">@SharedLocalizer["Yes"]</option>
-								<option value="false">@SharedLocalizer["No"]</option>
-							</select>
-						</div>
-					</div>
-					@if (!string.IsNullOrEmpty(PageState.Alias.Path))
+					@if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host))
 					{
 						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="cookietype" HelpText="Cookies are usually managed per domain. However you can also choose to have distinct cookies for each site (this option is only applicable to micro-sites)." ResourceKey="CookieType">Cookie Type:</Label>
+							<Label Class="col-sm-3" For="twofactor" HelpText="Do you want users to use two factor authentication? Note that you should use the Disabled option until you have successfully verified that the Notification Job in Scheduled Jobs is enabled and your SMTP options in Site Settings are configured or else you will lock yourself out." ResourceKey="TwoFactor">Two Factor?</Label>
 							<div class="col-sm-9">
-								<select id="cookietype" class="form-select" @bind="@_cookietype">
-									<option value="domain">@Localizer["Domain"]</option>
-									<option value="site">@Localizer["Site"]</option>
+								<select id="twofactor" class="form-select" @bind="@_twofactor">
+									<option value="false">@Localizer["Disabled"]</option>
+									<option value="true">@Localizer["Optional"]</option>
+									<option value="required">@Localizer["Required"]</option>
 								</select>
 							</div>
 						</div>
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="cookiename" HelpText="You can choose to use a custom authentication cookie name for each site. However please be aware that if you want to share an authentication cookie between sites on the same domain they need to use a consistent cookie name. Also be aware that changing the authentication cookie name will logout all current users." ResourceKey="CookieName">Cookie Name:</Label>
+							<div class="col-sm-9">
+								<input id="cookiename" class="form-control" @bind="@_cookiename" />
+							</div>
+						</div>
 					}
 				</Section>
-				<Section Name="Password" Heading="Password Settings" ResourceKey="PasswordSettings">
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="minimumlength" HelpText="The Minimum Length For A Password" ResourceKey="RequiredLength">Minimum Length:</Label>
-						<div class="col-sm-9">
-							<input id="minimumlength" class="form-control" @bind="@_minimumlength" required />
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="uniquecharacters" HelpText="The Minimum Number Of Unique Characters Which A Password Must Contain" ResourceKey="UniqueCharacters">Unique Characters:</Label>
-						<div class="col-sm-9">
-							<input id="uniquecharacters" class="form-control" @bind="@_uniquecharacters" required />
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="requiredigit" HelpText="Indicate If Passwords Must Contain A Digit" ResourceKey="RequireDigit">Require Digit?</Label>
-						<div class="col-sm-9">
-							<select id="requiredigit" class="form-select" @bind="@_requiredigit" required>
-								<option value="true">@SharedLocalizer["Yes"]</option>
-								<option value="false">@SharedLocalizer["No"]</option>
-							</select>
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="requireupper" HelpText="Indicate If Passwords Must Contain An Upper Case Character" ResourceKey="RequireUpper">Require Uppercase?</Label>
-						<div class="col-sm-9">
-							<select id="requireupper" class="form-select" @bind="@_requireupper" required>
-								<option value="true">@SharedLocalizer["Yes"]</option>
-								<option value="false">@SharedLocalizer["No"]</option>
-							</select>
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="requirelower" HelpText="Indicate If Passwords Must Contain A Lower Case Character" ResourceKey="RequireLower">Require Lowercase?</Label>
-						<div class="col-sm-9">
-							<select id="requirelower" class="form-select" @bind="@_requirelower" required>
-								<option value="true">@SharedLocalizer["Yes"]</option>
-								<option value="false">@SharedLocalizer["No"]</option>
-							</select>
-						</div>
-					</div>
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="requirepunctuation" HelpText="Indicate if Passwords Must Contain A Non-alphanumeric Character (ie. Punctuation)" ResourceKey="RequirePunctuation">Require Punctuation?</Label>
-						<div class="col-sm-9">
-							<select id="requirepunctuation" class="form-select" @bind="@_requirepunctuation" required>
-								<option value="true">@SharedLocalizer["Yes"]</option>
-								<option value="false">@SharedLocalizer["No"]</option>
-							</select>
-						</div>
-					</div>					
-				</Section>
-				<Section Name="Lockout" Heading="Lockout Settings" ResourceKey="LockoutSettings">
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="maximum" HelpText="The Maximum Number Of Sign In Attempts Before A User Is Locked Out" ResourceKey="MaximumFailures">Maximum Failures:</Label>
-						<div class="col-sm-9">
-							<input id="maximum" class="form-control" @bind="@_maximumfailures" required />
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="lockoutduration" HelpText="The Number Of Minutes A User Should Be Locked Out" ResourceKey="LockoutDuration">Lockout Duration:</Label>
-						<div class="col-sm-9">
-							<input id="lockoutduration" class="form-control" @bind="@_lockoutduration" required />
-						</div>
-					</div>					
-				</Section>
-				<Section Name="ExternalLogin" Heading="External Login Settings" ResourceKey="ExternalLoginSettings">
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="providertype" HelpText="Select the external login provider type" ResourceKey="ProviderType">Provider Type:</Label>
-						<div class="col-sm-9">
-							<select id="providertype" class="form-select" value="@_providertype" @onchange="(e => ProviderTypeChanged(e))">
-								<option value="" selected>@Localizer["Not Specified"]</option>
-								<option value="@AuthenticationProviderTypes.OpenIDConnect">@Localizer["OpenID Connect"]</option>
-								<option value="@AuthenticationProviderTypes.OAuth2">@Localizer["OAuth 2.0"]</option>
-							</select>
-						</div>
-					</div>		
-					@if (_providertype != "")
-					{
+				@if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host))
+				{
+					<Section Name="Password" Heading="Password Settings" ResourceKey="PasswordSettings">
 						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="providername" HelpText="The external login provider name which will be displayed on the login page" ResourceKey="ProviderName">Provider Name:</Label>
+							<Label Class="col-sm-3" For="minimumlength" HelpText="The Minimum Length For A Password" ResourceKey="RequiredLength">Minimum Length:</Label>
 							<div class="col-sm-9">
-								<input id="providername" class="form-control" @bind="@_providername" />
+								<input id="minimumlength" class="form-control" @bind="@_minimumlength" required />
 							</div>
-						</div>
-					}
-					@if (_providertype == AuthenticationProviderTypes.OpenIDConnect)
-					{
+						</div>					
 						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="authority" HelpText="The Authority Url or Issuer Url associated with the OpenID Connect provider" ResourceKey="Authority">Authority:</Label>
+							<Label Class="col-sm-3" For="uniquecharacters" HelpText="The Minimum Number Of Unique Characters Which A Password Must Contain" ResourceKey="UniqueCharacters">Unique Characters:</Label>
 							<div class="col-sm-9">
-								<input id="authority" class="form-control" @bind="@_authority" />
+								<input id="uniquecharacters" class="form-control" @bind="@_uniquecharacters" required />
 							</div>
-						</div>
+						</div>					
 						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="metadataurl" HelpText="The discovery endpoint for obtaining metadata for this provider. Only specify if the OpenID Connect provider does not use the standard approach (ie. /.well-known/openid-configuration)" ResourceKey="MetadataUrl">Metadata Url:</Label>
+							<Label Class="col-sm-3" For="requiredigit" HelpText="Indicate If Passwords Must Contain A Digit" ResourceKey="RequireDigit">Require Digit?</Label>
 							<div class="col-sm-9">
-								<input id="metadataurl" class="form-control" @bind="@_metadataurl" />
-							</div>
-						</div>
-					}
-					@if (_providertype == AuthenticationProviderTypes.OAuth2)
-					{
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="authorizationurl" HelpText="The endpoint for obtaining an Authorization Code" ResourceKey="AuthorizationUrl">Authorization Url:</Label>
-							<div class="col-sm-9">
-								<input id="authorizationurl" class="form-control" @bind="@_authorizationurl" />
-							</div>
-						</div>
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="tokenurl" HelpText="The endpoint for obtaining an Auth Token" ResourceKey="TokenUrl">Token Url:</Label>
-							<div class="col-sm-9">
-								<input id="tokenurl" class="form-control" @bind="@_tokenurl" />
-							</div>
-						</div>
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="userinfourl" HelpText="The endpoint for obtaining user information. This should be an API or Page Url which contains the users email address." ResourceKey="UserInfoUrl">User Info Url:</Label>
-							<div class="col-sm-9">
-								<input id="userinfourl" class="form-control" @bind="@_userinfourl" />
-							</div>
-						</div>
-					}
-					@if (_providertype != "")
-					{
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="clientid" HelpText="The Client ID from the provider" ResourceKey="ClientID">Client ID:</Label>
-							<div class="col-sm-9">
-								<input id="clientid" class="form-control" @bind="@_clientid" />
-							</div>
-						</div>
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="clientsecret" HelpText="The Client Secret from the provider" ResourceKey="ClientSecret">Client Secret:</Label>
-							<div class="col-sm-9">
-								<div class="input-group">
-									<input type="@_clientsecrettype" id="clientsecret" class="form-control" @bind="@_clientsecret" />
-									<button type="button" class="btn btn-secondary" @onclick="@ToggleClientSecret">@_toggleclientsecret</button>
-								</div>
-							</div>
-						</div>
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="scopes" HelpText="A list of Scopes to request from the provider (separated by commas). If none are specified, standard Scopes will be used by default." ResourceKey="Scopes">Scopes:</Label>
-							<div class="col-sm-9">
-								<input id="scopes" class="form-control" @bind="@_scopes" />
-							</div>
-						</div>
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="pkce" HelpText="Indicate if the provider supports Proof Key for Code Exchange (PKCE)" ResourceKey="PKCE">Use PKCE?</Label>
-							<div class="col-sm-9">
-								<select id="pkce" class="form-select" @bind="@_pkce" required>
+								<select id="requiredigit" class="form-select" @bind="@_requiredigit" required>
 									<option value="true">@SharedLocalizer["Yes"]</option>
 									<option value="false">@SharedLocalizer["No"]</option>
 								</select>
 							</div>
 						</div>					
 						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="redirecturl" HelpText="The Redirect Url (or Callback Url) which usually needs to be registered with the provider" ResourceKey="RedirectUrl">Redirect Url:</Label>
+							<Label Class="col-sm-3" For="requireupper" HelpText="Indicate If Passwords Must Contain An Upper Case Character" ResourceKey="RequireUpper">Require Uppercase?</Label>
 							<div class="col-sm-9">
-								<input id="redirecturl" class="form-control" @bind="@_redirecturl" readonly />
+								<select id="requireupper" class="form-select" @bind="@_requireupper" required>
+									<option value="true">@SharedLocalizer["Yes"]</option>
+									<option value="false">@SharedLocalizer["No"]</option>
+								</select>
 							</div>
-						</div>
-						@if (_providertype == AuthenticationProviderTypes.OpenIDConnect)
-						{
-							<div class="row mb-1 align-items-center">
-								<Label Class="col-sm-3" For="emailclaimtype" HelpText="The type name for the email address claim provided by the provider" ResourceKey="EmailClaimType">Email Claim Type:</Label>
-								<div class="col-sm-9">
-									<input id="emailclaimtype" class="form-control" @bind="@_emailclaimtype" />
-								</div>
-							</div>
-						}
+						</div>					
 						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="domainfilter" HelpText="Provide any email domain filter criteria (separated by commas). Domains to exclude should be prefixed with an exclamation point (!). For example 'microsoft.com,!hotmail.com' would include microsoft.com email addresses but not hotmail.com email addresses." ResourceKey="DomainFilter">Domain Filter:</Label>
+							<Label Class="col-sm-3" For="requirelower" HelpText="Indicate If Passwords Must Contain A Lower Case Character" ResourceKey="RequireLower">Require Lowercase?</Label>
 							<div class="col-sm-9">
-								<input id="domainfilter" class="form-control" @bind="@_domainfilter" />
-							</div>
-						</div>
-						<div class="row mb-1 align-items-center">
-							<Label Class="col-sm-3" For="createusers" HelpText="Do you want new users to be created automatically? If you disable this option, users must already be registered on the site in order to sign in with their external login." ResourceKey="CreateUsers">Create New Users?</Label>
-							<div class="col-sm-9">
-								<select id="createusers" class="form-select" @bind="@_createusers">
+								<select id="requirelower" class="form-select" @bind="@_requirelower" required>
 									<option value="true">@SharedLocalizer["Yes"]</option>
 									<option value="false">@SharedLocalizer["No"]</option>
 								</select>
 							</div>
 						</div>
-					}
-				</Section>
-				<Section Name="Token" Heading="Token Settings" ResourceKey="TokenSettings">
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="secret" HelpText="If you want to want to provide API access, please specify a secret which will be used to encrypt your tokens. The secret should be 16 characters or more to ensure optimal security. Please note that if you change this secret, all existing tokens will become invalid and will need to be regenerated." ResourceKey="Secret">Secret:</Label>
-						<div class="col-sm-9">
-							<div class="input-group">
-								<input type="@_secrettype" id="secret" class="form-control" @bind="@_secret" />
-								<button type="button" class="btn btn-secondary" @onclick="@ToggleSecret">@_togglesecret</button>
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="requirepunctuation" HelpText="Indicate if Passwords Must Contain A Non-alphanumeric Character (ie. Punctuation)" ResourceKey="RequirePunctuation">Require Punctuation?</Label>
+							<div class="col-sm-9">
+								<select id="requirepunctuation" class="form-select" @bind="@_requirepunctuation" required>
+									<option value="true">@SharedLocalizer["Yes"]</option>
+									<option value="false">@SharedLocalizer["No"]</option>
+								</select>
 							</div>
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="issuer" HelpText="Optionally provide the issuer of the token" ResourceKey="Issuer">Issuer:</Label>
-						<div class="col-sm-9">
-							<input id="issuer" class="form-control" @bind="@_issuer" />
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="audience" HelpText="Optionally provide the audience for the token" ResourceKey="Audience">Audience:</Label>
-						<div class="col-sm-9">
-							<input id="audience" class="form-control" @bind="@_audience" />
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="lifetime" HelpText="The number of minutes for which a token should be valid" ResourceKey="Lifetime">Lifetime:</Label>
-						<div class="col-sm-9">
-							<input id="lifetime" class="form-control" @bind="@_lifetime" />
-						</div>
-					</div>					
-					<div class="row mb-1 align-items-center">
-						<Label Class="col-sm-3" For="token" HelpText="Select the Create Token button to generate a long-lived access token (valid for 1 year). Be sure to store this token in a safe location as you will not be able to access it in the future." ResourceKey="Token">Access Token:</Label>
-						<div class="col-sm-9">
-							<div class="input-group">
-								<input id="token" class="form-control" @bind="@_token" />
-								<button type="button" class="btn btn-secondary" @onclick="@CreateToken">@Localizer["CreateToken"]</button>
+						</div>					
+					</Section>
+					<Section Name="Lockout" Heading="Lockout Settings" ResourceKey="LockoutSettings">
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="maximum" HelpText="The Maximum Number Of Sign In Attempts Before A User Is Locked Out" ResourceKey="MaximumFailures">Maximum Failures:</Label>
+							<div class="col-sm-9">
+								<input id="maximum" class="form-control" @bind="@_maximumfailures" required />
 							</div>
-						</div>
-					</div>					
-				</Section>
+						</div>					
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="lockoutduration" HelpText="The Number Of Minutes A User Should Be Locked Out" ResourceKey="LockoutDuration">Lockout Duration:</Label>
+							<div class="col-sm-9">
+								<input id="lockoutduration" class="form-control" @bind="@_lockoutduration" required />
+							</div>
+						</div>					
+					</Section>
+					<Section Name="ExternalLogin" Heading="External Login Settings" ResourceKey="ExternalLoginSettings">
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="providertype" HelpText="Select the external login provider type" ResourceKey="ProviderType">Provider Type:</Label>
+							<div class="col-sm-9">
+								<select id="providertype" class="form-select" value="@_providertype" @onchange="(e => ProviderTypeChanged(e))">
+									<option value="" selected>@Localizer["Not Specified"]</option>
+									<option value="@AuthenticationProviderTypes.OpenIDConnect">@Localizer["OpenID Connect"]</option>
+									<option value="@AuthenticationProviderTypes.OAuth2">@Localizer["OAuth 2.0"]</option>
+								</select>
+							</div>
+						</div>		
+						@if (_providertype != "")
+						{
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="providername" HelpText="The external login provider name which will be displayed on the login page" ResourceKey="ProviderName">Provider Name:</Label>
+								<div class="col-sm-9">
+									<input id="providername" class="form-control" @bind="@_providername" />
+								</div>
+							</div>
+						}
+						@if (_providertype == AuthenticationProviderTypes.OpenIDConnect)
+						{
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="authority" HelpText="The Authority Url or Issuer Url associated with the OpenID Connect provider" ResourceKey="Authority">Authority:</Label>
+								<div class="col-sm-9">
+									<input id="authority" class="form-control" @bind="@_authority" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="metadataurl" HelpText="The discovery endpoint for obtaining metadata for this provider. Only specify if the OpenID Connect provider does not use the standard approach (ie. /.well-known/openid-configuration)" ResourceKey="MetadataUrl">Metadata Url:</Label>
+								<div class="col-sm-9">
+									<input id="metadataurl" class="form-control" @bind="@_metadataurl" />
+								</div>
+							</div>
+						}
+						@if (_providertype == AuthenticationProviderTypes.OAuth2)
+						{
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="authorizationurl" HelpText="The endpoint for obtaining an Authorization Code" ResourceKey="AuthorizationUrl">Authorization Url:</Label>
+								<div class="col-sm-9">
+									<input id="authorizationurl" class="form-control" @bind="@_authorizationurl" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="tokenurl" HelpText="The endpoint for obtaining an Auth Token" ResourceKey="TokenUrl">Token Url:</Label>
+								<div class="col-sm-9">
+									<input id="tokenurl" class="form-control" @bind="@_tokenurl" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="userinfourl" HelpText="The endpoint for obtaining user information. This should be an API or Page Url which contains the users email address." ResourceKey="UserInfoUrl">User Info Url:</Label>
+								<div class="col-sm-9">
+									<input id="userinfourl" class="form-control" @bind="@_userinfourl" />
+								</div>
+							</div>
+						}
+						@if (_providertype != "")
+						{
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="clientid" HelpText="The Client ID from the provider" ResourceKey="ClientID">Client ID:</Label>
+								<div class="col-sm-9">
+									<input id="clientid" class="form-control" @bind="@_clientid" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="clientsecret" HelpText="The Client Secret from the provider" ResourceKey="ClientSecret">Client Secret:</Label>
+								<div class="col-sm-9">
+									<div class="input-group">
+										<input type="@_clientsecrettype" id="clientsecret" class="form-control" @bind="@_clientsecret" />
+										<button type="button" class="btn btn-secondary" @onclick="@ToggleClientSecret">@_toggleclientsecret</button>
+									</div>
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="scopes" HelpText="A list of Scopes to request from the provider (separated by commas). If none are specified, standard Scopes will be used by default." ResourceKey="Scopes">Scopes:</Label>
+								<div class="col-sm-9">
+									<input id="scopes" class="form-control" @bind="@_scopes" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="pkce" HelpText="Indicate if the provider supports Proof Key for Code Exchange (PKCE)" ResourceKey="PKCE">Use PKCE?</Label>
+								<div class="col-sm-9">
+									<select id="pkce" class="form-select" @bind="@_pkce" required>
+										<option value="true">@SharedLocalizer["Yes"]</option>
+										<option value="false">@SharedLocalizer["No"]</option>
+									</select>
+								</div>
+							</div>					
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="redirecturl" HelpText="The Redirect Url (or Callback Url) which usually needs to be registered with the provider" ResourceKey="RedirectUrl">Redirect Url:</Label>
+								<div class="col-sm-9">
+									<input id="redirecturl" class="form-control" @bind="@_redirecturl" readonly />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="identifierclaimtype" HelpText="The name of the unique user identifier claim provided by the provider" ResourceKey="IdentifierClaimType">Identifier Claim:</Label>
+								<div class="col-sm-9">
+									<input id="identifierclaimtype" class="form-control" @bind="@_identifierclaimtype" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="emailclaimtype" HelpText="The name of the email address claim provided by the provider" ResourceKey="EmailClaimType">Email Claim:</Label>
+								<div class="col-sm-9">
+									<input id="emailclaimtype" class="form-control" @bind="@_emailclaimtype" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="domainfilter" HelpText="Provide any email domain filter criteria (separated by commas). Domains to exclude should be prefixed with an exclamation point (!). For example 'microsoft.com,!hotmail.com' would include microsoft.com email addresses but not hotmail.com email addresses." ResourceKey="DomainFilter">Domain Filter:</Label>
+								<div class="col-sm-9">
+									<input id="domainfilter" class="form-control" @bind="@_domainfilter" />
+								</div>
+							</div>
+							<div class="row mb-1 align-items-center">
+								<Label Class="col-sm-3" For="createusers" HelpText="Do you want new users to be created automatically? If you disable this option, users must already be registered on the site in order to sign in with their external login." ResourceKey="CreateUsers">Create New Users?</Label>
+								<div class="col-sm-9">
+									<select id="createusers" class="form-select" @bind="@_createusers">
+										<option value="true">@SharedLocalizer["Yes"]</option>
+										<option value="false">@SharedLocalizer["No"]</option>
+									</select>
+								</div>
+							</div>
+						}
+					</Section>
+					<Section Name="Token" Heading="Token Settings" ResourceKey="TokenSettings">
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="secret" HelpText="If you want to want to provide API access, please specify a secret which will be used to encrypt your tokens. The secret should be 16 characters or more to ensure optimal security. Please note that if you change this secret, all existing tokens will become invalid and will need to be regenerated." ResourceKey="Secret">Secret:</Label>
+							<div class="col-sm-9">
+								<div class="input-group">
+									<input type="@_secrettype" id="secret" class="form-control" @bind="@_secret" />
+									<button type="button" class="btn btn-secondary" @onclick="@ToggleSecret">@_togglesecret</button>
+								</div>
+							</div>
+						</div>					
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="issuer" HelpText="Optionally provide the issuer of the token" ResourceKey="Issuer">Issuer:</Label>
+							<div class="col-sm-9">
+								<input id="issuer" class="form-control" @bind="@_issuer" />
+							</div>
+						</div>					
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="audience" HelpText="Optionally provide the audience for the token" ResourceKey="Audience">Audience:</Label>
+							<div class="col-sm-9">
+								<input id="audience" class="form-control" @bind="@_audience" />
+							</div>
+						</div>					
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="lifetime" HelpText="The number of minutes for which a token should be valid" ResourceKey="Lifetime">Lifetime:</Label>
+							<div class="col-sm-9">
+								<input id="lifetime" class="form-control" @bind="@_lifetime" />
+							</div>
+						</div>					
+						<div class="row mb-1 align-items-center">
+							<Label Class="col-sm-3" For="token" HelpText="Select the Create Token button to generate a long-lived access token (valid for 1 year). Be sure to store this token in a safe location as you will not be able to access it in the future." ResourceKey="Token">Access Token:</Label>
+							<div class="col-sm-9">
+								<div class="input-group">
+									<input id="token" class="form-control" @bind="@_token" />
+									<button type="button" class="btn btn-secondary" @onclick="@CreateToken">@Localizer["CreateToken"]</button>
+								</div>
+							</div>
+						</div>					
+					</Section>
+				}
 			</div>
 			<br />
 			<button type="button" class="btn btn-success" @onclick="SaveSiteSettings">@SharedLocalizer["Save"]</button>
@@ -338,14 +350,14 @@ else
 }
 
 @code {
-	private List<UserRole> allroles;
-	private List<UserRole> userroles;
-	private string _search;
+	private List<UserRole> allusers;
+	private List<UserRole> users;
+	private string _search = "";
 
 	private string _allowregistration;
 	private string _allowsitelogin;
 	private string _twofactor;
-	private string _cookietype;
+	private string _cookiename;
 
 	private string _minimumlength;
 	private string _uniquecharacters;
@@ -370,6 +382,7 @@ else
 	private string _scopes;
 	private string _pkce;
 	private string _redirecturl;
+	private string _identifierclaimtype;
 	private string _emailclaimtype;
 	private string _domainfilter;
 	private string _createusers;
@@ -386,71 +399,83 @@ else
 
 	protected override async Task OnInitializedAsync()
 	{
-		allroles = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId);
-		await LoadSettingsAsync();
-		userroles = Search(_search);
+		await LoadUserSettingsAsync();
+		await LoadUsersAsync(true);
 
 		var settings = await SettingService.GetSiteSettingsAsync(PageState.Site.SiteId);
 		_allowregistration = PageState.Site.AllowRegistration.ToString();
 		_allowsitelogin = SettingService.GetSetting(settings, "LoginOptions:AllowSiteLogin", "true");
-		_twofactor = SettingService.GetSetting(settings, "LoginOptions:TwoFactor", "false");
-		_cookietype = SettingService.GetSetting(settings, "LoginOptions:CookieType", "domain");
 
-		_minimumlength = SettingService.GetSetting(settings, "IdentityOptions:Password:RequiredLength", "6");
-		_uniquecharacters = SettingService.GetSetting(settings, "IdentityOptions:Password:RequiredUniqueChars", "1");
-		_requiredigit = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireDigit", "true");
-		_requireupper = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireUppercase", "true");
-		_requirelower = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireLowercase", "true");
-		_requirepunctuation = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireNonAlphanumeric", "true");
+		if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host))
+		{
+			_twofactor = SettingService.GetSetting(settings, "LoginOptions:TwoFactor", "false");
+			_cookiename = SettingService.GetSetting(settings, "LoginOptions:CookieName", ".AspNetCore.Identity.Application");
 
-		_maximumfailures = SettingService.GetSetting(settings, "IdentityOptions:Lockout:MaxFailedAccessAttempts", "5");
-		_lockoutduration = TimeSpan.Parse(SettingService.GetSetting(settings, "IdentityOptions:Lockout:DefaultLockoutTimeSpan", "00:05:00")).TotalMinutes.ToString();
+			_minimumlength = SettingService.GetSetting(settings, "IdentityOptions:Password:RequiredLength", "6");
+			_uniquecharacters = SettingService.GetSetting(settings, "IdentityOptions:Password:RequiredUniqueChars", "1");
+			_requiredigit = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireDigit", "true");
+			_requireupper = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireUppercase", "true");
+			_requirelower = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireLowercase", "true");
+			_requirepunctuation = SettingService.GetSetting(settings, "IdentityOptions:Password:RequireNonAlphanumeric", "true");
 
-		_providertype = SettingService.GetSetting(settings, "ExternalLogin:ProviderType", "");
-		_providername = SettingService.GetSetting(settings, "ExternalLogin:ProviderName", "");
-		_authority = SettingService.GetSetting(settings, "ExternalLogin:Authority", "");
-		_metadataurl = SettingService.GetSetting(settings, "ExternalLogin:MetadataUrl", "");
-		_authorizationurl = SettingService.GetSetting(settings, "ExternalLogin:AuthorizationUrl", "");
-		_tokenurl = SettingService.GetSetting(settings, "ExternalLogin:TokenUrl", "");
-		_userinfourl = SettingService.GetSetting(settings, "ExternalLogin:UserInfoUrl", "");
-		_clientid = SettingService.GetSetting(settings, "ExternalLogin:ClientId", "");
-		_clientsecret = SettingService.GetSetting(settings, "ExternalLogin:ClientSecret", "");
-		_toggleclientsecret = Localizer["Show"];
-		_scopes = SettingService.GetSetting(settings, "ExternalLogin:Scopes", "");
-		_pkce = SettingService.GetSetting(settings, "ExternalLogin:PKCE", "false");
-		_redirecturl = PageState.Uri.Scheme + "://" + PageState.Alias.Name + "/signin-" + _providertype;
-		_emailclaimtype = SettingService.GetSetting(settings, "ExternalLogin:EmailClaimType", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress");
-		_domainfilter = SettingService.GetSetting(settings, "ExternalLogin:DomainFilter", "");
-		_createusers = SettingService.GetSetting(settings, "ExternalLogin:CreateUsers", "true");
+			_maximumfailures = SettingService.GetSetting(settings, "IdentityOptions:Lockout:MaxFailedAccessAttempts", "5");
+			_lockoutduration = TimeSpan.Parse(SettingService.GetSetting(settings, "IdentityOptions:Lockout:DefaultLockoutTimeSpan", "00:05:00")).TotalMinutes.ToString();
 
-		_secret = SettingService.GetSetting(settings, "JwtOptions:Secret", "");
-		_togglesecret = Localizer["Show"];
-		_issuer = SettingService.GetSetting(settings, "JwtOptions:Issuer", PageState.Uri.Scheme + "://" + PageState.Alias.Name);
-		_audience = SettingService.GetSetting(settings, "JwtOptions:Audience", "");
-		_lifetime = SettingService.GetSetting(settings, "JwtOptions:Lifetime", "20");
+			_providertype = SettingService.GetSetting(settings, "ExternalLogin:ProviderType", "");
+			_providername = SettingService.GetSetting(settings, "ExternalLogin:ProviderName", "");
+			_authority = SettingService.GetSetting(settings, "ExternalLogin:Authority", "");
+			_metadataurl = SettingService.GetSetting(settings, "ExternalLogin:MetadataUrl", "");
+			_authorizationurl = SettingService.GetSetting(settings, "ExternalLogin:AuthorizationUrl", "");
+			_tokenurl = SettingService.GetSetting(settings, "ExternalLogin:TokenUrl", "");
+			_userinfourl = SettingService.GetSetting(settings, "ExternalLogin:UserInfoUrl", "");
+			_clientid = SettingService.GetSetting(settings, "ExternalLogin:ClientId", "");
+			_clientsecret = SettingService.GetSetting(settings, "ExternalLogin:ClientSecret", "");
+			_toggleclientsecret = SharedLocalizer["ShowPassword"];
+			_scopes = SettingService.GetSetting(settings, "ExternalLogin:Scopes", "");
+			_pkce = SettingService.GetSetting(settings, "ExternalLogin:PKCE", "false");
+			_redirecturl = PageState.Uri.Scheme + "://" + PageState.Alias.Name + "/signin-" + _providertype;
+			_identifierclaimtype = SettingService.GetSetting(settings, "ExternalLogin:IdentifierClaimType", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier");
+			_emailclaimtype = SettingService.GetSetting(settings, "ExternalLogin:EmailClaimType", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress");
+			_domainfilter = SettingService.GetSetting(settings, "ExternalLogin:DomainFilter", "");
+			_createusers = SettingService.GetSetting(settings, "ExternalLogin:CreateUsers", "true");
+
+			_secret = SettingService.GetSetting(settings, "JwtOptions:Secret", "");
+			_togglesecret = SharedLocalizer["ShowPassword"];
+			_issuer = SettingService.GetSetting(settings, "JwtOptions:Issuer", PageState.Uri.Scheme + "://" + PageState.Alias.Name);
+			_audience = SettingService.GetSetting(settings, "JwtOptions:Audience", "");
+			_lifetime = SettingService.GetSetting(settings, "JwtOptions:Lifetime", "20");		}
 	}
 
-	private List<UserRole> Search(string search)
+	private async Task LoadUsersAsync(bool load)
 	{
-		var results = allroles.Where(item => item.Role.Name == RoleNames.Registered || (item.Role.Name == RoleNames.Host && UserSecurity.IsAuthorized(PageState.User, RoleNames.Host)));
+		if (load)
+		{
+			allusers = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId, RoleNames.Registered);
+			if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host))
+			{
+				var hosts = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId, RoleNames.Host);
+				allusers.AddRange(hosts);
+				allusers = allusers.OrderBy(u => u.User.DisplayName).ToList();
+			}			
+		}
 
+		users = allusers;
 		if (!string.IsNullOrEmpty(_search))
 		{
-			results = results.Where(item =>
+			users = users.Where(item =>
 				(
-					item.User.Username.Contains(search, StringComparison.OrdinalIgnoreCase) ||
-					item.User.Email.Contains(search, StringComparison.OrdinalIgnoreCase) ||
-					item.User.DisplayName.Contains(search, StringComparison.OrdinalIgnoreCase)
+					item.User.Username.Contains(_search, StringComparison.OrdinalIgnoreCase) ||
+					item.User.Email.Contains(_search, StringComparison.OrdinalIgnoreCase) ||
+					item.User.DisplayName.Contains(_search, StringComparison.OrdinalIgnoreCase)
 				)
-			);
+			).ToList();
 		}
-		return results.ToList();
 	}
 
 	private async Task OnSearch()
 	{
-		userroles = Search(_search);
-		await UpdateSettingsAsync();
+		await UpdateUserSettingsAsync();
+		await LoadUsersAsync(false);
 	}
 
 	private async Task DeleteUser(UserRole UserRole)
@@ -462,8 +487,7 @@ else
 			{
 				await UserService.DeleteUserAsync(user.UserId, PageState.Site.SiteId);
 				await logger.LogInformation("User Deleted {User}", UserRole.User);
-				allroles = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId);
-				userroles = Search(_search);
+				await LoadUsersAsync(true);
 				StateHasChanged();
 			}
 		}
@@ -476,13 +500,13 @@ else
 
 	private string settingSearch = "AU-search";
 
-	private async Task LoadSettingsAsync()
+	private async Task LoadUserSettingsAsync()
 	{
 		Dictionary<string, string> settings = await SettingService.GetUserSettingsAsync(PageState.User.UserId);
 		_search = SettingService.GetSetting(settings, settingSearch, "");
 	}
 
-	private async Task UpdateSettingsAsync()
+	private async Task UpdateUserSettingsAsync()
 	{
 		Dictionary<string, string> settings = await SettingService.GetUserSettingsAsync(PageState.User.UserId);
 		SettingService.SetSetting(settings, settingSearch, _search);
@@ -499,43 +523,53 @@ else
 
 			var settings = await SettingService.GetSiteSettingsAsync(site.SiteId);
 			settings = SettingService.SetSetting(settings, "LoginOptions:AllowSiteLogin", _allowsitelogin, false);
-			settings = SettingService.SetSetting(settings, "LoginOptions:TwoFactor", _twofactor, false);
-			settings = SettingService.SetSetting(settings, "LoginOptions:CookieType", _cookietype, true);
 
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequiredLength", _minimumlength, true);
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequiredUniqueChars", _uniquecharacters, true);
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireDigit", _requiredigit, true);
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireUppercase", _requireupper, true);
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireLowercase", _requirelower, true);
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireNonAlphanumeric", _requirepunctuation, true);
+			if (UserSecurity.IsAuthorized(PageState.User, RoleNames.Host))
+			{
+				settings = SettingService.SetSetting(settings, "LoginOptions:TwoFactor", _twofactor, false);
+				settings = SettingService.SetSetting(settings, "LoginOptions:CookieName", _cookiename, true);
 
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Lockout:MaxFailedAccessAttempts", _maximumfailures, true);
-			settings = SettingService.SetSetting(settings, "IdentityOptions:Lockout:DefaultLockoutTimeSpan", TimeSpan.FromMinutes(Convert.ToInt64(_lockoutduration)).ToString(), true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequiredLength", _minimumlength, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequiredUniqueChars", _uniquecharacters, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireDigit", _requiredigit, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireUppercase", _requireupper, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireLowercase", _requirelower, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Password:RequireNonAlphanumeric", _requirepunctuation, true);
 
-			settings = SettingService.SetSetting(settings, "ExternalLogin:ProviderType", _providertype, false);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:ProviderName", _providername, false);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:Authority", _authority, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:MetadataUrl", _metadataurl, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:AuthorizationUrl", _authorizationurl, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:TokenUrl", _tokenurl, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:UserInfoUrl", _userinfourl, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:ClientId", _clientid, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:ClientSecret", _clientsecret, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:Scopes", _scopes, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:PKCE", _pkce, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:EmailClaimType", _emailclaimtype, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:DomainFilter", _domainfilter, true);
-			settings = SettingService.SetSetting(settings, "ExternalLogin:CreateUsers", _createusers, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Lockout:MaxFailedAccessAttempts", _maximumfailures, true);
+				settings = SettingService.SetSetting(settings, "IdentityOptions:Lockout:DefaultLockoutTimeSpan", TimeSpan.FromMinutes(Convert.ToInt64(_lockoutduration)).ToString(), true);
 
-			if (!string.IsNullOrEmpty(_secret) && _secret.Length < 16) _secret = (_secret + "????????????????").Substring(0, 16);
-			settings = SettingService.SetSetting(settings, "JwtOptions:Secret", _secret, true);
-			settings = SettingService.SetSetting(settings, "JwtOptions:Issuer", _issuer, true);
-			settings = SettingService.SetSetting(settings, "JwtOptions:Audience", _audience, true);
-			settings = SettingService.SetSetting(settings, "JwtOptions:Lifetime", _lifetime, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:ProviderType", _providertype, false);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:ProviderName", _providername, false);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:Authority", _authority, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:MetadataUrl", _metadataurl, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:AuthorizationUrl", _authorizationurl, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:TokenUrl", _tokenurl, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:UserInfoUrl", _userinfourl, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:ClientId", _clientid, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:ClientSecret", _clientsecret, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:Scopes", _scopes, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:PKCE", _pkce, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:IdentifierClaimType", _identifierclaimtype, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:EmailClaimType", _emailclaimtype, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:DomainFilter", _domainfilter, true);
+				settings = SettingService.SetSetting(settings, "ExternalLogin:CreateUsers", _createusers, true);
+
+				if (!string.IsNullOrEmpty(_secret) && _secret.Length < 16) _secret = (_secret + "????????????????").Substring(0, 16);
+				settings = SettingService.SetSetting(settings, "JwtOptions:Secret", _secret, true);
+				settings = SettingService.SetSetting(settings, "JwtOptions:Issuer", _issuer, true);
+				settings = SettingService.SetSetting(settings, "JwtOptions:Audience", _audience, true);
+				settings = SettingService.SetSetting(settings, "JwtOptions:Lifetime", _lifetime, true);
+			}
 
 			await SettingService.UpdateSiteSettingsAsync(settings, site.SiteId);
 			await SettingService.ClearSiteSettingsCacheAsync();
 
+			if (!string.IsNullOrEmpty(_secret))
+			{
+				SiteState.AuthorizationToken = await UserService.GetTokenAsync();
+			}
+
 			AddModuleMessage(Localizer["Success.SaveSiteSettings"], MessageType.Success);				
 		}
 		catch (Exception ex)
@@ -548,13 +582,20 @@ else
 	private void ProviderTypeChanged(ChangeEventArgs e)
 	{
 		_providertype = (string)e.Value;
-		if (_providertype == AuthenticationProviderTypes.OpenIDConnect)
+		if (string.IsNullOrEmpty(_providername))
 		{
-			_scopes = "openid,profile,email";
-		}
-		else
-		{
-			_scopes = "";
+			if (_providertype == AuthenticationProviderTypes.OpenIDConnect)
+			{
+				_scopes = "openid,profile,email";
+				_identifierclaimtype = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier";
+				_emailclaimtype = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+			}
+			else
+			{
+				_scopes = "";
+				_identifierclaimtype = "sub";
+				_emailclaimtype = "email";
+			}			
 		}
 		_redirecturl = PageState.Uri.Scheme + "://" + PageState.Alias.Name + "/signin-" + _providertype;
 		StateHasChanged();
@@ -562,7 +603,7 @@ else
 
 	private async Task CreateToken()
 	{
-		_token = await UserService.GetTokenAsync();
+		_token = await UserService.GetPersonalAccessTokenAsync();
 	}
 
 	private void ToggleClientSecret()
@@ -570,12 +611,12 @@ else
 		if (_clientsecrettype == "password")
 		{
 			_clientsecrettype = "text";
-			_toggleclientsecret = Localizer["Hide"];
+			_toggleclientsecret = SharedLocalizer["HidePassword"];
 		}
 		else
 		{
 			_clientsecrettype = "password";
-			_toggleclientsecret = Localizer["Show"];
+			_toggleclientsecret = SharedLocalizer["ShowPassword"];
 		}
 	}
 
@@ -584,12 +625,12 @@ else
 		if (_secrettype == "password")
 		{
 			_secrettype = "text";
-			_togglesecret = Localizer["Hide"];
+			_togglesecret = SharedLocalizer["HidePassword"];
 		}
 		else
 		{
 			_secrettype = "password";
-			_togglesecret = Localizer["Show"];
+			_togglesecret = SharedLocalizer["ShowPassword"];
 		}
 	}
 }
diff --git a/Oqtane.Client/Modules/Admin/Users/Roles.razor b/Oqtane.Client/Modules/Admin/Users/Roles.razor
index 59e4d00c..4b90b902 100644
--- a/Oqtane.Client/Modules/Admin/Users/Roles.razor
+++ b/Oqtane.Client/Modules/Admin/Users/Roles.razor
@@ -110,8 +110,7 @@ else
     {
         try
         {
-            userroles = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId);
-            userroles = userroles.Where(item => item.UserId == userid).ToList();
+            userroles = await UserRoleService.GetUserRolesAsync(PageState.Site.SiteId, userid);
         }
         catch (Exception ex)
         {
diff --git a/Oqtane.Client/Oqtane.Client.csproj b/Oqtane.Client/Oqtane.Client.csproj
index 22aa5a50..b8819317 100644
--- a/Oqtane.Client/Oqtane.Client.csproj
+++ b/Oqtane.Client/Oqtane.Client.csproj
@@ -5,7 +5,7 @@
     <OutputType>Exe</OutputType>
     <RazorLangVersion>3.0</RazorLangVersion>
     <Configurations>Debug;Release</Configurations>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -13,7 +13,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <RootNamespace>Oqtane</RootNamespace>
diff --git a/Oqtane.Client/Resources/Modules/Admin/Login/Index.resx b/Oqtane.Client/Resources/Modules/Admin/Login/Index.resx
index 33c9fb60..67dbbfed 100644
--- a/Oqtane.Client/Resources/Modules/Admin/Login/Index.resx
+++ b/Oqtane.Client/Resources/Modules/Admin/Login/Index.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -123,9 +123,15 @@
   <data name="Success.Account.Verified" xml:space="preserve">
     <value>User Account Verified Successfully. You Can Now Login With Your Username And Password Below.</value>
   </data>
-  <data name="Message.Account.NotVerfied" xml:space="preserve">
+  <data name="Message.Account.NotVerified" xml:space="preserve">
     <value>User Account Could Not Be Verified. Please Contact Your Administrator For Further Instructions.</value>
   </data>
+  <data name="Success.Account.Linked" xml:space="preserve">
+    <value>User Account Linked Successfully. You Can Now Login With Your External Login Below.</value>
+  </data>
+  <data name="Message.Account.NotLinked" xml:space="preserve">
+    <value>External Login Could Not Be Linked. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
   <data name="Error.Login.Fail" xml:space="preserve">
     <value>Login Failed. Please Remember That Passwords Are Case Sensitive. If You Have Attempted To Sign In Multiple Times Unsuccessfully, Your Account Will Be Locked Out For A Period Of Time. Note That User Accounts Require Verification When They Are Initially Created So You May Wish To Check Your Email If You Are A New User.</value>
   </data>
@@ -183,12 +189,6 @@
   <data name="Username.Text" xml:space="preserve">
     <value>Username:</value>
   </data>
-  <data name="HidePassword" xml:space="preserve">
-    <value>Hide</value>
-  </data>
-  <data name="ShowPassword" xml:space="preserve">
-    <value>Show</value>
-  </data>
   <data name="Use" xml:space="preserve">
     <value>Use</value>
   </data>
@@ -201,4 +201,28 @@
   <data name="Error.ResetPassword" xml:space="preserve">
     <value>Error Resetting Password</value>
   </data>
+  <data name="ExternalLoginStatus.DuplicateEmail" xml:space="preserve">
+    <value>Multiple User Accounts Already Exist With The Email Address Of Your External Login. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.InvalidEmail" xml:space="preserve">
+    <value>The External Login Provider Did Not Provide A Valid Email Address For Your Account. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.ProviderKeyMismatch" xml:space="preserve">
+    <value>An Error Occurred Verifying Your External Login. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.UserDoesNotExist" xml:space="preserve">
+    <value>A User Account Matching The Email Address Of Your External Login Does Not Exist. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.UserNotCreated" xml:space="preserve">
+    <value>A User Account Could Not Be Created For Your External Login. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.VerificationRequired" xml:space="preserve">
+    <value>In Order To Link Your External Login With Your User Account You Must Verify Your Identity. Please Check Your Email For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.AccessDenied" xml:space="preserve">
+    <value>Your External Login Was Denied Access. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
+  <data name="ExternalLoginStatus.RemoteFailure" xml:space="preserve">
+    <value>Your External Login Failed. Please Contact Your Administrator For Further Instructions.</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Resources/Modules/Admin/Site/Index.resx b/Oqtane.Client/Resources/Modules/Admin/Site/Index.resx
index c20813b4..1007685f 100644
--- a/Oqtane.Client/Resources/Modules/Admin/Site/Index.resx
+++ b/Oqtane.Client/Resources/Modules/Admin/Site/Index.resx
@@ -324,10 +324,4 @@
   <data name="Aliases.Heading" xml:space="preserve">
     <value>Aliases</value>
   </data>
-  <data name="Hide" xml:space="preserve">
-    <value>Hide</value>
-  </data>
-  <data name="Show" xml:space="preserve">
-    <value>Show</value>
-  </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Resources/Modules/Admin/UserProfile/Index.resx b/Oqtane.Client/Resources/Modules/Admin/UserProfile/Index.resx
index ba95f3c0..6eabb548 100644
--- a/Oqtane.Client/Resources/Modules/Admin/UserProfile/Index.resx
+++ b/Oqtane.Client/Resources/Modules/Admin/UserProfile/Index.resx
@@ -210,4 +210,13 @@
   <data name="TwoFactor.Text" xml:space="preserve">
     <value>Two Factor?</value>
   </data>
+  <data name="DeleteAllNotifications.Header" xml:space="preserve">
+    <value>Clear Notifications</value>
+  </data>
+  <data name="DeleteAllNotifications.Message" xml:space="preserve">
+    <value>Are You Sure You Wish To Permanently Delete All Notifications?</value>
+  </data>
+  <data name="DeleteAllNotifications.Text" xml:space="preserve">
+    <value>Delete ALL Notifications</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Resources/Modules/Admin/Users/Add.resx b/Oqtane.Client/Resources/Modules/Admin/Users/Add.resx
index 4726a6e9..810f2b9d 100644
--- a/Oqtane.Client/Resources/Modules/Admin/Users/Add.resx
+++ b/Oqtane.Client/Resources/Modules/Admin/Users/Add.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -168,4 +168,7 @@
   <data name="Username.Text" xml:space="preserve">
     <value>Username:</value>
   </data>
+  <data name="Password.Placeholder" xml:space="preserve">
+    <value>Password</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Resources/Modules/Admin/Users/Edit.resx b/Oqtane.Client/Resources/Modules/Admin/Users/Edit.resx
index 86f18fb8..831ba0ad 100644
--- a/Oqtane.Client/Resources/Modules/Admin/Users/Edit.resx
+++ b/Oqtane.Client/Resources/Modules/Admin/Users/Edit.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -183,4 +183,7 @@
   <data name="Profile.Heading" xml:space="preserve">
     <value>Profile</value>
   </data>
+  <data name="Password.Placeholder" xml:space="preserve">
+    <value>Password</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Resources/Modules/Admin/Users/Index.resx b/Oqtane.Client/Resources/Modules/Admin/Users/Index.resx
index c26d4611..e37f3f20 100644
--- a/Oqtane.Client/Resources/Modules/Admin/Users/Index.resx
+++ b/Oqtane.Client/Resources/Modules/Admin/Users/Index.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -247,10 +247,10 @@
     <value>Domain Filter:</value>
   </data>
   <data name="EmailClaimType.HelpText" xml:space="preserve">
-    <value>The type name for the email address claim provided by the provider</value>
+    <value>The name of the email address claim provided by the provider</value>
   </data>
   <data name="EmailClaimType.Text" xml:space="preserve">
-    <value>Email Claim Type:</value>
+    <value>Email Claim:</value>
   </data>
   <data name="ExternalLoginSettings.Heading" xml:space="preserve">
     <value>External Login Settings</value>
@@ -318,11 +318,11 @@
   <data name="UserSettings.Heading" xml:space="preserve">
     <value>User Settings</value>
   </data>
-  <data name="CookieType.HelpText" xml:space="preserve">
-    <value>Cookies are usually managed per domain. However you can also choose to have distinct cookies for each site (this option is only applicable to micro-sites).</value>
+  <data name="CookieName.HelpText" xml:space="preserve">
+    <value>You can choose to use a custom authentication cookie name for each site. However please be aware that if you want to share an authentication cookie between sites on the same domain they need to use a consistent cookie name. Also be aware that changing the authentication cookie name will logout all current users.</value>
   </data>
-  <data name="CookieType.Text" xml:space="preserve">
-    <value>Login Cookie Type:</value>
+  <data name="CookieName.Text" xml:space="preserve">
+    <value>Cookie Name:</value>
   </data>
   <data name="CreateToken" xml:space="preserve">
     <value>Create Token</value>
@@ -355,15 +355,33 @@
     <value>Token Settings</value>
   </data>
   <data name="TwoFactor.HelpText" xml:space="preserve">
-    <value>Do you want to allow users to use two factor authentication? Note that the Notification Job in Scheduled Jobs needs to be enabled and your SMTP options need to be configured in Site Settings for this option to work properly.</value>
+    <value>Do you want users to use two factor authentication? Note that you should use the Disabled option until you have successfully verified that the Notification Job in Scheduled Jobs is enabled and your SMTP options in Site Settings are configured or else you will lock yourself out.</value>
   </data>
   <data name="TwoFactor.Text" xml:space="preserve">
-    <value>Allow Two Factor?</value>
+    <value>Two Factor?</value>
   </data>
-  <data name="Hide" xml:space="preserve">
-    <value>Hide</value>
+  <data name="Disabled" xml:space="preserve">
+    <value>Disabled</value>
   </data>
-  <data name="Show" xml:space="preserve">
-    <value>Show</value>
+  <data name="Optional" xml:space="preserve">
+    <value>Optional</value>
+  </data>
+  <data name="Required" xml:space="preserve">
+    <value>Required</value>
+  </data>
+  <data name="CreatedOn" xml:space="preserve">
+    <value>Created On</value>
+  </data>
+  <data name="LastIPAddress" xml:space="preserve">
+    <value>Last IP Address</value>
+  </data>
+  <data name="LastLoginOn" xml:space="preserve">
+    <value>Last Login</value>
+  </data>
+  <data name="IdentifierClaimType.HelpText" xml:space="preserve">
+    <value>The name of the unique user identifier claim provided by the provider</value>
+  </data>
+  <data name="IdentifierClaimType.Text" xml:space="preserve">
+    <value>Identifier Claim:</value>
   </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Resources/SharedResources.resx b/Oqtane.Client/Resources/SharedResources.resx
index bf4dded4..774b533a 100644
--- a/Oqtane.Client/Resources/SharedResources.resx
+++ b/Oqtane.Client/Resources/SharedResources.resx
@@ -274,7 +274,7 @@
     <value>Full Name:</value>
   </data>
   <data name="LocalVersion" xml:space="preserve">
-    <value>Local Version</value>
+    <value>Installed Version</value>
   </data>
   <data name="Search.Source" xml:space="preserve">
     <value>source</value>
@@ -321,4 +321,10 @@
   <data name="Settings" xml:space="preserve">
     <value>Settings</value>
   </data>
+  <data name="HidePassword" xml:space="preserve">
+    <value>Hide</value>
+  </data>
+  <data name="ShowPassword" xml:space="preserve">
+    <value>Show</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Oqtane.Client/Services/AliasService.cs b/Oqtane.Client/Services/AliasService.cs
index 891c5a08..c2e59799 100644
--- a/Oqtane.Client/Services/AliasService.cs
+++ b/Oqtane.Client/Services/AliasService.cs
@@ -12,18 +12,12 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class AliasService : ServiceBase, IAliasService
     {
-
-        private readonly SiteState _siteState;
-
         /// <summary>
         /// Constructor - should only be used by Dependency Injection
         /// </summary>
-        public AliasService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
+        public AliasService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        private string ApiUrl => CreateApiUrl("Alias", _siteState.Alias);
+        private string ApiUrl => CreateApiUrl("Alias");
 
         /// <inheritdoc />
         public async Task<List<Alias>> GetAliasesAsync()
diff --git a/Oqtane.Client/Services/DatabaseService.cs b/Oqtane.Client/Services/DatabaseService.cs
index 81c93248..bfa06865 100644
--- a/Oqtane.Client/Services/DatabaseService.cs
+++ b/Oqtane.Client/Services/DatabaseService.cs
@@ -11,15 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class DatabaseService : ServiceBase, IDatabaseService
     {
+        public DatabaseService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        private readonly SiteState _siteState;
-
-        public DatabaseService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Database", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Database");
 
         public async Task<List<Database>> GetDatabasesAsync()
         {
diff --git a/Oqtane.Client/Services/FileService.cs b/Oqtane.Client/Services/FileService.cs
index 84932e19..3a224cc4 100644
--- a/Oqtane.Client/Services/FileService.cs
+++ b/Oqtane.Client/Services/FileService.cs
@@ -14,16 +14,14 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class FileService : ServiceBase, IFileService
     {
-        private readonly SiteState _siteState;
         private readonly IJSRuntime _jsRuntime;
 
-        public FileService(HttpClient http, SiteState siteState, IJSRuntime jsRuntime) : base(http)
+        public FileService(HttpClient http, SiteState siteState, IJSRuntime jsRuntime) : base(http, siteState)
         {
-            _siteState = siteState;
             _jsRuntime = jsRuntime;
         }
 
-        private string Apiurl => CreateApiUrl("File", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("File");
 
         public async Task<List<File>> GetFilesAsync(int folderId)
         {
diff --git a/Oqtane.Client/Services/FolderService.cs b/Oqtane.Client/Services/FolderService.cs
index 653fab23..6375d9a6 100644
--- a/Oqtane.Client/Services/FolderService.cs
+++ b/Oqtane.Client/Services/FolderService.cs
@@ -14,14 +14,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class FolderService : ServiceBase, IFolderService
     {
-        private readonly SiteState _siteState;
+        public FolderService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public FolderService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string ApiUrl => CreateApiUrl("Folder", _siteState.Alias);
+        private string ApiUrl => CreateApiUrl("Folder");
 
         public async Task<List<Folder>> GetFoldersAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/InstallationService.cs b/Oqtane.Client/Services/InstallationService.cs
index 44441fe8..4659d9f6 100644
--- a/Oqtane.Client/Services/InstallationService.cs
+++ b/Oqtane.Client/Services/InstallationService.cs
@@ -15,7 +15,7 @@ namespace Oqtane.Services
         private readonly NavigationManager _navigationManager;
         private readonly SiteState _siteState;
 
-        public InstallationService(HttpClient http, NavigationManager navigationManager, SiteState siteState) : base(http)
+        public InstallationService(HttpClient http, SiteState siteState, NavigationManager navigationManager) : base(http, siteState)
         {
             _navigationManager = navigationManager;
             _siteState = siteState;
diff --git a/Oqtane.Client/Services/Interfaces/IUserRoleService.cs b/Oqtane.Client/Services/Interfaces/IUserRoleService.cs
index b0897554..802a0d0e 100644
--- a/Oqtane.Client/Services/Interfaces/IUserRoleService.cs
+++ b/Oqtane.Client/Services/Interfaces/IUserRoleService.cs
@@ -16,6 +16,31 @@ namespace Oqtane.Services
         /// <returns></returns>
         Task<List<UserRole>> GetUserRolesAsync(int siteId);
 
+        /// <summary>
+        /// Get all <see cref="UserRole"/>s on a <see cref="Site"/>
+        /// </summary>
+        /// <param name="siteId">ID-reference to a <see cref="Site"/></param>
+        /// <param name="userId">ID-reference to a <see cref="User"/></param>
+        /// <returns></returns>
+        Task<List<UserRole>> GetUserRolesAsync(int siteId, int userId);
+
+        /// <summary>
+        /// Get all <see cref="UserRole"/>s on a <see cref="Site"/>
+        /// </summary>
+        /// <param name="siteId">ID-reference to a <see cref="Site"/></param>
+        /// <param name="roleName">Name reference a <see cref="Role"/></param>
+        /// <returns></returns>
+        Task<List<UserRole>> GetUserRolesAsync(int siteId, string roleName);
+
+        /// <summary>
+        /// Get all <see cref="UserRole"/>s on a <see cref="Site"/>
+        /// </summary>
+        /// <param name="siteId">ID-reference to a <see cref="Site"/></param>
+        /// <param name="userId">ID-reference to a <see cref="User"/></param>
+        /// <param name="roleName">Name reference a <see cref="Role"/></param>
+        /// <returns></returns>
+        Task<List<UserRole>> GetUserRolesAsync(int siteId, int userId, string roleName);
+
         /// <summary>
         /// Get one specific <see cref="UserRole"/>
         /// </summary>
diff --git a/Oqtane.Client/Services/Interfaces/IUserService.cs b/Oqtane.Client/Services/Interfaces/IUserService.cs
index 9a80c7bd..012c5f79 100644
--- a/Oqtane.Client/Services/Interfaces/IUserService.cs
+++ b/Oqtane.Client/Services/Interfaces/IUserService.cs
@@ -54,10 +54,8 @@ namespace Oqtane.Services
         /// Note that this will probably not be a real User, but a user object where the `Username` and `Password` have been filled.
         /// </summary>
         /// <param name="user">A <see cref="User"/> object which should have at least the <see cref="User.Username"/> and <see cref="User.Password"/> set.</param>
-        /// <param name="setCookie">Determines if the login should be stored in the cookie.</param>
-        /// <param name="isPersistent">Determines if the login should be persisted in the cookie for a long time.</param>
         /// <returns></returns>
-        Task<User> LoginUserAsync(User user, bool setCookie, bool isPersistent);
+        Task<User> LoginUserAsync(User user);
 
         /// <summary>
         /// Logout a <see cref="User"/>
@@ -109,5 +107,24 @@ namespace Oqtane.Services
         /// </summary>
         /// <returns></returns>
         Task<string> GetTokenAsync();
+
+        /// <summary>
+        /// Get personal access token for current user (administrators only)
+        /// </summary>
+        /// <returns></returns>
+        Task<string> GetPersonalAccessTokenAsync();
+
+        /// <summary>
+        /// Link an external login with a local user account
+        /// </summary>
+        /// <param name="user">The <see cref="User"/> we're verifying</param>
+        /// <param name="token">A Hash value in the URL which verifies this user got the e-mail (containing this token)</param>
+        /// <param name="type">External Login provider type</param>
+        /// <param name="key">External Login provider key</param>
+        /// <param name="name">External Login provider display name</param>
+        /// <returns></returns>
+        Task<User> LinkUserAsync(User user, string token, string type, string key, string name);
+
+
     }
 }
diff --git a/Oqtane.Client/Services/JobLogService.cs b/Oqtane.Client/Services/JobLogService.cs
index 6c2f0a73..04c9c534 100644
--- a/Oqtane.Client/Services/JobLogService.cs
+++ b/Oqtane.Client/Services/JobLogService.cs
@@ -11,14 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class JobLogService : ServiceBase, IJobLogService
     {
-        private readonly SiteState _siteState;
+        public JobLogService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public JobLogService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("JobLog", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("JobLog");
 
         public async Task<List<JobLog>> GetJobLogsAsync()
         {
diff --git a/Oqtane.Client/Services/JobService.cs b/Oqtane.Client/Services/JobService.cs
index f4fdc281..edb43485 100644
--- a/Oqtane.Client/Services/JobService.cs
+++ b/Oqtane.Client/Services/JobService.cs
@@ -11,14 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class JobService : ServiceBase, IJobService
     {
-        private readonly SiteState _siteState;
+        public JobService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public JobService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Job", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Job");
         
         public async Task<List<Job>> GetJobsAsync()
         {
diff --git a/Oqtane.Client/Services/LanguageService.cs b/Oqtane.Client/Services/LanguageService.cs
index dc8ff89b..d9657420 100644
--- a/Oqtane.Client/Services/LanguageService.cs
+++ b/Oqtane.Client/Services/LanguageService.cs
@@ -10,16 +10,10 @@ namespace Oqtane.Services
 {
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class LanguageService : ServiceBase, ILanguageService
-    {
-        
-        private readonly SiteState _siteState;
+    {        
+        public LanguageService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public LanguageService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Language", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Language");
 
         public async Task<List<Language>> GetLanguagesAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/LocalizationService.cs b/Oqtane.Client/Services/LocalizationService.cs
index d0603997..8b45a49d 100644
--- a/Oqtane.Client/Services/LocalizationService.cs
+++ b/Oqtane.Client/Services/LocalizationService.cs
@@ -10,14 +10,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class LocalizationService : ServiceBase, ILocalizationService
     {
-        private readonly SiteState _siteState;
+        public LocalizationService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public LocalizationService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Localization", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Localization");
 
         public async Task<IEnumerable<Culture>> GetCulturesAsync() => await GetJsonAsync<IEnumerable<Culture>>(Apiurl);
     }
diff --git a/Oqtane.Client/Services/LogService.cs b/Oqtane.Client/Services/LogService.cs
index 8b158cb2..e575694e 100644
--- a/Oqtane.Client/Services/LogService.cs
+++ b/Oqtane.Client/Services/LogService.cs
@@ -14,18 +14,16 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class LogService : ServiceBase, ILogService
     {
-        
         private readonly SiteState _siteState;
         private readonly NavigationManager _navigationManager;
 
-        public LogService(HttpClient http, SiteState siteState, NavigationManager navigationManager) : base(http)
+        public LogService(HttpClient http, SiteState siteState, NavigationManager navigationManager) : base(http, siteState)
         {
-            
             _siteState = siteState;
             _navigationManager = navigationManager;
         }
 
-        private string Apiurl => CreateApiUrl("Log", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Log");
 
         public async Task<List<Log>> GetLogsAsync(int siteId, string level, string function, int rows)
         {
diff --git a/Oqtane.Client/Services/ModuleDefinitionService.cs b/Oqtane.Client/Services/ModuleDefinitionService.cs
index 202aa90d..3416e25b 100644
--- a/Oqtane.Client/Services/ModuleDefinitionService.cs
+++ b/Oqtane.Client/Services/ModuleDefinitionService.cs
@@ -14,16 +14,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class ModuleDefinitionService : ServiceBase, IModuleDefinitionService
     {
-        private readonly HttpClient _http;
-        private readonly SiteState _siteState;
+        public ModuleDefinitionService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public ModuleDefinitionService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _http = http;
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("ModuleDefinition", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("ModuleDefinition");
 
         public async Task<List<ModuleDefinition>> GetModuleDefinitionsAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/ModuleService.cs b/Oqtane.Client/Services/ModuleService.cs
index 01ec03c5..70d47d45 100644
--- a/Oqtane.Client/Services/ModuleService.cs
+++ b/Oqtane.Client/Services/ModuleService.cs
@@ -11,15 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class ModuleService : ServiceBase, IModuleService
     {
-        
-        private readonly SiteState _siteState;
+        public ModuleService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public ModuleService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Module", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Module");
 
         public async Task<List<Module>> GetModulesAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/NotificationService.cs b/Oqtane.Client/Services/NotificationService.cs
index ce710da5..3368ff0b 100644
--- a/Oqtane.Client/Services/NotificationService.cs
+++ b/Oqtane.Client/Services/NotificationService.cs
@@ -11,14 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class NotificationService : ServiceBase, INotificationService
     {
-        private readonly SiteState _siteState;
+        public NotificationService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public NotificationService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Notification", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Notification");
 
         public async Task<List<Notification>> GetNotificationsAsync(int siteId, string direction, int userId)
         {
diff --git a/Oqtane.Client/Services/PackageService.cs b/Oqtane.Client/Services/PackageService.cs
index e0dad5b0..a45c73e6 100644
--- a/Oqtane.Client/Services/PackageService.cs
+++ b/Oqtane.Client/Services/PackageService.cs
@@ -12,13 +12,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class PackageService : ServiceBase, IPackageService
     {
-        private readonly SiteState _siteState;
+        public PackageService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public PackageService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-        private string Apiurl => CreateApiUrl("Package", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Package");
 
         public async Task<List<Package>> GetPackagesAsync(string type)
         {
diff --git a/Oqtane.Client/Services/PageModuleService.cs b/Oqtane.Client/Services/PageModuleService.cs
index 4ed4fa1a..c9ebc19a 100644
--- a/Oqtane.Client/Services/PageModuleService.cs
+++ b/Oqtane.Client/Services/PageModuleService.cs
@@ -9,15 +9,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class PageModuleService : ServiceBase, IPageModuleService
     {
-        
-        private readonly SiteState _siteState;
+        public PageModuleService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public PageModuleService(HttpClient http, SiteState siteState) : base(http)
-        {            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("PageModule", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("PageModule");
 
         public async Task<PageModule> GetPageModuleAsync(int pageModuleId)
         {
diff --git a/Oqtane.Client/Services/PageService.cs b/Oqtane.Client/Services/PageService.cs
index a1030848..e9d7991d 100644
--- a/Oqtane.Client/Services/PageService.cs
+++ b/Oqtane.Client/Services/PageService.cs
@@ -13,16 +13,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class PageService : ServiceBase, IPageService
     {
-        
-        private readonly SiteState _siteState;
+        public PageService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public PageService(HttpClient http, SiteState siteState) : base(http)
-        {
-            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Page", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Page");
 
         public async Task<List<Page>> GetPagesAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/ProfileService.cs b/Oqtane.Client/Services/ProfileService.cs
index e19069f7..5f0f1080 100644
--- a/Oqtane.Client/Services/ProfileService.cs
+++ b/Oqtane.Client/Services/ProfileService.cs
@@ -11,15 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class ProfileService : ServiceBase, IProfileService
     {
-        
-        private readonly SiteState _siteState;
+        public ProfileService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public ProfileService(HttpClient http, SiteState siteState) : base(http)
-        {            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Profile", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Profile");
 
         public async Task<List<Profile>> GetProfilesAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/RemoteServiceBase.cs b/Oqtane.Client/Services/RemoteServiceBase.cs
index 5076d779..75c1435d 100644
--- a/Oqtane.Client/Services/RemoteServiceBase.cs
+++ b/Oqtane.Client/Services/RemoteServiceBase.cs
@@ -21,11 +21,16 @@ namespace Oqtane.Services
         }
 
         private HttpClient GetHttpClient()
+        {
+            return GetHttpClient(_siteState?.AuthorizationToken);
+        }
+
+        private HttpClient GetHttpClient(string AuthorizationToken)
         {
             var httpClient = _httpClientFactory.CreateClient("Remote");
-            if (!httpClient.DefaultRequestHeaders.Contains(HeaderNames.Authorization) && _siteState != null && !string.IsNullOrEmpty(_siteState.AuthorizationToken))
+            if (!httpClient.DefaultRequestHeaders.Contains(HeaderNames.Authorization) && !string.IsNullOrEmpty(AuthorizationToken))
             {
-                httpClient.DefaultRequestHeaders.Add(HeaderNames.Authorization, "Bearer " + _siteState.AuthorizationToken);
+                httpClient.DefaultRequestHeaders.Add(HeaderNames.Authorization, "Bearer " + AuthorizationToken);
             }
             return httpClient;
         }
diff --git a/Oqtane.Client/Services/RoleService.cs b/Oqtane.Client/Services/RoleService.cs
index 4b4fa607..6215c51d 100644
--- a/Oqtane.Client/Services/RoleService.cs
+++ b/Oqtane.Client/Services/RoleService.cs
@@ -11,16 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class RoleService : ServiceBase, IRoleService
     {
-        
-        private readonly SiteState _siteState;
+        public RoleService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public RoleService(HttpClient http, SiteState siteState) : base(http)
-        {
-            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Role", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Role");
 
         public async Task<List<Role>> GetRolesAsync(int siteId)
         {
diff --git a/Oqtane.Client/Services/SettingService.cs b/Oqtane.Client/Services/SettingService.cs
index b87c7dfe..13177055 100644
--- a/Oqtane.Client/Services/SettingService.cs
+++ b/Oqtane.Client/Services/SettingService.cs
@@ -12,15 +12,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class SettingService : ServiceBase, ISettingService
     {
-        
-        private readonly SiteState _siteState;
+        public SettingService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public SettingService(HttpClient http, SiteState siteState) : base(http)
-        {            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Setting", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Setting");
 
         public async Task<Dictionary<string, string>> GetTenantSettingsAsync()
         {
diff --git a/Oqtane.Client/Services/SiteService.cs b/Oqtane.Client/Services/SiteService.cs
index d9320318..1aa8a659 100644
--- a/Oqtane.Client/Services/SiteService.cs
+++ b/Oqtane.Client/Services/SiteService.cs
@@ -12,15 +12,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class SiteService : ServiceBase, ISiteService
     {
-        
-        private readonly SiteState _siteState;
+        public SiteService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public SiteService(HttpClient http, SiteState siteState) : base(http)
-        {            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Site", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Site");
 
         public async Task<List<Site>> GetSitesAsync()
         {
diff --git a/Oqtane.Client/Services/SiteTemplateService.cs b/Oqtane.Client/Services/SiteTemplateService.cs
index 300fa1c2..1e6d5c3c 100644
--- a/Oqtane.Client/Services/SiteTemplateService.cs
+++ b/Oqtane.Client/Services/SiteTemplateService.cs
@@ -11,13 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class SiteTemplateService : ServiceBase, ISiteTemplateService
     {
-        private readonly SiteState _siteState;
+        public SiteTemplateService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public SiteTemplateService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-        private string Apiurl => CreateApiUrl("SiteTemplate", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("SiteTemplate");
 
         public async Task<List<SiteTemplate>> GetSiteTemplatesAsync()
         {
diff --git a/Oqtane.Client/Services/SqlService.cs b/Oqtane.Client/Services/SqlService.cs
index 00319953..403de7fd 100644
--- a/Oqtane.Client/Services/SqlService.cs
+++ b/Oqtane.Client/Services/SqlService.cs
@@ -9,14 +9,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class SqlService : ServiceBase, ISqlService
     {
-        private readonly SiteState _siteState;
+        public SqlService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public SqlService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Sql", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Sql");
 
         public async Task<SqlQuery> ExecuteQueryAsync(SqlQuery sqlquery)
         {
diff --git a/Oqtane.Client/Services/SyncService.cs b/Oqtane.Client/Services/SyncService.cs
index 45d2cfca..6f60d176 100644
--- a/Oqtane.Client/Services/SyncService.cs
+++ b/Oqtane.Client/Services/SyncService.cs
@@ -11,18 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class SyncService : ServiceBase, ISyncService
     {
+        public SyncService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        private readonly SiteState _siteState;
-
-        /// <summary>
-        /// Constructor - should only be used by Dependency Injection
-        /// </summary>
-        public SyncService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string ApiUrl => CreateApiUrl("Sync", _siteState.Alias);
+        private string ApiUrl => CreateApiUrl("Sync");
 
         /// <inheritdoc />
         public async Task<Sync> GetSyncAsync(DateTime lastSyncDate)
diff --git a/Oqtane.Client/Services/SystemService.cs b/Oqtane.Client/Services/SystemService.cs
index 6bc5a880..41605da2 100644
--- a/Oqtane.Client/Services/SystemService.cs
+++ b/Oqtane.Client/Services/SystemService.cs
@@ -9,14 +9,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class SystemService : ServiceBase, ISystemService
     {
-        private readonly SiteState _siteState;
+        public SystemService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public SystemService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("System", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("System");
 
         public async Task<Dictionary<string, object>> GetSystemInfoAsync()
         {
diff --git a/Oqtane.Client/Services/TenantService.cs b/Oqtane.Client/Services/TenantService.cs
index 6c02b9a9..b6343e7a 100644
--- a/Oqtane.Client/Services/TenantService.cs
+++ b/Oqtane.Client/Services/TenantService.cs
@@ -11,14 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class TenantService : ServiceBase, ITenantService
     {
-        private readonly SiteState _siteState;
+        public TenantService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public TenantService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Tenant", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Tenant");
 
         public async Task<List<Tenant>> GetTenantsAsync()
         {
diff --git a/Oqtane.Client/Services/ThemeService.cs b/Oqtane.Client/Services/ThemeService.cs
index 0874dd32..a62b779f 100644
--- a/Oqtane.Client/Services/ThemeService.cs
+++ b/Oqtane.Client/Services/ThemeService.cs
@@ -11,14 +11,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class ThemeService : ServiceBase, IThemeService
     {
-        private readonly SiteState _siteState;
+        public ThemeService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public ThemeService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string ApiUrl => CreateApiUrl("Theme", _siteState.Alias);
+        private string ApiUrl => CreateApiUrl("Theme");
 
         public async Task<List<Theme>> GetThemesAsync()
         {
diff --git a/Oqtane.Client/Services/UrlMappingService.cs b/Oqtane.Client/Services/UrlMappingService.cs
index 121e818b..55f381e3 100644
--- a/Oqtane.Client/Services/UrlMappingService.cs
+++ b/Oqtane.Client/Services/UrlMappingService.cs
@@ -12,16 +12,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class UrlMappingService : ServiceBase, IUrlMappingService
     {
-        
-        private readonly SiteState _siteState;
+        public UrlMappingService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public UrlMappingService(HttpClient http, SiteState siteState) : base(http)
-        {
-            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("UrlMapping", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("UrlMapping");
 
         public async Task<List<UrlMapping>> GetUrlMappingsAsync(int siteId, bool isMapped)
         {
diff --git a/Oqtane.Client/Services/UserRoleService.cs b/Oqtane.Client/Services/UserRoleService.cs
index 1bb35450..ef596854 100644
--- a/Oqtane.Client/Services/UserRoleService.cs
+++ b/Oqtane.Client/Services/UserRoleService.cs
@@ -10,19 +10,37 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class UserRoleService : ServiceBase, IUserRoleService
     {
-        
-        private readonly SiteState _siteState;
+        public UserRoleService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public UserRoleService(HttpClient http, SiteState siteState) : base(http)
-        {            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("UserRole", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("UserRole");
 
         public async Task<List<UserRole>> GetUserRolesAsync(int siteId)
         {
-            return await GetJsonAsync<List<UserRole>>($"{Apiurl}?siteid={siteId}");
+            return await GetUserRolesAsync(siteId, -1, "");
+        }
+
+        public async Task<List<UserRole>> GetUserRolesAsync(int siteId, int userId)
+        {
+            return await GetUserRolesAsync(siteId, userId, "");
+        }
+
+        public async Task<List<UserRole>> GetUserRolesAsync(int siteId, string roleName)
+        {
+            return await GetUserRolesAsync(siteId, -1, roleName);
+        }
+
+        public async Task<List<UserRole>> GetUserRolesAsync(int siteId, int userId, string roleName)
+        {
+            var url = $"{Apiurl}?siteid={siteId}";
+            if (userId != -1)
+            {
+                url += $"&userid={userId}";
+            }
+            if (roleName != "")
+            {
+                url += $"&rolename={roleName}";
+            }
+            return await GetJsonAsync<List<UserRole>>(url);
         }
 
         public async Task<UserRole> GetUserRoleAsync(int userRoleId)
diff --git a/Oqtane.Client/Services/UserService.cs b/Oqtane.Client/Services/UserService.cs
index 625d5cd1..7d363e07 100644
--- a/Oqtane.Client/Services/UserService.cs
+++ b/Oqtane.Client/Services/UserService.cs
@@ -10,14 +10,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class UserService : ServiceBase, IUserService
     {
-        private readonly SiteState _siteState;
+        public UserService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public UserService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("User", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("User");
 
         public async Task<User> GetUserAsync(int userId, int siteId)
         {
@@ -44,9 +39,9 @@ namespace Oqtane.Services
             await DeleteAsync($"{Apiurl}/{userId}?siteid={siteId}");
         }
 
-        public async Task<User> LoginUserAsync(User user, bool setCookie, bool isPersistent)
+        public async Task<User> LoginUserAsync(User user)
         {
-            return await PostJsonAsync<User>($"{Apiurl}/login?setcookie={setCookie}&persistent={isPersistent}", user);
+            return await PostJsonAsync<User>($"{Apiurl}/login", user);
         }
 
         public async Task LogoutUserAsync(User user)
@@ -84,5 +79,16 @@ namespace Oqtane.Services
         {
             return await GetStringAsync($"{Apiurl}/token");
         }
+
+        public async Task<string> GetPersonalAccessTokenAsync()
+        {
+            return await GetStringAsync($"{Apiurl}/personalaccesstoken");
+        }
+
+        public async Task<User> LinkUserAsync(User user, string token, string type, string key, string name)
+        {
+            return await PostJsonAsync<User>($"{Apiurl}/link?token={token}&type={type}&key={key}&name={name}", user);
+        }
+
     }
 }
diff --git a/Oqtane.Client/Services/VisitorService.cs b/Oqtane.Client/Services/VisitorService.cs
index 730ca5d4..9febe7f9 100644
--- a/Oqtane.Client/Services/VisitorService.cs
+++ b/Oqtane.Client/Services/VisitorService.cs
@@ -12,16 +12,9 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class VisitorService : ServiceBase, IVisitorService
     {
-        
-        private readonly SiteState _siteState;
+        public VisitorService(HttpClient http, SiteState siteState) : base(http, siteState) { }
 
-        public VisitorService(HttpClient http, SiteState siteState) : base(http)
-        {
-            
-            _siteState = siteState;
-        }
-
-        private string Apiurl => CreateApiUrl("Visitor", _siteState.Alias);
+        private string Apiurl => CreateApiUrl("Visitor");
 
         public async Task<List<Visitor>> GetVisitorsAsync(int siteId, DateTime fromDate)
         {
diff --git a/Oqtane.Client/Themes/Controls/Theme/LoginBase.cs b/Oqtane.Client/Themes/Controls/Theme/LoginBase.cs
index b7a3646f..6965b845 100644
--- a/Oqtane.Client/Themes/Controls/Theme/LoginBase.cs
+++ b/Oqtane.Client/Themes/Controls/Theme/LoginBase.cs
@@ -1,10 +1,8 @@
 using System;
-using System.Net;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Components;
 using Microsoft.JSInterop;
 using Oqtane.Enums;
-using Oqtane.Providers;
 using Oqtane.Security;
 using Oqtane.Services;
 using Oqtane.Shared;
@@ -33,28 +31,19 @@ namespace Oqtane.Themes.Controls
 
         protected async Task LogoutUser()
         {
-            await UserService.LogoutUserAsync(PageState.User);
             await LoggingService.Log(PageState.Alias, PageState.Page.PageId, null, PageState.User.UserId, GetType().AssemblyQualifiedName, "Logout", LogFunction.Security, LogLevel.Information, null, "User Logout For Username {Username}", PageState.User.Username);
-            PageState.User = null;
 
+            // check if anonymous user can access page
             var url = PageState.Alias.Path + "/" + PageState.Page.Path;
-            if (!UserSecurity.IsAuthorized(PageState.User, PermissionNames.View, PageState.Page.Permissions))
+            if (!UserSecurity.IsAuthorized(null, PermissionNames.View, PageState.Page.Permissions))
             {
                 url = PageState.Alias.Path;
             }            
 
-            if (PageState.Runtime == Shared.Runtime.Server)
-            {
-                // server-side Blazor needs to redirect to the Logout page
-                NavigationManager.NavigateTo(Utilities.TenantUrl(PageState.Alias, "/pages/logout/") + "?returnurl=" + WebUtility.UrlEncode(url), true);
-            }
-            else
-            {
-                // client-side Blazor
-                var authstateprovider = (IdentityAuthenticationStateProvider)ServiceProvider.GetService(typeof(IdentityAuthenticationStateProvider));
-                authstateprovider.NotifyAuthenticationChanged();
-                NavigationManager.NavigateTo(NavigateUrl(url, true));
-            }
+            // post to the Logout page to complete the logout process
+            var fields = new { __RequestVerificationToken = SiteState.AntiForgeryToken, returnurl = url };
+            var interop = new Interop(jsRuntime);
+            await interop.SubmitForm(Utilities.TenantUrl(PageState.Alias, "/pages/logout/"), fields);
         }
     }
 }
diff --git a/Oqtane.Client/UI/SiteRouter.razor b/Oqtane.Client/UI/SiteRouter.razor
index e62db3aa..f66983e0 100644
--- a/Oqtane.Client/UI/SiteRouter.razor
+++ b/Oqtane.Client/UI/SiteRouter.razor
@@ -80,23 +80,33 @@
 		var runtime = (Shared.Runtime)Enum.Parse(typeof(Shared.Runtime), Runtime);
 
 		Route route = new Route(_absoluteUri, SiteState.Alias.Path);
-		var moduleid = (int.TryParse(route.ModuleId, out int mid)) ? mid : -1;
+		int moduleid = (int.TryParse(route.ModuleId, out moduleid)) ? moduleid : -1;
 		var action = (!string.IsNullOrEmpty(route.Action)) ? route.Action : Constants.DefaultAction; 
 		var querystring = ParseQueryString(route.Query);
 
-		// reload the client application if there is a forced reload or the user navigated to a site with a different alias 
-		if (querystring.ContainsKey("reload") || (!route.AbsolutePath.Substring(1).ToLower().StartsWith(SiteState.Alias.Path.ToLower()) && !string.IsNullOrEmpty(SiteState.Alias.Path)))
+		// reload the client application from the server if there is a forced reload or the user navigated to a site with a different alias 
+		if (querystring.ContainsKey("reload") || (!NavigationManager.ToBaseRelativePath(_absoluteUri).ToLower().StartsWith(SiteState.Alias.Path.ToLower()) && !string.IsNullOrEmpty(SiteState.Alias.Path)))
 		{
-			NavigationManager.NavigateTo(_absoluteUri.Replace("?reload", ""), true);
-			return;
-		}
-		else
-		{
-			// the refresh parameter is used to refresh the PageState
-			if (querystring.ContainsKey("refresh"))
+			if (querystring["reload"] == "post")
 			{
-				refresh = UI.Refresh.Site;
+				// post back so that the cookies are set correctly - required on any change to the principal 
+				var interop = new Interop(JSRuntime);
+				var fields = new { returnurl = "/" + NavigationManager.ToBaseRelativePath(_absoluteUri) };
+				string url = Utilities.TenantUrl(SiteState.Alias, "/pages/external/");
+				await interop.SubmitForm(url, fields);
+				return;
 			}
+			else
+			{
+				NavigationManager.NavigateTo(_absoluteUri.Replace("?reload", ""), true);
+				return;				
+			}
+		}
+		
+		// the refresh parameter is used to refresh the client-side PageState
+		if (querystring.ContainsKey("refresh"))
+		{
+			refresh = UI.Refresh.Site;
 		}
 
 		if (PageState != null)
@@ -260,7 +270,6 @@
 					{
 						if (route.PagePath != "404")
 						{
-							await LogService.Log(null, null, user.UserId, "SiteRouter", "SiteRouter", LogFunction.Other, LogLevel.Information, null, "Page Path /{Path} Does Not Exist Or User Is Not Authorized To View", route.PagePath);
 							// redirect to 404 page
 							NavigationManager.NavigateTo(Utilities.NavigateUrl(SiteState.Alias.Path, "404", ""));
 						}
diff --git a/Oqtane.Database.MySQL/Oqtane.Database.MySQL.csproj b/Oqtane.Database.MySQL/Oqtane.Database.MySQL.csproj
index dd9b7b4f..b9a73e98 100644
--- a/Oqtane.Database.MySQL/Oqtane.Database.MySQL.csproj
+++ b/Oqtane.Database.MySQL/Oqtane.Database.MySQL.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -10,7 +10,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/Oqtane.Database.MySQL/Oqtane.Database.MySQL.nuspec b/Oqtane.Database.MySQL/Oqtane.Database.MySQL.nuspec
index a53381e1..ce9978a7 100644
--- a/Oqtane.Database.MySQL/Oqtane.Database.MySQL.nuspec
+++ b/Oqtane.Database.MySQL/Oqtane.Database.MySQL.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
     <metadata>
         <id>Oqtane.Database.MySQL</id>
-        <version>3.1.0</version>
+        <version>3.1.1</version>
         <authors>Shaun Walker</authors>
         <owners>.NET Foundation</owners>
         <title>Oqtane MySQL Provider</title>
@@ -12,7 +12,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <license type="expression">MIT</license>
         <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
         <icon>icon.png</icon>
         <tags>oqtane</tags>
     </metadata>
diff --git a/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.csproj b/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.csproj
index ac0fa2fd..a7587280 100644
--- a/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.csproj
+++ b/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -10,7 +10,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.nuspec b/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.nuspec
index 7acbc11e..df3fc572 100644
--- a/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.nuspec
+++ b/Oqtane.Database.PostgreSQL/Oqtane.Database.PostgreSQL.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
     <metadata>
         <id>Oqtane.Database.PostgreSQL</id>
-        <version>3.1.0</version>
+        <version>3.1.1</version>
         <authors>Shaun Walker</authors>
         <owners>.NET Foundation</owners>
         <title>Oqtane PostgreSQL Provider</title>
@@ -12,7 +12,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <license type="expression">MIT</license>
         <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
         <icon>icon.png</icon>
         <tags>oqtane</tags>
     </metadata>
diff --git a/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.csproj b/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.csproj
index 560df244..029b385c 100644
--- a/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.csproj
+++ b/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -10,7 +10,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.nuspec b/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.nuspec
index 1febd345..1f2642fc 100644
--- a/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.nuspec
+++ b/Oqtane.Database.SqlServer/Oqtane.Database.SqlServer.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
     <metadata>
         <id>Oqtane.Database.SqlServer</id>
-        <version>3.1.0</version>
+        <version>3.1.1</version>
         <authors>Shaun Walker</authors>
         <owners>.NET Foundation</owners>
         <title>Oqtane SQL Server Provider</title>
@@ -12,7 +12,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <license type="expression">MIT</license>
         <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
         <icon>icon.png</icon>
         <tags>oqtane</tags>
     </metadata>
diff --git a/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.csproj b/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.csproj
index 80d10bc1..d8a8b108 100644
--- a/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.csproj
+++ b/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -10,7 +10,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.nuspec b/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.nuspec
index 4d6037b2..61ab028d 100644
--- a/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.nuspec
+++ b/Oqtane.Database.Sqlite/Oqtane.Database.Sqlite.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
     <metadata>
         <id>Oqtane.Database.Sqlite</id>
-        <version>3.1.0</version>
+        <version>3.1.1</version>
         <authors>Shaun Walker</authors>
         <owners>.NET Foundation</owners>
         <title>Oqtane SQLite Provider</title>
@@ -12,7 +12,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <license type="expression">MIT</license>
         <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+        <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
         <icon>icon.png</icon>
         <tags>oqtane</tags>
     </metadata>
diff --git a/Oqtane.Package/Oqtane.Client.nuspec b/Oqtane.Package/Oqtane.Client.nuspec
index 19a37783..77114489 100644
--- a/Oqtane.Package/Oqtane.Client.nuspec
+++ b/Oqtane.Package/Oqtane.Client.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
   <metadata>
     <id>Oqtane.Client</id>
-    <version>3.1.0</version>
+    <version>3.1.1</version>
     <authors>Shaun Walker</authors>
     <owners>.NET Foundation</owners>
     <title>Oqtane Framework</title>
@@ -12,7 +12,7 @@
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
     <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
     <icon>icon.png</icon>
     <tags>oqtane</tags>
   </metadata>
diff --git a/Oqtane.Package/Oqtane.Framework.nuspec b/Oqtane.Package/Oqtane.Framework.nuspec
index 1f06ebc2..9577fe07 100644
--- a/Oqtane.Package/Oqtane.Framework.nuspec
+++ b/Oqtane.Package/Oqtane.Framework.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
   <metadata>
     <id>Oqtane.Framework</id>
-    <version>3.1.0</version>
+    <version>3.1.1</version>
     <authors>Shaun Walker</authors>
     <owners>.NET Foundation</owners>
     <title>Oqtane Framework</title>
@@ -11,8 +11,8 @@
     <copyright>.NET Foundation</copyright>
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
-    <projectUrl>https://github.com/oqtane/oqtane.framework/releases/download/v3.1.0/Oqtane.Framework.3.1.0.Upgrade.zip</projectUrl>
-    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+    <projectUrl>https://github.com/oqtane/oqtane.framework/releases/download/v3.1.1/Oqtane.Framework.3.1.1.Upgrade.zip</projectUrl>
+    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
     <icon>icon.png</icon>
     <tags>oqtane framework</tags>
   </metadata>
diff --git a/Oqtane.Package/Oqtane.Server.nuspec b/Oqtane.Package/Oqtane.Server.nuspec
index 8eb6425f..819caab8 100644
--- a/Oqtane.Package/Oqtane.Server.nuspec
+++ b/Oqtane.Package/Oqtane.Server.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
   <metadata>
     <id>Oqtane.Server</id>
-    <version>3.1.0</version>
+    <version>3.1.1</version>
     <authors>Shaun Walker</authors>
     <owners>.NET Foundation</owners>
     <title>Oqtane Framework</title>
@@ -12,7 +12,7 @@
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
     <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
     <icon>icon.png</icon>
     <tags>oqtane</tags>
   </metadata>
diff --git a/Oqtane.Package/Oqtane.Shared.nuspec b/Oqtane.Package/Oqtane.Shared.nuspec
index bd84e24b..6264e71f 100644
--- a/Oqtane.Package/Oqtane.Shared.nuspec
+++ b/Oqtane.Package/Oqtane.Shared.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
   <metadata>
     <id>Oqtane.Shared</id>
-    <version>3.1.0</version>
+    <version>3.1.1</version>
     <authors>Shaun Walker</authors>
     <owners>.NET Foundation</owners>
     <title>Oqtane Framework</title>
@@ -12,7 +12,7 @@
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
     <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
     <icon>icon.png</icon>
     <tags>oqtane</tags>
   </metadata>
diff --git a/Oqtane.Package/Oqtane.Updater.nuspec b/Oqtane.Package/Oqtane.Updater.nuspec
index e22d2366..9f81af27 100644
--- a/Oqtane.Package/Oqtane.Updater.nuspec
+++ b/Oqtane.Package/Oqtane.Updater.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
   <metadata>
     <id>Oqtane.Updater</id>
-    <version>3.1.0</version>
+    <version>3.1.1</version>
     <authors>Shaun Walker</authors>
     <owners>.NET Foundation</owners>
     <title>Oqtane Framework</title>
@@ -12,7 +12,7 @@
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
     <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
-    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</releaseNotes>
+    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</releaseNotes>
     <icon>icon.png</icon>
     <tags>oqtane</tags>
   </metadata>
diff --git a/Oqtane.Package/install.ps1 b/Oqtane.Package/install.ps1
index 4b8be660..13853034 100644
--- a/Oqtane.Package/install.ps1
+++ b/Oqtane.Package/install.ps1
@@ -1 +1 @@
-Compress-Archive -Path "..\Oqtane.Server\bin\Release\net6.0\publish\*" -DestinationPath "Oqtane.Framework.3.1.0.Install.zip" -Force 
\ No newline at end of file
+Compress-Archive -Path "..\Oqtane.Server\bin\Release\net6.0\publish\*" -DestinationPath "Oqtane.Framework.3.1.1.Install.zip" -Force 
\ No newline at end of file
diff --git a/Oqtane.Package/upgrade.ps1 b/Oqtane.Package/upgrade.ps1
index d0eef8e5..84315e93 100644
--- a/Oqtane.Package/upgrade.ps1
+++ b/Oqtane.Package/upgrade.ps1
@@ -1 +1 @@
-Compress-Archive -Path "..\Oqtane.Server\bin\Release\net6.0\publish\*" -DestinationPath "Oqtane.Framework.3.1.0.Upgrade.zip" -Force 
\ No newline at end of file
+Compress-Archive -Path "..\Oqtane.Server\bin\Release\net6.0\publish\*" -DestinationPath "Oqtane.Framework.3.1.1.Upgrade.zip" -Force 
\ No newline at end of file
diff --git a/Oqtane.Server/Controllers/FileController.cs b/Oqtane.Server/Controllers/FileController.cs
index 34c2ab2a..e13f770c 100644
--- a/Oqtane.Server/Controllers/FileController.cs
+++ b/Oqtane.Server/Controllers/FileController.cs
@@ -137,6 +137,7 @@ namespace Oqtane.Controllers
             {
                 if (File.Name != file.Name || File.FolderId != file.FolderId)
                 {
+                    file.Folder = _folders.GetFolder(file.FolderId);
                     string folderpath = _folders.GetFolderPath(file.Folder);
                     if (!Directory.Exists(folderpath))
                     {
diff --git a/Oqtane.Server/Controllers/SqlController.cs b/Oqtane.Server/Controllers/SqlController.cs
index 10922007..6b4eca3d 100644
--- a/Oqtane.Server/Controllers/SqlController.cs
+++ b/Oqtane.Server/Controllers/SqlController.cs
@@ -52,6 +52,7 @@ namespace Oqtane.Controllers
             }
             catch (Exception ex)
             {
+                results.Add(new Dictionary<string, string>() { { "Error", ex.Message } });
                 _logger.Log(LogLevel.Error, this, LogFunction.Other, "Sql Query {Query} Executed on Tenant {TenantId} Resulted In An Error {Error}", sqlquery.Query, sqlquery.TenantId, ex.Message);
             }
             sqlquery.Results = results;
diff --git a/Oqtane.Server/Controllers/UserController.cs b/Oqtane.Server/Controllers/UserController.cs
index b741cae0..d73ea1e6 100644
--- a/Oqtane.Server/Controllers/UserController.cs
+++ b/Oqtane.Server/Controllers/UserController.cs
@@ -109,7 +109,6 @@ namespace Oqtane.Controllers
 
                 if (!User.IsInRole(RoleNames.Admin) && User.Identity.Name?.ToLower() != user.Username.ToLower())
                 {
-                    user.DisplayName = "";
                     user.Email = "";
                     user.PhotoFileId = null;
                     user.LastLoginOn = DateTime.MinValue;
@@ -203,7 +202,7 @@ namespace Oqtane.Controllers
                     else
                     {
                         string url = HttpContext.Request.Scheme + "://" + _tenantManager.GetAlias().Name;
-                        string body = "Dear " + user.DisplayName + ",\n\nA User Account Has Been Succesfully Created For You. Please Use The Following Link To Access The Site:\n\n" + url + "\n\nThank You!";
+                        string body = "Dear " + user.DisplayName + ",\n\nA User Account Has Been Successfully Created For You. Please Use The Following Link To Access The Site:\n\n" + url + "\n\nThank You!";
                         var notification = new Notification(user.SiteId, newUser, "User Account Notification", body);
                         _notifications.AddNotification(notification);
                     }
@@ -316,7 +315,7 @@ namespace Oqtane.Controllers
 
         // POST api/<controller>/login
         [HttpPost("login")]
-        public async Task<User> Login([FromBody] User user, bool setCookie, bool isPersistent)
+        public async Task<User> Login([FromBody] User user)
         {
             User loginUser = new User { SiteId = user.SiteId, Username = user.Username, IsAuthenticated = false };
 
@@ -357,10 +356,6 @@ namespace Oqtane.Controllers
                                     loginUser.LastIPAddress = HttpContext.Connection.RemoteIpAddress.ToString();
                                     _users.UpdateUser(loginUser);
                                     _logger.Log(LogLevel.Information, this, LogFunction.Security, "User Login Successful {Username}", user.Username);
-                                    if (setCookie)
-                                    {
-                                        await _identitySignInManager.SignInAsync(identityuser, isPersistent);
-                                    }
                                 }
                                 else
                                 {
@@ -419,7 +414,7 @@ namespace Oqtane.Controllers
                     }
                     else
                     {
-                        _logger.Log(LogLevel.Error, this, LogFunction.Security, "Email Verification Failed For {Username} - Error {Error}", user.Username, result.Errors.ToString());
+                        _logger.Log(LogLevel.Error, this, LogFunction.Security, "Email Verification Failed For {Username} - Error {Error}", user.Username, string.Join(" ", result.Errors.ToList().Select(e => e.Description)));
                         user = null;
                     }
                 }
@@ -477,7 +472,7 @@ namespace Oqtane.Controllers
                     }
                     else
                     {
-                        _logger.Log(LogLevel.Error, this, LogFunction.Security, "Password Reset Failed For {Username} - Error {Error}", user.Username, result.Errors.ToString());
+                        _logger.Log(LogLevel.Information, this, LogFunction.Security, "Password Reset Failed For {Username} - Error {Error}", user.Username, string.Join(" ", result.Errors.ToList().Select(e => e.Description)));
                         user = null;
                     }
                 }
@@ -511,6 +506,38 @@ namespace Oqtane.Controllers
             return loginUser;
         }
 
+        // POST api/<controller>/link
+        [HttpPost("link")]
+        public async Task<User> Link([FromBody] User user, string token, string type, string key, string name)
+        {
+            if (ModelState.IsValid)
+            {
+                IdentityUser identityuser = await _identityUserManager.FindByNameAsync(user.Username);
+                if (identityuser != null && !string.IsNullOrEmpty(token))
+                {
+                    var result = await _identityUserManager.ConfirmEmailAsync(identityuser, token);
+                    if (result.Succeeded)
+                    {
+                        // make LoginProvider multi-tenant aware
+                        type += ":" + user.SiteId.ToString();
+                        await _identityUserManager.AddLoginAsync(identityuser, new UserLoginInfo(type, key, name));
+                        _logger.Log(LogLevel.Information, this, LogFunction.Security, "External Login Linkage Successful For {Username} And Provider {Provider}", user.Username, type);
+                    }
+                    else
+                    {
+                        _logger.Log(LogLevel.Error, this, LogFunction.Security, "External Login Linkage Failed For {Username} - Error {Error}", user.Username, string.Join(" ", result.Errors.ToList().Select(e => e.Description)));
+                        user = null;
+                    }
+                }
+            }
+            else
+            {
+                _logger.Log(LogLevel.Error, this, LogFunction.Security, "External Login Linkage Failed For {Username} And Token {Token}", user.Username, token);
+                user = null;
+            }
+            return user;
+        }
+
         // GET api/<controller>/validate/x
         [HttpGet("validate/{password}")]
         public async Task<bool> Validate(string password)
@@ -522,8 +549,23 @@ namespace Oqtane.Controllers
 
         // GET api/<controller>/token
         [HttpGet("token")]
-        [Authorize(Roles = RoleNames.Admin)]
+        [Authorize(Roles = RoleNames.Registered)]
         public string Token()
+        {
+            var token = "";
+            var sitesettings = HttpContext.GetSiteSettings();
+            var secret = sitesettings.GetValue("JwtOptions:Secret", "");
+            if (!string.IsNullOrEmpty(secret))
+            {
+                token = _jwtManager.GenerateToken(_tenantManager.GetAlias(), (ClaimsIdentity)User.Identity, secret, sitesettings.GetValue("JwtOptions:Issuer", ""), sitesettings.GetValue("JwtOptions:Audience", ""), int.Parse(sitesettings.GetValue("JwtOptions:Audience", "20")));
+            }
+            return token;
+        }
+
+        // GET api/<controller>/personalaccesstoken
+        [HttpGet("personalaccesstoken")]
+        [Authorize(Roles = RoleNames.Admin)]
+        public string PersonalAccessToken()
         {
             var token = "";
             var sitesettings = HttpContext.GetSiteSettings();
diff --git a/Oqtane.Server/Controllers/UserRoleController.cs b/Oqtane.Server/Controllers/UserRoleController.cs
index 0250fd7c..1d179a3d 100644
--- a/Oqtane.Server/Controllers/UserRoleController.cs
+++ b/Oqtane.Server/Controllers/UserRoleController.cs
@@ -8,6 +8,8 @@ using Oqtane.Infrastructure;
 using Oqtane.Repository;
 using System.Linq;
 using System.Net;
+using Oqtane.Security;
+using System;
 
 namespace Oqtane.Controllers
 {
@@ -16,32 +18,57 @@ namespace Oqtane.Controllers
     {
         private readonly IUserRoleRepository _userRoles;
         private readonly IRoleRepository _roles;
+        private readonly IUserPermissions _userPermissions;
         private readonly ISyncManager _syncManager;
         private readonly ILogManager _logger;
         private readonly Alias _alias;
 
-        public UserRoleController(IUserRoleRepository userRoles, IRoleRepository roles, ITenantManager tenantManager, ISyncManager syncManager, ILogManager logger)
+        public UserRoleController(IUserRoleRepository userRoles, IRoleRepository roles, IUserPermissions userPermissions, ITenantManager tenantManager, ISyncManager syncManager, ILogManager logger)
         {
             _userRoles = userRoles;
             _roles = roles;
+            _userPermissions = userPermissions;
             _syncManager = syncManager;
             _logger = logger;
             _alias = tenantManager.GetAlias();
         }
 
-        // GET: api/<controller>?siteid=x
+        // GET: api/<controller>?siteid=x&userid=y&rolename=z
         [HttpGet]
-        [Authorize(Roles = RoleNames.Admin)]
-        public IEnumerable<UserRole> Get(string siteid)
+        [Authorize(Roles = RoleNames.Registered)]
+        public IEnumerable<UserRole> Get(string siteid, string userid = null, string rolename = null)
         {
             int SiteId;
             if (int.TryParse(siteid, out SiteId) && SiteId == _alias.SiteId)
             {
-                return _userRoles.GetUserRoles(SiteId);
+                int UserId = (int.TryParse(userid, out UserId)) ? UserId : -1;
+                if (User.IsInRole(RoleNames.Admin) || ((userid == null || _userPermissions.GetUser().UserId == UserId) && (rolename == null || (User.IsInRole(rolename) && rolename != RoleNames.Registered))))
+                {
+                    var userroles = _userRoles.GetUserRoles(SiteId).ToList();
+                    if (userid != null)
+                    {
+                        userroles = userroles.Where(item => item.UserId == UserId).ToList();
+                    }
+                    if (rolename != null)
+                    {
+                        userroles = userroles.Where(item => item.Role.Name == rolename).ToList();
+                    }
+                    for (int i = 0; i < userroles.Count(); i++)
+                    {
+                        userroles[i] = Filter(userroles[i]);
+                    }
+                    return userroles.OrderBy(u => u.User.DisplayName);
+                }
+                else
+                {
+                    _logger.Log(LogLevel.Error, this, LogFunction.Security, "Unauthorized UserRole Get Attempt For Site {SiteId} User {UserId} Role {RoleName}", siteid, userid, rolename);
+                    HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden;
+                    return null;
+                }
             }
             else
             {
-                _logger.Log(LogLevel.Error, this, LogFunction.Security, "Unauthorized UserRole Get Attempt {SiteId}", siteid);
+                _logger.Log(LogLevel.Error, this, LogFunction.Security, "Unauthorized UserRole Get Attempt For Site {SiteId} User {UserId} Role {RoleName}", siteid, userid, rolename);
                 HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden;
                 return null;
             }
@@ -49,13 +76,22 @@ namespace Oqtane.Controllers
         
         // GET api/<controller>/5
         [HttpGet("{id}")]
-        [Authorize(Roles = RoleNames.Admin)]
+        [Authorize(Roles = RoleNames.Registered)]
         public UserRole Get(int id)
         {
             var userrole = _userRoles.GetUserRole(id);
             if (userrole != null && SiteValid(userrole.Role.SiteId))
             {
-                return userrole;
+                if (User.IsInRole(RoleNames.Admin) || User.Identity.Name?.ToLower() != userrole.User.Username.ToLower() || User.IsInRole(userrole.Role.Name))
+                {
+                    return Filter(userrole);
+                }
+                else
+                {
+                    _logger.Log(LogLevel.Error, this, LogFunction.Security, "Unauthorized User Role Get Attempt {UserRoleId}", id);
+                    HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden;
+                    return null;
+                }
             }
             else
             {
@@ -65,6 +101,35 @@ namespace Oqtane.Controllers
             }
         }
 
+        private UserRole Filter(UserRole userrole)
+        {
+            if (userrole != null)
+            {
+                userrole.User.Password = "";
+                userrole.User.IsAuthenticated = false;
+                userrole.User.TwoFactorCode = "";
+                userrole.User.TwoFactorExpiry = null;
+
+                if (!User.IsInRole(RoleNames.Admin) && User.Identity.Name?.ToLower() != userrole.User.Username.ToLower())
+                {
+                    userrole.User.Email = "";
+                    userrole.User.PhotoFileId = null;
+                    userrole.User.LastLoginOn = DateTime.MinValue;
+                    userrole.User.LastIPAddress = "";
+                    userrole.User.Roles = "";
+                    userrole.User.CreatedBy = "";
+                    userrole.User.CreatedOn = DateTime.MinValue;
+                    userrole.User.ModifiedBy = "";
+                    userrole.User.ModifiedOn = DateTime.MinValue;
+                    userrole.User.DeletedBy = "";
+                    userrole.User.DeletedOn = DateTime.MinValue;
+                    userrole.User.IsDeleted = false;
+                    userrole.User.TwoFactorRequired = false;
+                }
+            }
+            return userrole;
+        }
+
         // POST api/<controller>
         [HttpPost]
         [Authorize(Roles = RoleNames.Admin)]
diff --git a/Oqtane.Server/Extensions/OqtaneServiceCollectionExtensions.cs b/Oqtane.Server/Extensions/OqtaneServiceCollectionExtensions.cs
index 7377abfa..31132a00 100644
--- a/Oqtane.Server/Extensions/OqtaneServiceCollectionExtensions.cs
+++ b/Oqtane.Server/Extensions/OqtaneServiceCollectionExtensions.cs
@@ -72,6 +72,7 @@ namespace Microsoft.Extensions.DependencyInjection
             services.AddSingleton<IDatabaseManager, DatabaseManager>();
             services.AddSingleton<IConfigManager, ConfigManager>();
             services.AddSingleton<ILoggerProvider, FileLoggerProvider>();
+            services.AddSingleton<AutoValidateAntiforgeryTokenFilter>();
             return services;
         }
 
diff --git a/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs b/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs
index ce34632f..b63b9ad3 100644
--- a/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs
+++ b/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs
@@ -16,8 +16,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Authentication.OAuth;
 using System.Net.Http;
 using System.Net.Http.Headers;
-using System.Text.RegularExpressions;
 using Microsoft.AspNetCore.Authentication.Cookies;
+using System.Net;
+using System.Text.Json.Nodes;
 
 namespace Oqtane.Extensions
 {
@@ -28,15 +29,7 @@ namespace Oqtane.Extensions
             // site cookie authentication options
             builder.AddSiteOptions<CookieAuthenticationOptions>((options, alias, sitesettings) =>
             {
-                if (sitesettings.GetValue("LoginOptions:CookieType", "domain") == "domain")
-                {
-                    options.Cookie.Name = ".AspNetCore.Identity.Application";
-                }
-                else
-                {
-                    // use unique cookie name for site
-                    options.Cookie.Name = ".AspNetCore.Identity.Application" + alias.SiteKey;
-                }
+                options.Cookie.Name = sitesettings.GetValue("LoginOptions:CookieName", ".AspNetCore.Identity.Application");
             });
 
             // site OpenId Connect options
@@ -104,6 +97,7 @@ namespace Oqtane.Extensions
 
                     // oauth2 events
                     options.Events.OnCreatingTicket = OnCreatingTicket;
+                    options.Events.OnTicketReceived = OnTicketReceived;
                     options.Events.OnAccessDenied = OnAccessDenied;
                     options.Events.OnRemoteFailure = OnRemoteFailure;
                 }
@@ -116,10 +110,13 @@ namespace Oqtane.Extensions
         {
             // OAuth 2.0
             var email = "";
+            var id = "";
+
             if (context.Options.UserInformationEndpoint != "")
             {
                 try
                 {
+                    // call user information endpoint
                     var request = new HttpRequestMessage(HttpMethod.Get, context.Options.UserInformationEndpoint);
                     request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                     request.Headers.UserAgent.Add(new ProductInfoHeaderValue(Constants.PackageId, Constants.Version));
@@ -128,16 +125,33 @@ namespace Oqtane.Extensions
                     response.EnsureSuccessStatusCode();
                     var output = await response.Content.ReadAsStringAsync();
 
-                    // get email address using Regex on the raw output (could be json or html)
-                    var regex = new Regex(@"\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*", RegexOptions.IgnoreCase);
-                    foreach (Match match in regex.Matches(output))
+                    // parse json output
+                    var idClaimType = context.HttpContext.GetSiteSettings().GetValue("ExternalLogin:IdentifierClaimType", "");
+                    var emailClaimType = context.HttpContext.GetSiteSettings().GetValue("ExternalLogin:EmailClaimType", "");
+                    if (!output.StartsWith("[") && !output.EndsWith("]"))
                     {
-                        if (EmailValid(match.Value, context.HttpContext.GetSiteSettings().GetValue("ExternalLogin:DomainFilter", "")))
+                        output = "[" + output + "]"; // convert to json array
+                    }
+                    JsonNode items = JsonNode.Parse(output)!;
+                    foreach (var item in items.AsArray())
+                    {
+                        if (item[emailClaimType] != null)
                         {
-                            email = match.Value.ToLower();
-                            break;
+                            if (EmailValid(item[emailClaimType].ToString(), context.HttpContext.GetSiteSettings().GetValue("ExternalLogin:DomainFilter", "")))
+                            {
+                                email = item[emailClaimType].ToString().ToLower();
+                                if (item[idClaimType] != null)
+                                {
+                                    id = item[idClaimType].ToString();
+                                }
+                                break;
+                            }
                         }
                     }
+                    if (string.IsNullOrEmpty(id))
+                    {
+                        id = email;
+                    }
                 }
                 catch (Exception ex)
                 {
@@ -146,18 +160,53 @@ namespace Oqtane.Extensions
                 }
             }
 
-            // login user
-            await LoginUser(email, context.HttpContext, context.Principal);
+            // validate user
+            var identity = await ValidateUser(email, id, context.HttpContext);
+            if (identity.Label == ExternalLoginStatus.Success)
+            {
+                identity.AddClaim(new Claim("access_token", context.AccessToken));
+                context.Principal = new ClaimsPrincipal(identity);
+            }
+
+            // pass properties to OnTicketReceived
+            context.Properties.SetParameter("status", identity.Label);
+            context.Properties.SetParameter("redirecturl", context.Properties.RedirectUri);
+        }
+
+        private static Task OnTicketReceived(TicketReceivedContext context)
+        {
+            // OAuth 2.0
+            var status = context.Properties.GetParameter<string>("status");
+            if (status != ExternalLoginStatus.Success)
+            {
+                // redirect to login page and pass status
+                context.Response.Redirect(Utilities.TenantUrl(context.HttpContext.GetAlias(), $"/login?status={status}&returnurl={context.Properties.GetParameter<string>("redirecturl")}"), true);
+                context.HandleResponse();
+            }
+            return Task.CompletedTask;
         }
 
         private static async Task OnTokenValidated(TokenValidatedContext context)
         {
             // OpenID Connect
+            var idClaimType = context.HttpContext.GetSiteSettings().GetValue("ExternalLogin:IdentifierClaimType", "");
+            var id = context.Principal.FindFirstValue(idClaimType);
             var emailClaimType = context.HttpContext.GetSiteSettings().GetValue("ExternalLogin:EmailClaimType", "");
             var email = context.Principal.FindFirstValue(emailClaimType);
 
-            // login user
-            await LoginUser(email, context.HttpContext, context.Principal);
+            // validate user
+            var identity = await ValidateUser(email, id, context.HttpContext);
+            if (identity.Label == ExternalLoginStatus.Success)
+            {
+                identity.AddClaim(new Claim("access_token", context.SecurityToken.RawData));
+                context.Principal = new ClaimsPrincipal(identity);
+            }
+            else
+            {
+                // redirect to login page and pass status
+                context.Response.Redirect(Utilities.TenantUrl(context.HttpContext.GetAlias(), $"/login?status={identity.Label}&returnurl={context.Properties.RedirectUri}"), true);
+                context.HandleResponse();
+            }
         }
 
         private static Task OnAccessDenied(AccessDeniedContext context)
@@ -165,8 +214,7 @@ namespace Oqtane.Extensions
             var _logger = context.HttpContext.RequestServices.GetRequiredService<ILogManager>();
             _logger.Log(LogLevel.Information, "ExternalLogin", Enums.LogFunction.Security, "External Login Access Denied - User May Have Cancelled Their External Login Attempt");
             // redirect to login page
-            var alias = context.HttpContext.GetAlias();
-            context.Response.Redirect(alias.Path + "/login?returnurl=" + context.Properties.RedirectUri, true);
+            context.Response.Redirect(Utilities.TenantUrl(context.HttpContext.GetAlias(), $"/login?status={ExternalLoginStatus.AccessDenied}&returnurl={context.Properties.RedirectUri}"), true);
             context.HandleResponse();
             return Task.CompletedTask;
         }
@@ -176,161 +224,162 @@ namespace Oqtane.Extensions
             var _logger = context.HttpContext.RequestServices.GetRequiredService<ILogManager>();
             _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "External Login Remote Failure - {Error}", context.Failure.Message);
             // redirect to login page
-            var alias = context.HttpContext.GetAlias();
-            context.Response.Redirect(alias.Path + "/login", true);
+            context.Response.Redirect(Utilities.TenantUrl(context.HttpContext.GetAlias(), $"/login?status={ExternalLoginStatus.RemoteFailure}"), true);
             context.HandleResponse();
             return Task.CompletedTask;
         }
 
-        private static async Task LoginUser(string email, HttpContext httpContext, ClaimsPrincipal claimsPrincipal)
+        private static async Task<ClaimsIdentity> ValidateUser(string email, string id, HttpContext httpContext)
         {
             var _logger = httpContext.RequestServices.GetRequiredService<ILogManager>();
+            ClaimsIdentity identity = new ClaimsIdentity(Constants.AuthenticationScheme);
+            // use identity.Label as a temporary location to store validation status information
 
-            if (EmailValid(email, httpContext.GetSiteSettings().GetValue("ExternalLogin:DomainFilter", "")))
+            var providerType = httpContext.GetSiteSettings().GetValue("ExternalLogin:ProviderType", "");
+            var providerName = httpContext.GetSiteSettings().GetValue("ExternalLogin:ProviderName", "");
+            var alias = httpContext.GetAlias();
+            var _users = httpContext.RequestServices.GetRequiredService<IUserRepository>();
+            User user = null;
+
+            // verify if external user is already registerd for this site
+            var _identityUserManager = httpContext.RequestServices.GetRequiredService<UserManager<IdentityUser>>();
+            var identityuser = await _identityUserManager.FindByLoginAsync(providerType + ":" + alias.SiteId.ToString(), id);
+            if (identityuser != null)
             {
-                var _identityUserManager = httpContext.RequestServices.GetRequiredService<UserManager<IdentityUser>>();
-                var _users = httpContext.RequestServices.GetRequiredService<IUserRepository>();
-                var _userRoles = httpContext.RequestServices.GetRequiredService<IUserRoleRepository>();
-                var providerType = httpContext.GetSiteSettings().GetValue("ExternalLogin:ProviderType", "");
-                var providerKey = claimsPrincipal.FindFirstValue(ClaimTypes.NameIdentifier);
-                if (providerKey == null)
+                user = _users.GetUser(identityuser.UserName);
+            }
+            else
+            {
+                if (EmailValid(email, httpContext.GetSiteSettings().GetValue("ExternalLogin:DomainFilter", "")))
                 {
-                    providerKey = email; // OAuth2 does not pass claims
-                }
-                User user = null;
-
-                bool duplicates = false;
-                IdentityUser identityuser = null;
-                try
-                {
-                    identityuser = await _identityUserManager.FindByEmailAsync(email);
-                }
-                catch
-                {
-                    // FindByEmailAsync will throw an error if the email matches multiple user accounts
-                    duplicates = true;
-                }
-                if (identityuser == null)
-                {
-                    if (duplicates)
+                    bool duplicates = false;
+                    try
                     {
-                        _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Multiple Users Exist With Email Address {Email}. Login Denied.", email);
+                        identityuser = await _identityUserManager.FindByEmailAsync(email);
                     }
-                    else
+                    catch
                     {
-                        if (bool.Parse(httpContext.GetSiteSettings().GetValue("ExternalLogin:CreateUsers", "true")))
+                        // FindByEmailAsync will throw an error if the email matches multiple user accounts
+                        duplicates = true;
+                    }
+                    if (identityuser == null)
+                    {
+                        if (duplicates)
                         {
-                            identityuser = new IdentityUser();
-                            identityuser.UserName = email;
-                            identityuser.Email = email;
-                            identityuser.EmailConfirmed = true;
-                            var result = await _identityUserManager.CreateAsync(identityuser, DateTime.UtcNow.ToString("yyyy-MMM-dd-HH-mm-ss"));
-                            if (result.Succeeded)
+                            identity.Label = ExternalLoginStatus.DuplicateEmail;
+                            _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Multiple Users Exist With Email Address {Email}. Login Denied.", email);
+                        }
+                        else
+                        {
+                            if (bool.Parse(httpContext.GetSiteSettings().GetValue("ExternalLogin:CreateUsers", "true")))
                             {
-                                user = new User
+                                identityuser = new IdentityUser();
+                                identityuser.UserName = email;
+                                identityuser.Email = email;
+                                identityuser.EmailConfirmed = true;
+                                var result = await _identityUserManager.CreateAsync(identityuser, DateTime.UtcNow.ToString("yyyy-MMM-dd-HH-mm-ss"));
+                                if (result.Succeeded)
                                 {
-                                    SiteId = httpContext.GetAlias().SiteId,
-                                    Username = email,
-                                    DisplayName = email,
-                                    Email = email,
-                                    LastLoginOn = null,
-                                    LastIPAddress = ""
-                                };
-                                user = _users.AddUser(user);
+                                    user = new User
+                                    {
+                                        SiteId = alias.SiteId,
+                                        Username = email,
+                                        DisplayName = email,
+                                        Email = email,
+                                        LastLoginOn = null,
+                                        LastIPAddress = ""
+                                    };
+                                    user = _users.AddUser(user);
 
-                                if (user != null)
-                                {
-                                    var _notifications = httpContext.RequestServices.GetRequiredService<INotificationRepository>();
-                                    string url = httpContext.Request.Scheme + "://" + httpContext.GetAlias().Name;
-                                    string body = "You Recently Used An External Account To Sign In To Our Site.\n\n" + url + "\n\nThank You!";
-                                    var notification = new Notification(user.SiteId, user, "User Account Notification", body);
-                                    _notifications.AddNotification(notification);
+                                    if (user != null)
+                                    {
+                                        var _notifications = httpContext.RequestServices.GetRequiredService<INotificationRepository>();
+                                        string url = httpContext.Request.Scheme + "://" + alias.Name;
+                                        string body = "You Recently Used An External Account To Sign In To Our Site.\n\n" + url + "\n\nThank You!";
+                                        var notification = new Notification(user.SiteId, user, "User Account Notification", body);
+                                        _notifications.AddNotification(notification);
 
-                                    // add user login
-                                    await _identityUserManager.AddLoginAsync(identityuser, new UserLoginInfo(providerType, providerKey, ""));
+                                        // add user login
+                                        await _identityUserManager.AddLoginAsync(identityuser, new UserLoginInfo(providerType + ":" + alias.SiteId.ToString(), id, providerName));
 
-                                    _logger.Log(user.SiteId, LogLevel.Information, "ExternalLogin", Enums.LogFunction.Create, "User Added {User}", user);
+                                        _logger.Log(user.SiteId, LogLevel.Information, "ExternalLogin", Enums.LogFunction.Create, "User Added {User}", user);
+                                    }
+                                    else
+                                    {
+                                        identity.Label = ExternalLoginStatus.UserNotCreated;
+                                        _logger.Log(user.SiteId, LogLevel.Error, "ExternalLogin", Enums.LogFunction.Create, "Unable To Add User {Email}", email);
+                                    }
                                 }
                                 else
                                 {
-                                    _logger.Log(user.SiteId, LogLevel.Error, "ExternalLogin", Enums.LogFunction.Create, "Unable To Add User {Email}", email);
+                                    identity.Label = ExternalLoginStatus.UserNotCreated;
+                                    _logger.Log(user.SiteId, LogLevel.Error, "ExternalLogin", Enums.LogFunction.Create, "Unable To Add Identity User {Email} {Error}", email, result.Errors.ToString());
                                 }
                             }
                             else
                             {
-                                _logger.Log(user.SiteId, LogLevel.Error, "ExternalLogin", Enums.LogFunction.Create, "Unable To Add Identity User {Email} {Error}", email, result.Errors.ToString());
+                                identity.Label = ExternalLoginStatus.UserDoesNotExist;
+                                _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Creation Of New Users Is Disabled For This Site. User With Email Address {Email} Will First Need To Be Registered On The Site.", email);
                             }
                         }
-                        else
-                        {
-                            _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Creation Of New Users Is Disabled For This Site. User With Email Address {Email} Will First Need To Be Registered On The Site.", email);
-                        }
-                    }
-                }
-                else
-                {
-                    var logins = await _identityUserManager.GetLoginsAsync(identityuser);
-                    var login = logins.FirstOrDefault(item => item.LoginProvider == providerType);
-                    if (login != null)
-                    {
-                        if (login.ProviderKey == providerKey)
-                        {
-                            user = _users.GetUser(identityuser.UserName);
-                        }
-                        else
-                        {
-                            // provider keys do not match
-                            _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Provider Key Does Not Match For User {Username}. Login Denied.", identityuser.UserName);
-                        }
                     }
                     else
                     {
-                        // add user login
-                        await _identityUserManager.AddLoginAsync(identityuser, new UserLoginInfo(providerType, providerKey, ""));
-                        user = _users.GetUser(identityuser.UserName);
-                        _logger.Log(user.SiteId, LogLevel.Information, "ExternalLogin", Enums.LogFunction.Create, "External User Login Added For {Email} Using Provider {Provider}", email, providerType);
+                        var logins = await _identityUserManager.GetLoginsAsync(identityuser);
+                        var login = logins.FirstOrDefault(item => item.LoginProvider == (providerType + ":" + alias.SiteId.ToString()));
+                        if (login == null)
+                        {
+                            // new external login using existing user account - verification required
+                            var _notifications = httpContext.RequestServices.GetRequiredService<INotificationRepository>();
+                            string token = await _identityUserManager.GenerateEmailConfirmationTokenAsync(identityuser);
+                            string url = httpContext.Request.Scheme + "://" + alias.Name;
+                            url += $"/login?name={identityuser.UserName}&token={WebUtility.UrlEncode(token)}&key={WebUtility.UrlEncode(id)}";
+                            string body = $"You Recently Signed In To Our Site With {providerName} Using The Email Address {email}. ";
+                            body += "In Order To Complete The Linkage Of Your User Account Please Click The Link Displayed Below:\n\n" + url + "\n\nThank You!";
+                            var notification = new Notification(alias.SiteId, email, email, "External Login Linkage", body);
+                            _notifications.AddNotification(notification);
+
+                            identity.Label = ExternalLoginStatus.VerificationRequired;
+                            _logger.Log(alias.SiteId, LogLevel.Information, "ExternalLogin", Enums.LogFunction.Create, "External Login Linkage Verification For Provider {Provider} Sent To {Email}", providerName, email);
+                        }
+                        else
+                        {
+                            // provider keys do not match
+                            identity.Label = ExternalLoginStatus.ProviderKeyMismatch;
+                            _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Provider Key Does Not Match For User {Username}. Login Denied.", identityuser.UserName);
+                        }
                     }
                 }
-
-                // add claims to principal
-                if (user != null)
+                else // email invalid
                 {
-                    var principal = (ClaimsIdentity)claimsPrincipal.Identity;
-                    UserSecurity.ResetClaimsIdentity(principal);
-                    var identity = UserSecurity.CreateClaimsIdentity(httpContext.GetAlias(), user, _userRoles.GetUserRoles(user.UserId, user.SiteId).ToList());
-                    principal.AddClaims(identity.Claims);
-
-                    // update user
-                    user.LastLoginOn = DateTime.UtcNow;
-                    user.LastIPAddress = httpContext.Connection.RemoteIpAddress.ToString();
-                    _users.UpdateUser(user);
-                    _logger.Log(LogLevel.Information, "ExternalLogin", Enums.LogFunction.Security, "External User Login Successful For {Username} Using Provider {Provider}", user.Username, providerType);
-                }
-                else // user not valid
-                {
-                    await httpContext.SignOutAsync();
-                }
-            }
-            else // email invalid
-            {
-                if (!string.IsNullOrEmpty(email))
-                {
-                    _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "The Email Address {Email} Is Invalid Or Does Not Match The Domain Filter Criteria. Login Denied.", email);
-                }
-                else
-                {
-                    var emailclaimtype = claimsPrincipal.Claims.FirstOrDefault(item => item.Value.Contains("@") && item.Value.Contains("."));
-                    if (emailclaimtype != null)
+                    identity.Label = ExternalLoginStatus.InvalidEmail;
+                    if (!string.IsNullOrEmpty(email))
                     {
-                        _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Please Verify If \"{ClaimType}\" Is A Valid Email Claim Type For The Provider And Update Your External Login Settings Accordingly", emailclaimtype.Type);
+                        _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "The Email Address {Email} Is Invalid Or Does Not Match The Domain Filter Criteria. Login Denied.", email);
                     }
                     else
                     {
                         _logger.Log(LogLevel.Error, "ExternalLogin", Enums.LogFunction.Security, "Provider Did Not Return An Email To Uniquely Identify The User.");
                     }
                 }
-                await httpContext.SignOutAsync();
             }
+
+            // manage user
+            if (user != null)
+            {
+                // create claims identity
+                var _userRoles = httpContext.RequestServices.GetRequiredService<IUserRoleRepository>();
+                identity = UserSecurity.CreateClaimsIdentity(alias, user, _userRoles.GetUserRoles(user.UserId, user.SiteId).ToList());
+                identity.Label = ExternalLoginStatus.Success;
+
+                // update user
+                user.LastLoginOn = DateTime.UtcNow;
+                user.LastIPAddress = httpContext.Connection.RemoteIpAddress.ToString();
+                _users.UpdateUser(user);
+                _logger.Log(LogLevel.Information, "ExternalLogin", Enums.LogFunction.Security, "External User Login Successful For {Username} Using Provider {Provider}", user.Username, providerName);
+            }
+            
+            return identity;
         }
 
         private static bool EmailValid(string email, string domainfilter)
diff --git a/Oqtane.Server/Extensions/StringExtensions.cs b/Oqtane.Server/Extensions/StringExtensions.cs
index f3640368..76290fc8 100644
--- a/Oqtane.Server/Extensions/StringExtensions.cs
+++ b/Oqtane.Server/Extensions/StringExtensions.cs
@@ -14,5 +14,14 @@ namespace Oqtane.Extensions
 
             return list.Any(f => s.StartsWith(f));
         }
+
+        public static string ReplaceMultiple(this string s, string[] oldValues, string newValue)
+        {
+            foreach(string value in oldValues)
+            {
+                s = s.Replace(value, newValue);
+            }
+            return s;
+        }
     }
 }
diff --git a/Oqtane.Server/Infrastructure/DatabaseManager.cs b/Oqtane.Server/Infrastructure/DatabaseManager.cs
index 21726ef2..e3da4de5 100644
--- a/Oqtane.Server/Infrastructure/DatabaseManager.cs
+++ b/Oqtane.Server/Infrastructure/DatabaseManager.cs
@@ -267,13 +267,13 @@ namespace Oqtane.Infrastructure
 
                     var databaseType = install.DatabaseType;
 
-                    //Get database Type
+                    // get database type
                     var type = Type.GetType(databaseType);
 
-                    //Create database object from Type
+                    // create database object from type
                     var database = Activator.CreateInstance(type) as IDatabase;
 
-                    //create data directory if does not exist
+                    // create data directory if does not exist
                     var dataDirectory = AppDomain.CurrentDomain.GetData("DataDirectory")?.ToString();
                     if (!Directory.Exists(dataDirectory)) Directory.CreateDirectory(dataDirectory ?? String.Empty);
 
@@ -287,7 +287,7 @@ namespace Oqtane.Infrastructure
                 }
                 catch (Exception ex)
                 {
-                    result.Message = ex.Message;
+                    result.Message = "An Error Occurred Creating The Database. This Is Usually Related To Your User Not Having Sufficient Rights To Perform This Operation. Please Note That You Can Also Create The Database Manually Prior To Initiating The Install Wizard. " + ex.Message;
                     _filelogger.LogError(Utilities.LogMessage(this, result.Message));
                 }
             }
@@ -321,14 +321,14 @@ namespace Oqtane.Infrastructure
                             {
                                 UpgradeSqlServer(sql, install.ConnectionString, install.DatabaseType, true);
                             }
-                            // Push latest model into database
+                            // push latest model into database
                             masterDbContext.Database.Migrate();
                             result.Success = true;
                         }
                     }
                     catch (Exception ex)
                     {
-                        result.Message = ex.Message;
+                        result.Message = "An Error Occurred Provisioning The Master Database. This Is Usually Related To The Master Database Not Being In A Supported State. " + ex.Message;
                         _filelogger.LogError(Utilities.LogMessage(this, result.Message));
                     }
                 }
@@ -429,14 +429,14 @@ namespace Oqtane.Infrastructure
                                     UpgradeSqlServer(sql, tenant.DBConnectionString, tenant.DBType, false);
                                 }
 
-                                // Push latest model into database
+                                // push latest model into database
                                 tenantDbContext.Database.Migrate();
                                 result.Success = true;
                             }
                         }
                         catch (Exception ex)
                         {
-                            result.Message = ex.Message;
+                            result.Message = "An Error Occurred Migrating A Tenant Database. This Is Usually Related To A Tenant Database Not Being In A Supported State. " + ex.Message;
                             _filelogger.LogError(Utilities.LogMessage(this, result.Message));
                         }
 
@@ -445,13 +445,21 @@ namespace Oqtane.Infrastructure
                         var index = Array.FindIndex(versions, item => item == version);
                         if (index != (versions.Length - 1))
                         {
-                            for (var i = (index + 1); i < versions.Length; i++)
+                            try
                             {
-                                upgrades.Upgrade(tenant, versions[i]);
+                                for (var i = (index + 1); i < versions.Length; i++)
+                                {
+                                    upgrades.Upgrade(tenant, versions[i]);
+                                }
+                                tenant.Version = versions[versions.Length - 1];
+                                db.Entry(tenant).State = EntityState.Modified;
+                                db.SaveChanges();
+                            }
+                            catch (Exception ex)
+                            {
+                                result.Message = "An Error Occurred Executing Upgrade Logic. " + ex.Message;
+                                _filelogger.LogError(Utilities.LogMessage(this, result.Message));
                             }
-                            tenant.Version = versions[versions.Length - 1];
-                            db.Entry(tenant).State = EntityState.Modified;
-                            db.SaveChanges();
                         }
                     }
                 }
@@ -653,7 +661,7 @@ namespace Oqtane.Infrastructure
                 }
                 catch (Exception ex)
                 {
-                    result.Message = "An Error Occurred Creating Site - " + ex.Message;
+                    result.Message = "An Error Occurred Creating Site. " + ex.Message;
                 }
             }
 
@@ -715,7 +723,7 @@ namespace Oqtane.Infrastructure
                                     {
                                         try
                                         {
-                                            var obj = Activator.CreateInstance(upgrade.Value) as ISiteMigration;
+                                            var obj = ActivatorUtilities.CreateInstance(scope.ServiceProvider, upgrade.Value) as ISiteMigration;
                                             if (obj != null)
                                             {
                                                 obj.Up(site, alias);
diff --git a/Oqtane.Server/Infrastructure/Middleware/JwtMiddleware.cs b/Oqtane.Server/Infrastructure/Middleware/JwtMiddleware.cs
index baba6085..f0e65998 100644
--- a/Oqtane.Server/Infrastructure/Middleware/JwtMiddleware.cs
+++ b/Oqtane.Server/Infrastructure/Middleware/JwtMiddleware.cs
@@ -45,12 +45,11 @@ namespace Oqtane.Infrastructure
                             };
                             // jwt already contains the roles - we are reloading to ensure most accurate permissions
                             var _userRoles = context.RequestServices.GetService(typeof(IUserRoleRepository)) as IUserRoleRepository;
-                            identity = UserSecurity.CreateClaimsIdentity(alias, user, _userRoles.GetUserRoles(user.UserId, alias.SiteId).ToList());
 
-                            // populate principal
-                            var principal = (ClaimsIdentity)context.User.Identity;
-                            UserSecurity.ResetClaimsIdentity(principal);
-                            principal.AddClaims(identity.Claims);
+                            // set claims identity
+                            var claimsidentity = UserSecurity.CreateClaimsIdentity(alias, user, _userRoles.GetUserRoles(user.UserId, alias.SiteId).ToList());
+                            context.User = new ClaimsPrincipal(claimsidentity);
+
                             logger.Log(alias.SiteId, LogLevel.Information, "TokenValidation", Enums.LogFunction.Security, "Token Validated For User {Username}", user.Username);
                         }
                         else
diff --git a/Oqtane.Server/Modules/HtmlText/Controllers/HtmlTextController.cs b/Oqtane.Server/Modules/HtmlText/Controllers/HtmlTextController.cs
index f269650b..730b9f33 100644
--- a/Oqtane.Server/Modules/HtmlText/Controllers/HtmlTextController.cs
+++ b/Oqtane.Server/Modules/HtmlText/Controllers/HtmlTextController.cs
@@ -84,7 +84,6 @@ namespace Oqtane.Modules.HtmlText.Controllers
         }
 
         // POST api/<controller>
-        [ValidateAntiForgeryToken]
         [HttpPost]
         [Authorize(Policy = PolicyNames.EditModule)]
         public Models.HtmlText Post([FromBody] Models.HtmlText htmlText)
@@ -104,7 +103,6 @@ namespace Oqtane.Modules.HtmlText.Controllers
         }
 
         // DELETE api/<controller>/5
-        [ValidateAntiForgeryToken]
         [HttpDelete("{id}/{moduleid}")]
         [Authorize(Policy = PolicyNames.EditModule)]
         public void Delete(int id, int moduleId)
diff --git a/Oqtane.Server/Oqtane.Server.csproj b/Oqtane.Server/Oqtane.Server.csproj
index fd28d904..427ff0e0 100644
--- a/Oqtane.Server/Oqtane.Server.csproj
+++ b/Oqtane.Server/Oqtane.Server.csproj
@@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
     <Configurations>Debug;Release</Configurations>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -11,7 +11,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <RootNamespace>Oqtane</RootNamespace>
@@ -36,6 +36,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="6.0.3" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="6.0.3" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.ViewFeatures" Version="2.2.0" />
     <PackageReference Include="Microsoft.Data.SqlClient" Version="4.1.0" />
     <PackageReference Include="Microsoft.Data.Sqlite.Core" Version="6.0.3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="6.0.3" />
diff --git a/Oqtane.Server/Pages/External.cshtml.cs b/Oqtane.Server/Pages/External.cshtml.cs
index 1bd23ac6..49c728f0 100644
--- a/Oqtane.Server/Pages/External.cshtml.cs
+++ b/Oqtane.Server/Pages/External.cshtml.cs
@@ -1,12 +1,14 @@
 using System.Net;
 using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Oqtane.Extensions;
 
 namespace Oqtane.Pages
 {
+    [AllowAnonymous]
+    [IgnoreAntiforgeryToken]
     public class ExternalModel : PageModel
     {
         public IActionResult OnGetAsync(string returnurl)
@@ -17,7 +19,7 @@ namespace Oqtane.Pages
             var providertype = HttpContext.GetSiteSettings().GetValue("ExternalLogin:ProviderType", "");
             if (providertype != "")
             {
-                    return new ChallengeResult(providertype, new AuthenticationProperties { RedirectUri = returnurl });
+                    return new ChallengeResult(providertype, new AuthenticationProperties { RedirectUri = returnurl + (returnurl.Contains("?") ? "&" : "?") + "reload=post" });
             }
             else
             {
@@ -25,5 +27,22 @@ namespace Oqtane.Pages
                 return new EmptyResult();
             }
         }
+
+        public IActionResult OnPostAsync(string returnurl)
+        {
+            if (returnurl == null)
+            {
+                returnurl = "";
+            }
+            if (!returnurl.StartsWith("/"))
+            {
+                returnurl = "/" + returnurl;
+            }
+
+            // remove reload parameter
+            returnurl = returnurl.ReplaceMultiple(new string[] { "?reload=post", "&reload=post" }, "");
+
+            return LocalRedirect(Url.Content("~" + returnurl));
+        }
     }
 }
diff --git a/Oqtane.Server/Pages/Login.cshtml.cs b/Oqtane.Server/Pages/Login.cshtml.cs
index 345a4bd8..40202a16 100644
--- a/Oqtane.Server/Pages/Login.cshtml.cs
+++ b/Oqtane.Server/Pages/Login.cshtml.cs
@@ -9,7 +9,6 @@ namespace Oqtane.Pages
     [AllowAnonymous]
     public class LoginModel : PageModel
     {
-
         private readonly UserManager<IdentityUser> _identityUserManager;
         private readonly SignInManager<IdentityUser> _identitySignInManager;
 
@@ -19,9 +18,9 @@ namespace Oqtane.Pages
             _identitySignInManager = identitySignInManager;
         }
 
-        public async Task<IActionResult> OnPostAsync(string username, string password, bool remember, string returnurl)
+         public async Task<IActionResult> OnPostAsync(string username, string password, bool remember, string returnurl)
         {
-            if (!string.IsNullOrEmpty(username) && !string.IsNullOrEmpty(password))
+            if (!User.Identity.IsAuthenticated && !string.IsNullOrEmpty(username) && !string.IsNullOrEmpty(password))
             {
                 bool validuser = false;
                 IdentityUser identityuser = await _identityUserManager.FindByNameAsync(username);
diff --git a/Oqtane.Server/Pages/Logout.cshtml.cs b/Oqtane.Server/Pages/Logout.cshtml.cs
index b33fefe3..0526c41c 100644
--- a/Oqtane.Server/Pages/Logout.cshtml.cs
+++ b/Oqtane.Server/Pages/Logout.cshtml.cs
@@ -1,11 +1,8 @@
-using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
-using Oqtane.Extensions;
 using Oqtane.Shared;
 
 namespace Oqtane.Pages
@@ -13,7 +10,7 @@ namespace Oqtane.Pages
     [Authorize]
     public class LogoutModel : PageModel
     {
-        public async Task<IActionResult> OnGetAsync(string returnurl)
+        public async Task<IActionResult> OnPostAsync(string returnurl)
         {
             await HttpContext.SignOutAsync(Constants.AuthenticationScheme);
 
diff --git a/Oqtane.Server/Pages/_Host.cshtml b/Oqtane.Server/Pages/_Host.cshtml
index 5c8fdb6e..394dd296 100644
--- a/Oqtane.Server/Pages/_Host.cshtml
+++ b/Oqtane.Server/Pages/_Host.cshtml
@@ -19,8 +19,8 @@
     <script src="js/loadjs.min.js"></script>
     <link rel="stylesheet" href="css/app.css" />
     @Html.Raw(Model.HeadResources)
-	<link id="app-stylesheet-page" rel="stylesheet" href="disabled.css" disabled />
-	<link id="app-stylesheet-module" rel="stylesheet" href="disabled.css" disabled />
+	<link id="app-stylesheet-page" rel="stylesheet" href="css/empty.css" disabled />
+	<link id="app-stylesheet-module" rel="stylesheet" href="css/empty.css" disabled />
 </head>
 <body>
 	@if (string.IsNullOrEmpty(Model.Message))
diff --git a/Oqtane.Server/Pages/_Host.cshtml.cs b/Oqtane.Server/Pages/_Host.cshtml.cs
index 20770472..58cdeb29 100644
--- a/Oqtane.Server/Pages/_Host.cshtml.cs
+++ b/Oqtane.Server/Pages/_Host.cshtml.cs
@@ -186,7 +186,6 @@ namespace Oqtane.Pages
                             {
                                 if (route.PagePath != "404")
                                 {
-                                    _logger.Log(LogLevel.Information, "Host", LogFunction.Other, "Page Path /{Path} Does Not Exist", route.PagePath);
                                     return RedirectPermanent(route.SiteUrl + "/404");
                                 }
                             }
diff --git a/Oqtane.Server/Repository/ModuleDefinitionRepository.cs b/Oqtane.Server/Repository/ModuleDefinitionRepository.cs
index 7086e4e9..26a6d231 100644
--- a/Oqtane.Server/Repository/ModuleDefinitionRepository.cs
+++ b/Oqtane.Server/Repository/ModuleDefinitionRepository.cs
@@ -159,6 +159,11 @@ namespace Oqtane.Repository
                     moduledefinition.Name = (!string.IsNullOrEmpty(moduledef.Name)) ? moduledef.Name : moduledefinition.Name;
                     moduledefinition.Description = (!string.IsNullOrEmpty(moduledef.Description)) ? moduledef.Description : moduledefinition.Description;
                     moduledefinition.Categories = (!string.IsNullOrEmpty(moduledef.Categories)) ? moduledef.Categories : moduledefinition.Categories;
+                    // manage releaseversions in cases where it was not provided or is lower than the module version
+                    if (string.IsNullOrEmpty(moduledefinition.ReleaseVersions) || Version.Parse(moduledefinition.Version).CompareTo(Version.Parse(moduledefinition.ReleaseVersions.Split(',').Last())) > 0)
+                    {
+                        moduledefinition.ReleaseVersions = moduledefinition.Version;
+                    }
                     moduledefinition.Version = moduledef.Version;
                     // remove module definition from list as it is already synced
                     moduledefs.Remove(moduledef);
diff --git a/Oqtane.Server/Repository/UserRoleRepository.cs b/Oqtane.Server/Repository/UserRoleRepository.cs
index ad4cb1d1..93acbe18 100644
--- a/Oqtane.Server/Repository/UserRoleRepository.cs
+++ b/Oqtane.Server/Repository/UserRoleRepository.cs
@@ -87,7 +87,7 @@ namespace Oqtane.Repository
 
         public void DeleteUserRoles(int userId)
         {
-            foreach (UserRole userRole in _db.UserRole.Where(item => item.Role.SiteId != null))
+            foreach (UserRole userRole in _db.UserRole.Where(item => item.UserId == userId && item.Role.SiteId != null))
             {
                 _db.UserRole.Remove(userRole);
             }
diff --git a/Oqtane.Server/Security/AutoValidateAntiforgeryTokenAttribute.cs b/Oqtane.Server/Security/AutoValidateAntiforgeryTokenAttribute.cs
new file mode 100644
index 00000000..56bf4991
--- /dev/null
+++ b/Oqtane.Server/Security/AutoValidateAntiforgeryTokenAttribute.cs
@@ -0,0 +1,19 @@
+using System;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Oqtane.Security
+{
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
+    public class AutoValidateAntiforgeryTokenAttribute : Attribute, IFilterFactory, IOrderedFilter
+    {
+        public int Order { get; set; } = 1000;
+
+        public bool IsReusable => true;
+
+        public IFilterMetadata CreateInstance(IServiceProvider serviceProvider)
+        {
+            return serviceProvider.GetRequiredService<AutoValidateAntiforgeryTokenFilter>();
+        }
+    }
+}
diff --git a/Oqtane.Server/Security/AutoValidateAntiforgeryTokenFilter.cs b/Oqtane.Server/Security/AutoValidateAntiforgeryTokenFilter.cs
new file mode 100644
index 00000000..9cbf466c
--- /dev/null
+++ b/Oqtane.Server/Security/AutoValidateAntiforgeryTokenFilter.cs
@@ -0,0 +1,64 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+
+namespace Oqtane.Security
+{
+    public class AutoValidateAntiforgeryTokenFilter : IAsyncAuthorizationFilter, IAntiforgeryPolicy
+    {
+        private readonly IAntiforgery _antiforgery;
+
+        public AutoValidateAntiforgeryTokenFilter(IAntiforgery antiforgery)
+        {
+            _antiforgery = antiforgery;
+        }
+
+        public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
+        {
+            if (context == null)
+            {
+                throw new ArgumentNullException(nameof(context));
+            }
+
+            if (!context.IsEffectivePolicy<IAntiforgeryPolicy>(this))
+            {
+                return;
+            }
+
+            if (ShouldValidate(context))
+            {
+                try
+                {
+                    await _antiforgery.ValidateRequestAsync(context.HttpContext);
+                }
+                catch
+                {
+                    context.Result = new AntiforgeryValidationFailedResult();
+                }
+            }
+        }
+
+        protected virtual bool ShouldValidate(AuthorizationFilterContext context)
+        {
+            // ignore antiforgery validation if a bearer token was provided
+            if (context.HttpContext.Request.Headers.ContainsKey("Authorization"))
+            {
+                return false;
+            }
+
+            // ignore antiforgery validation for GET, HEAD, TRACE, OPTIONS
+            var method = context.HttpContext.Request.Method;
+            if (HttpMethods.IsGet(method) || HttpMethods.IsHead(method) || HttpMethods.IsTrace(method) || HttpMethods.IsOptions(method))
+            {
+                return false;
+            }
+
+            // everything else requires antiforgery validation (ie. POST, PUT, DELETE)
+            return true;
+        }
+    }
+}
diff --git a/Oqtane.Server/Security/PrincipalValidator.cs b/Oqtane.Server/Security/PrincipalValidator.cs
index 787afce0..5a15a2b2 100644
--- a/Oqtane.Server/Security/PrincipalValidator.cs
+++ b/Oqtane.Server/Security/PrincipalValidator.cs
@@ -50,15 +50,15 @@ namespace Oqtane.Security
                                 else
                                 {
                                     // user has no roles - remove principal
-                                    context.RejectPrincipal();
                                     Log(_logger, alias, "Permissions Removed For User {Username} Accessing {Url}", context.Principal.Identity.Name, path);
+                                    context.RejectPrincipal();
                                 }
                             }
                             else
                             {
                                 // user does not exist - remove principal
-                                context.RejectPrincipal();
                                 Log(_logger, alias, "Permissions Removed For User {Username} Accessing {Url}", context.Principal.Identity.Name, path);
+                                context.RejectPrincipal();
                             }
                         }
                     }
diff --git a/Oqtane.Server/Startup.cs b/Oqtane.Server/Startup.cs
index c1a2aeb2..6eeafb3e 100644
--- a/Oqtane.Server/Startup.cs
+++ b/Oqtane.Server/Startup.cs
@@ -99,7 +99,6 @@ namespace Oqtane
                 options.Cookie.Name = Constants.AntiForgeryTokenCookieName;
                 options.Cookie.SameSite = SameSiteMode.Strict;
                 options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
-                //options.Cookie.HttpOnly = false;
             });
 
             services.AddIdentityCore<IdentityUser>(options => { })
@@ -114,6 +113,7 @@ namespace Oqtane
                 {
                     options.DefaultAuthenticateScheme = Constants.AuthenticationScheme;
                     options.DefaultChallengeScheme = Constants.AuthenticationScheme;
+                    options.DefaultSignOutScheme = Constants.AuthenticationScheme;
                 })
                 .AddCookie(Constants.AuthenticationScheme)
                 .AddOpenIdConnect(AuthenticationProviderTypes.OpenIDConnect, options => { })
@@ -128,10 +128,13 @@ namespace Oqtane
 
             services.AddOqtaneAuthorizationPolicies();
 
-            services.AddMvc()
-                .AddNewtonsoftJson()
-                .AddOqtaneApplicationParts() // register any Controllers from custom modules
-                .ConfigureOqtaneMvc(); // any additional configuration from IStartup classes
+            services.AddMvc(options =>
+            {
+                options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
+            })
+            .AddNewtonsoftJson()
+            .AddOqtaneApplicationParts() // register any Controllers from custom modules
+            .ConfigureOqtaneMvc(); // any additional configuration from IStartup classes
 
             services.AddSwaggerGen(options =>
             {
@@ -161,7 +164,7 @@ namespace Oqtane
             // execute any IServerStartup logic
             app.ConfigureOqtaneAssemblies(env);
 
-            // Allow oqtane localization middleware
+            // allow oqtane localization middleware
             app.UseOqtaneLocalization();
 
             app.UseHttpsRedirection();
diff --git a/Oqtane.Server/web.Release.config b/Oqtane.Server/web.Release.config
deleted file mode 100644
index 12d5a006..00000000
--- a/Oqtane.Server/web.Release.config
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-
-<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
-    <location>
-        <system.webServer>
-            <modules xdt:Transform="InsertIfMissing">
-                <remove name="WebDAVModule" xdt:Transform="InsertIfMissing"/>
-            </modules>
-            <handlers xdt:Transform="InsertIfMissing">
-                <remove name="WebDAV" xdt:Transform="InsertIfMissing" />
-            </handlers>
-        </system.webServer>
-    </location>
-</configuration>
diff --git a/Oqtane.Server/wwwroot/Modules/Oqtane.Showcase/screenshot.png b/Oqtane.Server/wwwroot/Modules/Oqtane.Showcase/screenshot.png
deleted file mode 100644
index febc733b..00000000
Binary files a/Oqtane.Server/wwwroot/Modules/Oqtane.Showcase/screenshot.png and /dev/null differ
diff --git a/Oqtane.Server/wwwroot/Modules/Templates/External/Server/Controllers/[Module]Controller.cs b/Oqtane.Server/wwwroot/Modules/Templates/External/Server/Controllers/[Module]Controller.cs
index 15d2c514..3cb8fed1 100644
--- a/Oqtane.Server/wwwroot/Modules/Templates/External/Server/Controllers/[Module]Controller.cs
+++ b/Oqtane.Server/wwwroot/Modules/Templates/External/Server/Controllers/[Module]Controller.cs
@@ -58,7 +58,6 @@ namespace [Owner].[Module].Controllers
         }
 
         // POST api/<controller>
-        [ValidateAntiForgeryToken]
         [HttpPost]
         [Authorize(Policy = PolicyNames.EditModule)]
         public Models.[Module] Post([FromBody] Models.[Module] [Module])
@@ -78,7 +77,6 @@ namespace [Owner].[Module].Controllers
         }
 
         // PUT api/<controller>/5
-        [ValidateAntiForgeryToken]
         [HttpPut("{id}")]
         [Authorize(Policy = PolicyNames.EditModule)]
         public Models.[Module] Put(int id, [FromBody] Models.[Module] [Module])
@@ -98,7 +96,6 @@ namespace [Owner].[Module].Controllers
         }
 
         // DELETE api/<controller>/5
-        [ValidateAntiForgeryToken]
         [HttpDelete("{id}")]
         [Authorize(Policy = PolicyNames.EditModule)]
         public void Delete(int id)
diff --git a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.MySQL.nupkg.bak b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.MySQL.nupkg.bak
index 79ce9c30..27f6229f 100644
Binary files a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.MySQL.nupkg.bak and b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.MySQL.nupkg.bak differ
diff --git a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.PostgreSQL.nupkg.bak b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.PostgreSQL.nupkg.bak
index 1f732d4a..36d89a51 100644
Binary files a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.PostgreSQL.nupkg.bak and b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.PostgreSQL.nupkg.bak differ
diff --git a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.SqlServer.nupkg.bak b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.SqlServer.nupkg.bak
index 28549828..fb1f5299 100644
Binary files a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.SqlServer.nupkg.bak and b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.SqlServer.nupkg.bak differ
diff --git a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.Sqlite.nupkg.bak b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.Sqlite.nupkg.bak
index 1319cf60..ea4fa461 100644
Binary files a/Oqtane.Server/wwwroot/Packages/Oqtane.Database.Sqlite.nupkg.bak and b/Oqtane.Server/wwwroot/Packages/Oqtane.Database.Sqlite.nupkg.bak differ
diff --git a/Oqtane.Server/wwwroot/css/disabled.css b/Oqtane.Server/wwwroot/css/empty.css
similarity index 100%
rename from Oqtane.Server/wwwroot/css/disabled.css
rename to Oqtane.Server/wwwroot/css/empty.css
diff --git a/Oqtane.Shared/Oqtane.Shared.csproj b/Oqtane.Shared/Oqtane.Shared.csproj
index 051f4f6a..93d68ad7 100644
--- a/Oqtane.Shared/Oqtane.Shared.csproj
+++ b/Oqtane.Shared/Oqtane.Shared.csproj
@@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
     <Configurations>Debug;Release</Configurations>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -11,7 +11,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <RootNamespace>Oqtane</RootNamespace>
diff --git a/Oqtane.Shared/Security/UserSecurity.cs b/Oqtane.Shared/Security/UserSecurity.cs
index 70f43f55..1830765f 100644
--- a/Oqtane.Shared/Security/UserSecurity.cs
+++ b/Oqtane.Shared/Security/UserSecurity.cs
@@ -152,29 +152,5 @@ namespace Oqtane.Security
             }
             return identity;
         }
-
-        public static void ResetClaimsIdentity(ClaimsIdentity identity)
-        {
-            var claim = identity.Claims.FirstOrDefault(item => item.Type == ClaimTypes.Name);
-            if (claim != null)
-            {
-                identity.RemoveClaim(claim);
-            }
-            claim = identity.Claims.FirstOrDefault(item => item.Type == ClaimTypes.NameIdentifier);
-            if (claim != null)
-            {
-                identity.RemoveClaim(claim);
-            }
-            claim = identity.Claims.FirstOrDefault(item => item.Type == "sitekey");
-            if (claim != null)
-            {
-                identity.RemoveClaim(claim);
-            }
-            var roles = identity.Claims.Where(item => item.Type == ClaimTypes.Role);
-            foreach (var role in roles)
-            {
-                identity.RemoveClaim(role);
-            }
-        }
     }
 }
diff --git a/Oqtane.Shared/Shared/Constants.cs b/Oqtane.Shared/Shared/Constants.cs
index f71849d1..fcf2bb21 100644
--- a/Oqtane.Shared/Shared/Constants.cs
+++ b/Oqtane.Shared/Shared/Constants.cs
@@ -4,8 +4,8 @@ namespace Oqtane.Shared
 {
     public class Constants
     {
-        public static readonly string Version = "3.1.0";
-        public const string ReleaseVersions = "1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,2.0.0,2.0.1,2.0.2,2.1.0,2.2.0,2.3.0,2.3.1,3.0.0,3.0.1,3.0.2,3.0.3,3.1.0";
+        public static readonly string Version = "3.1.1";
+        public const string ReleaseVersions = "1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,2.0.0,2.0.1,2.0.2,2.1.0,2.2.0,2.3.0,2.3.1,3.0.0,3.0.1,3.0.2,3.0.3,3.1.0,3.1.1";
         public const string PackageId = "Oqtane.Framework";
         public const string UpdaterPackageId = "Oqtane.Updater";
         public const string PackageRegistryUrl = "https://www.oqtane.net";
diff --git a/Oqtane.Shared/Shared/ExternalLoginStatus.cs b/Oqtane.Shared/Shared/ExternalLoginStatus.cs
new file mode 100644
index 00000000..aec49985
--- /dev/null
+++ b/Oqtane.Shared/Shared/ExternalLoginStatus.cs
@@ -0,0 +1,13 @@
+namespace Oqtane.Shared {
+    public class ExternalLoginStatus {
+        public const string Success = "Success";
+        public const string InvalidEmail = "InvalidEmail";
+        public const string DuplicateEmail = "DuplicateEmail";
+        public const string UserNotCreated = "UserNotCreated";
+        public const string UserDoesNotExist = "UserDoesNotExist";
+        public const string ProviderKeyMismatch = "ProviderKeyMismatch";
+        public const string VerificationRequired = "VerificationRequired";
+        public const string AccessDenied = "AccessDenied";
+        public const string RemoteFailure = "RemoteFailure";
+    }
+}
diff --git a/Oqtane.Test/Oqtane.Test.csproj b/Oqtane.Test/Oqtane.Test.csproj
index 18a04168..d1c49118 100644
--- a/Oqtane.Test/Oqtane.Test.csproj
+++ b/Oqtane.Test/Oqtane.Test.csproj
@@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
     <Configurations>Debug;Release</Configurations>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -11,7 +11,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <RootNamespace>Oqtane</RootNamespace>
diff --git a/Oqtane.Updater/Oqtane.Updater.csproj b/Oqtane.Updater/Oqtane.Updater.csproj
index 497f0ff4..0f9127d7 100644
--- a/Oqtane.Updater/Oqtane.Updater.csproj
+++ b/Oqtane.Updater/Oqtane.Updater.csproj
@@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
     <OutputType>Exe</OutputType>
-    <Version>3.1.0</Version>
+    <Version>3.1.1</Version>
     <Product>Oqtane</Product>
     <Authors>Shaun Walker</Authors>
     <Company>.NET Foundation</Company>
@@ -11,7 +11,7 @@
     <Copyright>.NET Foundation</Copyright>
     <PackageProjectUrl>https://www.oqtane.org</PackageProjectUrl>
     <PackageLicenseUrl>https://github.com/oqtane/oqtane.framework/blob/dev/LICENSE</PackageLicenseUrl>
-    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.0</PackageReleaseNotes>
+    <PackageReleaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v3.1.1</PackageReleaseNotes>
     <RepositoryUrl>https://github.com/oqtane/oqtane.framework</RepositoryUrl>
     <RepositoryType>Git</RepositoryType>
     <RootNamespace>Oqtane</RootNamespace>
diff --git a/README.md b/README.md
index 407c2f80..ebd5e113 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ This project is open source, and therefore is a work in progress...
 Backlog (Not Yet Assigned)
 - [ ] Allow language specification in Url (#1731)
 
-V.3.1.0 ( April 2022 )
+V.3.1.0 ( April 5, 2022 )
 - [x] User account lockout support
 - [x] Two factor authentication support
 - [x] Per-site configuration of password complexity, lockout criteria
@@ -73,6 +73,7 @@ V.3.1.0 ( April 2022 )
 - [x] Event log notifications  
 - [x] 404 page handling
 - [x] Property change component notifications
+- [x] Support for ES6 JavaScript modules
 
 
 V.3.0.3 ( Feb 15, 2022 )