Certain controller methods are shared with oauth-based logins, and these have been moved to a concern.