From bea8b1162cdbf09fedaaee2d1faa2f7c6f35fcc5 Mon Sep 17 00:00:00 2001
From: Dante Soares <dante.m.soares@rice.edu>
Date: Fri, 18 Oct 2024 16:39:59 -0500
Subject: [PATCH] Ruby 3 (#1260)

* Updated gems for ruby 3

* Rails 6 update (still need to do something about rails-settings-cached and railssettings-ui)

* Removed rails-settings-ui but kept rails-settings-cached

* Updated to Rails 6.1, updated gems, fixed most warnings

* Updated config to 6.1, fixed more warnings

* Updated more gems, restored missing access policies inside an after_initialize block

* Fixed a bunch of tests, removed render_anywhere

* Fix settings and manifest again

* Removed spring, removed some legacy tests, fixed database cleaner config

* More test fixes

* Fixed more tests

* Added migration for the Doorkeeper update

* Update the Doorkeeper tokens and grants in batches

* Fixed a bunch more tests

* Fixed more tests, updated openstax_rescue_from

* Updated lev, transaction_retry and transaction_isolation to fix more test errors

* Fixed remaining tests, normalize describe calls, include ActiveJob::TestHelper everywhere

* Added comment about Newflow vs legacy behavior

* Attempt to fix bundler error in GH actions

* Lock ffi since the latest version has some issue in GH actions

* Attempt to fix popup console test

* Puma's nakayoshi_fork option was removed

* Fix puma crash on OS X

* Make belongs_to required by default

* Attempt to fix migration test when updating ruby version

* Moved puma config around to prevent warning, re-enabled spring, unlocked compass-rails version

* Added comment about gssencmode

* Removed spring config that's no longer needed

* Updated web-console gem, simplified ErrorPageBuilder

* Fix error page precompilation in non-prod

* Make RescueFrom config match Rails app config for errors
Make sure to disable dev routes in prod

* Don't ignore rescue_from by default in the test env

* Removed is_real_production?, moved the check to the OSU initializer

* Added rexml gem to Gemfile

* Update to ruby 3.1 but keep Psych 3 for now
---
 .github/workflows/migrations.yml              |   7 +-
 .github/workflows/tests.yml                   |   2 +-
 .ruby-version                                 |   2 +-
 Gemfile                                       |  68 +-
 Gemfile.lock                                  | 846 ++++++++++--------
 Rakefile                                      |   2 +-
 app/controllers/admin/users_controller.rb     |   2 +-
 app/controllers/api/v1/users_controller.rb    |  18 +-
 app/controllers/legacy/users_controller.rb    |   2 +-
 app/controllers/newflow/login_controller.rb   |   2 +-
 app/controllers/newflow/signup_controller.rb  |   3 +
 .../oauth/applications_controller.rb          |  14 +-
 app/handlers/signup_start.rb                  |   2 +-
 app/models/application_user.rb                |   4 +-
 app/models/contact_info.rb                    |   1 -
 app/models/email_address.rb                   |   6 -
 app/models/message.rb                         |   3 +-
 app/models/message_recipient.rb               |   2 +-
 app/models/pre_auth_state.rb                  |   2 -
 app/models/user.rb                            |   5 +-
 app/routines/newflow/create_email_for_user.rb |   4 -
 .../newflow/ensure_unverified_user.rb         |   2 +-
 app/routines/transfer_authentications.rb      |   4 +-
 app/views/faculty_access/apply.html.erb       |  12 +-
 app/views/layouts/admin.html.erb              |   2 -
 app/views/legacy/identities/_set.html.erb     |   8 +-
 .../sessions/_authenticate_options.html.erb   |   2 +-
 app/views/legacy/sessions/start.html.erb      |   8 +-
 app/views/legacy/signup/password.html.erb     |   6 +-
 app/views/legacy/signup/profile.html.erb      |  10 +-
 app/views/legacy/signup/start.html.erb        |   8 +-
 app/views/legacy/signup/verify_email.html.erb |   2 +-
 bin/rails                                     |   5 +-
 bin/rake                                      |   5 +-
 bin/setup                                     |  15 +-
 bin/spring                                    |  21 +-
 bin/update                                    |   0
 config.ru                                     |   3 +-
 config/app.yml                                | 112 ---
 config/application.rb                         |  62 +-
 config/boot.rb                                |   3 +-
 config/cable.yml                              |   2 +-
 config/database.yml                           |   1 +
 config/environment.rb                         |  11 +-
 config/environments/development.rb            |  25 +-
 config/environments/production.rb             | 114 ++-
 config/environments/test.rb                   |  51 +-
 .../{04-debugger.rb => 1-debugger.rb}         |   4 +-
 .../{constants.rb => 2-constants.rb}          |   9 +-
 .../{05-settings.rb => 3-settings.rb}         |   0
 config/initializers/4-accounts.rb             |   6 +
 config/initializers/access_policies.rb        |  33 +-
 config/initializers/action_mailer.rb          |  20 +-
 config/initializers/active_job.rb             |   2 +
 config/initializers/apipie.rb                 |   5 +-
 .../application_controller_renderer.rb        |   8 +
 config/initializers/assets.rb                 |   6 +-
 config/initializers/backtrace_silencers.rb    |   7 +-
 config/initializers/cache_store.rb            |  14 +
 .../initializers/content_security_policy.rb   |  28 +
 config/initializers/controllers.rb            | 170 ++--
 config/initializers/cors.rb                   |  14 +-
 config/initializers/doorkeeper.rb             |   2 +-
 config/initializers/exceptions.rb             |   5 +
 .../initializers/filter_parameter_logging.rb  |   4 +-
 config/initializers/i18n.rb                   |   3 +
 config/initializers/inflections.rb            |   2 +-
 config/initializers/lev.rb                    |   8 +-
 config/initializers/openstax_utilities.rb     |   5 +-
 config/initializers/permissions_policy.rb     |  11 +
 config/initializers/rails_settings_ui.rb      |  30 -
 config/initializers/rescue_from.rb            |  17 +-
 config/initializers/wrap_parameters.rb        |   4 +-
 config/locales/activerecord.en.yml            |   4 +-
 config/locales/activerecord.pl.yml            |   4 +-
 config/locales/doorkeeper.en.yml              |  11 +-
 config/locales/en.yml                         |  68 +-
 config/locales/pl.yml                         |   3 +-
 config/puma.rb                                |  66 +-
 config/routes.rb                              |   6 +-
 config/spring.rb                              |  12 +-
 ..._attachments_for_blob_id.active_storage.rb |  10 +
 ..._to_active_storage_blobs.active_storage.rb |  22 +
 ..._storage_variant_records.active_storage.rb |  27 +
 .../20241015172425_set_doorkeeper_scopes.rb   |  23 +
 db/schema.rb                                  |  16 +-
 lib/error_page_builder.rb                     |  12 +-
 lib/json_serialize.rb                         |   2 +-
 lib/settings.rb                               | 137 ++-
 lib/sso_cookie_jar.rb                         |   6 +-
 lib/user_session_management.rb                |   2 +-
 .../contact_info_access_policy_spec.rb        |   2 +-
 .../external_id_access_policy_spec.rb         |  18 +-
 .../identity_access_policy_spec.rb            |   2 +-
 .../user_access_policy_spec.rb                |   2 +-
 ...can_be_set_if_the_Contact_exists_in_SF.yml |   2 +-
 .../works_on_the_happy_path.yml               |   4 +-
 .../admin/contact_infos_controller_spec.rb    |   2 +-
 .../admin/external_ids_controller_spec.rb     |   2 +-
 .../admin/pre_auth_states_controller_spec.rb  |   2 +-
 .../admin/reports_controller_spec.rb          |   2 +-
 .../admin/security_logs_controller_spec.rb    |   2 +-
 .../admin/users_controller_spec.rb            |   2 +-
 .../v1/application_groups_controller_spec.rb  |   2 +-
 .../v1/application_users_controller_spec.rb   |   2 +-
 .../api/v1/contact_infos_controller_spec.rb   |   2 +-
 .../api/v1/messages_controller_spec.rb        |   3 +-
 .../api/v1/users_controller_spec.rb           |   2 +-
 .../application_controller_spec.rb            |   2 +-
 .../contact_infos_controller_spec.rb          |   2 +-
 spec/controllers/controllers_spec.rb          |   2 +-
 .../authorizations_controller_spec.rb         |  16 +-
 ...ternal_user_credentials_controller_spec.rb |   2 +-
 .../faculty_access_controller_spec.rb         |   2 +-
 .../educator_signup_controller_spec.rb        |   2 +-
 .../newflow/login_controller_spec.rb          |   8 +-
 .../password_management_controller_spec.rb    |   2 +-
 .../newflow/signup_controller_spec.rb         |   2 +-
 .../newflow/social_auth_controller_spec.rb    |   2 +-
 .../newflow/student_signup_controller_spec.rb |   2 +-
 spec/controllers/other_controller_spec.rb     |   2 +-
 spec/controllers/terms_controller_spec.rb     |   2 +-
 spec/delayed/worker_spec.rb                   |   2 +-
 spec/factories/doorkeeper_access_grant.rb     |   3 +-
 spec/factories/doorkeeper_access_token.rb     |   1 +
 spec/factories/message.rb                     |   3 +-
 spec/factories/sheerid_verification.rb        |   2 +-
 spec/features/add_application_spec.rb         |   3 +-
 ...change_salesforce_contact_manually_spec.rb |   5 +-
 spec/features/admin/create_banners_spec.rb    |   3 +-
 .../admin/oauth_application_crud_spec.rb      |   3 +-
 spec/features/admin/reports_spec.rb           |   3 +-
 spec/features/admin/settings_spec.rb          |  21 -
 spec/features/admin/users_spec.rb             |   4 +-
 spec/features/cache_headers_spec.rb           |   4 +-
 spec/features/log_out_inactive_admins_spec.rb |  14 +-
 ...ing_and_resetting_password_from_profile.rb |   4 +-
 .../newflow/educator_signup_flow_spec.rb      |  10 +-
 ..._sign_in_to_change_authentications_spec.rb |   4 +-
 spec/features/newflow/reset_password_spec.rb  |  14 +-
 .../newflow/student_login_flow_spec.rb        |  18 +-
 .../newflow/student_signup_flow_spec.rb       |  63 +-
 .../newflow/user_cant_sign_in_spec.rb         |  12 +-
 .../newflow/user_claims_account_spec.rb       |   1 +
 ...r_login_signup_with_social_network_spec.rb |  10 +-
 .../newflow/user_manages_emails_spec.rb       |   4 +
 .../newflow/user_updates_password_spec.rb     |   2 +-
 spec/features/pose_terms_spec.rb              |   4 +-
 spec/features/rate_limit_sign_ins_spec.rb     |  30 +-
 .../remove_accounts_path_prefix_spec.rb       |  20 +-
 .../user_profile_management/README.md         |   3 -
 .../add_social_auth_spec.rb                   |  67 --
 ..._sign_in_to_change_authentications_spec.rb | 127 ---
 .../user_updates_password_spec.rb             |  64 --
 .../user_updates_profile_spec.rb              |  52 --
 .../contact_infos_resend_confirmation_spec.rb |   5 +-
 .../create_external_user_credentials_spec.rb  |   8 +-
 spec/handlers/messages_create_spec.rb         |   3 +-
 .../newflow/change_signup_email_spec.rb       |   5 +-
 .../newflow/confirm_oauth_info_spec.rb        |   4 +-
 .../educator_signup/sheerid_webhook_spec.rb   |   4 +-
 .../educator_signup/signup_form_spec.rb       |   8 +-
 .../student_signup/signup_form_spec.rb        |   8 +-
 spec/handlers/oauth_callback_spec.rb          |   2 +-
 .../send_reset_password_email_spec.rb         |   2 +
 spec/handlers/sessions_create_spec.rb         |   2 +-
 spec/handlers/signup_password_spec.rb         |   2 +-
 .../signup_profile_instructor_spec.rb         |   2 +-
 spec/handlers/signup_profile_other_spec.rb    |   2 +-
 spec/handlers/signup_profile_student_spec.rb  |   2 +-
 .../newflow/login_signup_helper_spec.rb       |   2 +-
 spec/lib/authenticate_methods_spec.rb         |   2 +-
 spec/lib/domain_mx_validator_spec.rb          |   2 +-
 .../json_and_string_parameter_filter_spec.rb  |   2 +-
 spec/lib/sheerid_api_spec.rb                  |   2 +-
 spec/lib/sso_cookie_jar_spec.rb               |   2 +-
 .../lib/tasks/doorkeeper/cleanup_rake_spec.rb |   2 +-
 ...s_info_to_match_with_consent_forms_spec.rb |   2 +-
 .../export_users_last_login_date_spec.rb      |   2 +-
 spec/lib/user_session_management_spec.rb      |   6 +-
 spec/mailers/exception_spec.rb                |   2 +-
 spec/models/authentication_spec.rb            |  34 +-
 spec/models/banner_spec.rb                    |   2 +-
 spec/models/contact_info_spec.rb              |   2 +-
 spec/models/doorkeeper/application_spec.rb    |   2 +-
 spec/models/external_id_spec.rb               |   2 +-
 spec/models/school_spec.rb                    |   2 +-
 spec/models/security_log_spec.rb              |   4 +-
 spec/models/sequential_failure_spec.rb        |   2 +-
 spec/models/user_external_uuid_spec.rb        |   2 +-
 spec/models/user_spec.rb                      |  11 +-
 spec/rails_helper.rb                          |   4 +-
 .../api/v1/external_id_representer_spec.rb    |   2 +-
 .../api/v1/find_user_representer_spec.rb      |   2 +-
 .../api/v1/user_representer_spec.rb           |   2 +-
 .../api/v1/application_users_requests_spec.rb |   6 +-
 spec/requests/api/v1/cache_header_spec.rb     |   2 +-
 spec/requests/api/v1/device_id_spec.rb        |   3 +-
 spec/routines/admin/export_users_spec.rb      |   2 +-
 spec/routines/admin/import_users_spec.rb      |   2 +-
 .../admin/search_security_log_spec.rb         |   2 +-
 spec/routines/admin/search_users_spec.rb      |   2 +-
 spec/routines/find_or_create_user_spec.rb     |   2 +-
 .../mark_contact_info_verified_spec.rb        |   2 +-
 .../create_or_update_salesforce_lead_spec.rb  |   2 +-
 .../routines/search_application_users_spec.rb |   2 +-
 spec/routines/search_users_spec.rb            |   4 +-
 .../send_contact_info_confirmation_spec.rb    |   7 +
 .../routines/transfer_authentications_spec.rb |   3 +-
 spec/routines/transfer_omniauth_data_spec.rb  |   2 +-
 spec/routines/transfer_pre_auth_state_spec.rb |   2 +-
 ...pdate_salesforce_assignable_fields_spec.rb |   2 +-
 .../update_school_salesforce_info_spec.rb     |   2 +-
 .../routines/user_from_pre_auth_state_spec.rb |   2 +-
 spec/routing/contact_infos_routing_spec.rb    |   2 +-
 .../external_user_credentials_routing_spec.rb |   2 +-
 spec/routing/users_routing_spec.rb            |   2 +-
 spec/spec_helper.rb                           |  34 +-
 spec/support/feature_helpers.rb               |   2 +-
 spec/support/i18n.rb                          |   4 +-
 spec/support/newflow_feature_helpers.rb       |  10 +-
 spec/whenever_spec.rb                         |   2 +-
 222 files changed, 1617 insertions(+), 1670 deletions(-)
 mode change 100644 => 100755 bin/update
 delete mode 100644 config/app.yml
 rename config/initializers/{04-debugger.rb => 1-debugger.rb} (84%)
 rename config/initializers/{constants.rb => 2-constants.rb} (89%)
 rename config/initializers/{05-settings.rb => 3-settings.rb} (100%)
 create mode 100644 config/initializers/4-accounts.rb
 create mode 100644 config/initializers/active_job.rb
 create mode 100644 config/initializers/application_controller_renderer.rb
 create mode 100644 config/initializers/cache_store.rb
 create mode 100644 config/initializers/content_security_policy.rb
 create mode 100644 config/initializers/exceptions.rb
 create mode 100644 config/initializers/i18n.rb
 create mode 100644 config/initializers/permissions_policy.rb
 delete mode 100644 config/initializers/rails_settings_ui.rb
 create mode 100644 db/migrate/20241004201505_add_foreign_key_constraint_to_active_storage_attachments_for_blob_id.active_storage.rb
 create mode 100644 db/migrate/20241008205807_add_service_name_to_active_storage_blobs.active_storage.rb
 create mode 100644 db/migrate/20241008205808_create_active_storage_variant_records.active_storage.rb
 create mode 100644 db/migrate/20241015172425_set_doorkeeper_scopes.rb
 delete mode 100644 spec/features/admin/settings_spec.rb
 delete mode 100644 spec/features/user_profile_management/README.md
 delete mode 100644 spec/features/user_profile_management/add_social_auth_spec.rb
 delete mode 100644 spec/features/user_profile_management/require_recent_sign_in_to_change_authentications_spec.rb
 delete mode 100644 spec/features/user_profile_management/user_updates_password_spec.rb
 delete mode 100644 spec/features/user_profile_management/user_updates_profile_spec.rb

diff --git a/.github/workflows/migrations.yml b/.github/workflows/migrations.yml
index b256b75d81..87daadf9b8 100644
--- a/.github/workflows/migrations.yml
+++ b/.github/workflows/migrations.yml
@@ -40,7 +40,7 @@ jobs:
 
       - run: git checkout HEAD^
 
-      # Install ruby
+      # Install base commit ruby version
       - uses: ruby/setup-ruby@v1
         with:
           bundler-cache: true
@@ -56,6 +56,11 @@ jobs:
           bundle exec rails runner '3.times { FactoryBot.create :user }'
           git checkout --force -
 
+      # Install PR ruby version
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
       # Migrate the data
       - name: Migrate
         env:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 25525e2aa6..8e2dc73f06 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -39,4 +39,4 @@ jobs:
         run: |
           bundle install --jobs 4 --retry 3
           bundle exec rake parallel:create parallel:load_schema parallel:seed --trace
-          bundle exec rspec ./spec
+          WORKERS=4 bundle exec rake parallel:spec
diff --git a/.ruby-version b/.ruby-version
index a4dd9dba4f..9cec7165ab 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.7.4
+3.1.6
diff --git a/Gemfile b/Gemfile
index dc10ed774a..94ac8c47da 100644
--- a/Gemfile
+++ b/Gemfile
@@ -6,8 +6,12 @@ git_source(:github) do |repo_name|
 end
 
 # Rails framework
-gem 'rails', '~> 5.2'
-gem 'rails-i18n', '~> 5'
+gem 'rails', '6.1.7.8'
+gem 'rails-i18n'
+
+# Psych 4 (included in Ruby 3.1) breaks Rails < 7
+# Remove this entry completely when updating to Rails 7
+gem 'psych', '< 4'
 
 # Reduces boot times through caching; required in config/boot.rb
 gem 'bootsnap', require: false
@@ -16,7 +20,7 @@ gem 'bootsnap', require: false
 gem 'dotenv-rails'
 
 # Threaded application server
-gem 'puma', '~> 5.6.0'
+gem 'puma'
 
 # Prevent server memory from growing until OOM
 gem 'puma_worker_killer'
@@ -29,35 +33,40 @@ gem 'pattern-library', git: 'https://github.com/openstax/pattern-library.git', r
 
 # Lev framework
 # - introduces two new concepts: Routines and Handlers
-gem 'lev', '~> 10.1.0'
-
-# Bootstrap front-end framework
-gem 'bootstrap-sass', '~> 3.4.1'
+gem 'lev', github: 'lml/lev', ref: 'a33c93c83afea63c80b5da6317efec4bfd357df5'
+gem 'openstax_transaction_retry', github: 'openstax/transaction_retry', ref: '36e26d0a068756c334b9d1c671d40773bbfc9300'
+gem 'openstax_transaction_isolation', github: 'openstax/transaction_isolation', ref: '7387fa091462118704967a7c4b2821cd0f5d9e01'
 
 # SCSS stylesheets
-gem 'sass-rails', '~> 5.0'
+gem 'sass-rails'
+
+# Bootstrap front-end framework
+gem 'bootstrap-sass'
 
 # Compass stylesheets
-gem 'compass-rails', '~> 3.1.0'
+gem 'compass-rails'
+
+# Prevent deprecation warning coming from Compass in Sass 3.4.20
+gem 'sass', '3.4.19'
+gem 'ffi', '< 1.17'
 
 # CoffeeScript for .js.coffee assets and views
-gem 'coffee-rails', '5.0.0'
+gem 'coffee-rails'
 
 # JavaScript asset compiler
 gem 'mini_racer'
 
 # JavaScript asset compressor
-gem 'uglifier', '>= 1.3.0'
+gem 'uglifier'
 
 # Nicely-styled static error pages
 gem 'error_page_assets'
-gem 'render_anywhere', require: false
 
 # Password hashing
-gem 'bcrypt', '~> 3.1.7'
+gem 'bcrypt'
 
 # OAuth provider
-gem 'doorkeeper', '~> 5.1.0'
+gem 'doorkeeper'
 
 # OAuth clients
 gem 'omniauth', '~> 1.9'
@@ -97,6 +106,7 @@ gem 'smarter_csv'
 # API documentation
 gem 'apipie-rails'
 gem 'maruku'
+gem 'rexml'
 
 gem 'jbuilder'
 
@@ -110,13 +120,13 @@ gem 'delayed_job_worker_pool'
 gem 'delayed_job_heartbeat_plugin'
 
 # JSON Api builder
-gem 'representable', '~> 3.0.0'
+gem 'representable'
 
 # Keyword search
 gem 'keyword_search', '~> 1.5.0'
 
 # ToS/PP management
-gem 'fine_print'
+gem 'fine_print', github: 'lml/fine_print', ref: '636023f68e95196dffaf295bfad3ad8051c23542'
 
 # Send users back to the correct page after login
 gem 'action_interceptor'
@@ -151,16 +161,13 @@ gem 'awesome_print'
 gem 'whenever', require: false
 
 # Admin toggles
-gem 'rails-settings-ui'
-
-gem 'rails-settings-cached', '0.7.2'
-gem 'dry-validation', '0.12.3'
+gem 'rails-settings-cached'
 
 # Respond to ELB healthchecks in /ping and /ping/
 gem 'openstax_healthcheck'
 
 # Allow Accounts routes to be accessed under an /accounts prefix (for use in CloudFront)
-gem "openstax_path_prefixer", github: "openstax/path_prefixer", ref: "8298c40ec38f132fc23ea946b2b20e855fe73a49"
+gem 'openstax_path_prefixer', github: 'openstax/path_prefixer', ref: 'e3edfc70589bc90fcffba63b417260a88c1377d7'
 
 # JWE library used by the SSO cookie
 gem 'json-jwt'
@@ -172,7 +179,7 @@ gem 'intl-tel-input-rails', git: 'https://github.com/openstax/intl-tel-input-rai
 gem 'http_accept_language'
 
 # Fast JSON parsing
-gem 'oj', '~> 3.7.12'
+gem 'oj'
 
 # Replace JSON with Oj
 gem 'oj_mimic_json'
@@ -183,9 +190,6 @@ gem 'rack-cors'
 # Data visualization and query
 gem 'blazer'
 
-# temp fix until we update old dependencies
-# gem "net-http"
-
 group :development, :test do
   # Run specs in parallel
   gem 'parallel_tests'
@@ -197,9 +201,9 @@ group :development, :test do
   #
   # Call 'debugger' anywhere in the code to stop execution and get a debugger console
   gem 'byebug', require: false
-  # Debug in VS Code
-  gem 'ruby-debug-ide', require: false
-  gem 'debase', require: false
+  # Debug in VS Code - these do not install properly on the latest OS X
+  # gem 'ruby-debug-ide', require: false
+  # gem 'debase', require: false
 
   # Use RSpec for tests
   gem 'rspec-rails'
@@ -223,7 +227,7 @@ group :development, :test do
   gem 'spring'
   gem 'spring-commands-rspec'
   gem 'guard-rspec'
-  gem 'guard-livereload', '~> 2.5', require: false
+  gem 'guard-livereload', require: false
 
   # Stubs HTTP requests
   gem 'webmock'
@@ -232,7 +236,7 @@ group :development, :test do
   gem 'vcr'
 
   # Lint ruby files
-  gem 'rubocop', '~> 0.76.0', require: false
+  gem 'rubocop', require: false
 
   # Lint RSpec files
   gem 'rubocop-rspec'
@@ -247,7 +251,7 @@ group :development do
   gem 'listen'
 
   # Access an IRB console on exception pages or by using <%= console %> in views
-  gem 'web-console', '~> 3.7'
+  gem 'web-console'
 
   gem 'i18n-tasks'
 
@@ -263,7 +267,7 @@ group :test do
   gem 'cgi'
 
   # RSpec matchers for convenience
-  gem 'shoulda-matchers', '~> 3.1'
+  gem 'shoulda-matchers'
 
   # Test database cleanup gem with multiple strategies
   gem 'database_cleaner'
diff --git a/Gemfile.lock b/Gemfile.lock
index 50cce74702..9dd659a565 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,3 +1,29 @@
+GIT
+  remote: https://github.com/lml/fine_print.git
+  revision: 636023f68e95196dffaf295bfad3ad8051c23542
+  ref: 636023f68e95196dffaf295bfad3ad8051c23542
+  specs:
+    fine_print (6.0.1)
+      action_interceptor
+      jquery-rails
+      rails (< 7)
+      responders
+
+GIT
+  remote: https://github.com/lml/lev.git
+  revision: a33c93c83afea63c80b5da6317efec4bfd357df5
+  ref: a33c93c83afea63c80b5da6317efec4bfd357df5
+  specs:
+    lev (13.0.0)
+      actionpack (>= 4.2)
+      active_attr
+      activejob
+      activemodel (>= 6.1)
+      activerecord (>= 4.2)
+      hashie
+      openstax_transaction_isolation
+      openstax_transaction_retry
+
 GIT
   remote: https://github.com/openstax/intl-tel-input-rails.git
   revision: 3a63a495822d90bc9ca93e9541ef252fd7a0b50b
@@ -9,8 +35,8 @@ GIT
 
 GIT
   remote: https://github.com/openstax/path_prefixer.git
-  revision: 8298c40ec38f132fc23ea946b2b20e855fe73a49
-  ref: 8298c40ec38f132fc23ea946b2b20e855fe73a49
+  revision: e3edfc70589bc90fcffba63b417260a88c1377d7
+  ref: e3edfc70589bc90fcffba63b417260a88c1377d7
   specs:
     openstax_path_prefixer (0.0.1)
       addressable
@@ -23,128 +49,170 @@ GIT
   specs:
     pattern-library (1.1.18)
 
+GIT
+  remote: https://github.com/openstax/transaction_isolation.git
+  revision: 7387fa091462118704967a7c4b2821cd0f5d9e01
+  ref: 7387fa091462118704967a7c4b2821cd0f5d9e01
+  specs:
+    openstax_transaction_isolation (2.0.0)
+      activerecord (>= 6)
+
+GIT
+  remote: https://github.com/openstax/transaction_retry.git
+  revision: 36e26d0a068756c334b9d1c671d40773bbfc9300
+  ref: 36e26d0a068756c334b9d1c671d40773bbfc9300
+  specs:
+    openstax_transaction_retry (2.0.0)
+      activerecord (>= 6)
+      openstax_transaction_isolation (>= 2)
+
 GEM
   remote: https://rubygems.org/
   specs:
-    action_interceptor (1.2.0)
+    action_interceptor (1.2.1)
       addressable
       rails (>= 3.1)
-    actioncable (5.2.8.1)
-      actionpack (= 5.2.8.1)
+    actioncable (6.1.7.8)
+      actionpack (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.8.1)
-      actionpack (= 5.2.8.1)
-      actionview (= 5.2.8.1)
-      activejob (= 5.2.8.1)
+    actionmailbox (6.1.7.8)
+      actionpack (= 6.1.7.8)
+      activejob (= 6.1.7.8)
+      activerecord (= 6.1.7.8)
+      activestorage (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
+      mail (>= 2.7.1)
+    actionmailer (6.1.7.8)
+      actionpack (= 6.1.7.8)
+      actionview (= 6.1.7.8)
+      activejob (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.8.1)
-      actionview (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
-      rack (~> 2.0, >= 2.0.8)
+    actionpack (6.1.7.8)
+      actionview (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
+      rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.8.1)
-      activesupport (= 5.2.8.1)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
+    actiontext (6.1.7.8)
+      actionpack (= 6.1.7.8)
+      activerecord (= 6.1.7.8)
+      activestorage (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
+      nokogiri (>= 1.8.5)
+    actionview (6.1.7.8)
+      activesupport (= 6.1.7.8)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    active_attr (0.16.0)
-      actionpack (>= 3.0.2, < 7.2)
-      activemodel (>= 3.0.2, < 7.2)
-      activesupport (>= 3.0.2, < 7.2)
-    activejob (5.2.8.1)
-      activesupport (= 5.2.8.1)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    active_attr (0.17.0)
+      actionpack (>= 3.0.2, < 8.0)
+      activemodel (>= 3.0.2, < 8.0)
+      activesupport (>= 3.0.2, < 8.0)
+    activejob (6.1.7.8)
+      activesupport (= 6.1.7.8)
       globalid (>= 0.3.6)
-    activemodel (5.2.8.1)
-      activesupport (= 5.2.8.1)
-    activerecord (5.2.8.1)
-      activemodel (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
-      arel (>= 9.0)
-    activerecord-import (1.0.8)
-      activerecord (>= 3.2)
-    activestorage (5.2.8.1)
-      actionpack (= 5.2.8.1)
-      activerecord (= 5.2.8.1)
-      marcel (~> 1.0.0)
-    activesupport (5.2.8.1)
+    activemodel (6.1.7.8)
+      activesupport (= 6.1.7.8)
+    activerecord (6.1.7.8)
+      activemodel (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
+    activerecord-import (1.8.1)
+      activerecord (>= 4.2)
+    activestorage (6.1.7.8)
+      actionpack (= 6.1.7.8)
+      activejob (= 6.1.7.8)
+      activerecord (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
+      marcel (~> 1.0)
+      mini_mime (>= 1.1.0)
+    activesupport (6.1.7.8)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
     aes_key_wrap (1.1.0)
-    apipie-rails (0.5.16)
-      rails (>= 4.1)
-    arel (9.0.0)
+    apipie-rails (1.4.2)
+      actionpack (>= 5.0)
+      activesupport (>= 5.0)
     ast (2.4.2)
-    autoprefixer-rails (9.6.0)
-      execjs
-    awesome_print (1.8.0)
+    autoprefixer-rails (10.4.19.0)
+      execjs (~> 2)
+    awesome_print (1.9.2)
     aws-eventstream (1.3.0)
-    aws-partitions (1.968.0)
-    aws-record (2.5.0)
-      aws-sdk-dynamodb (~> 1.18)
-    aws-sdk-autoscaling (1.115.0)
-      aws-sdk-core (~> 3, >= 3.201.0)
+    aws-partitions (1.987.0)
+    aws-record (2.13.2)
+      aws-sdk-dynamodb (~> 1, >= 1.85.0)
+    aws-sdk-autoscaling (1.121.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-cloudwatch (1.103.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-cloudwatch (1.44.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.201.5)
+    aws-sdk-core (3.209.1)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.9)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-dynamodb (1.53.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-rails (3.6.0)
+    aws-sdk-dynamodb (1.125.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-rails (3.13.0)
       aws-record (~> 2)
-      aws-sdk-ses (~> 1)
-      aws-sdk-sqs (~> 1)
+      aws-sdk-ses (~> 1, >= 1.50.0)
+      aws-sdk-sesv2 (~> 1, >= 1.34.0)
+      aws-sdk-sqs (~> 1, >= 1.56.0)
       aws-sessionstore-dynamodb (~> 2)
-      concurrent-ruby (~> 1)
+      concurrent-ruby (>= 1.3.1)
       railties (>= 5.2.0)
-    aws-sdk-rds (1.131.0)
-      aws-sdk-core (~> 3, >= 3.122.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-ses (1.35.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-sqs (1.33.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
-      aws-sigv4 (~> 1.1)
-    aws-sessionstore-dynamodb (2.0.1)
-      aws-sdk-dynamodb (~> 1)
-      rack (~> 2)
-    aws-sigv4 (1.9.1)
+    aws-sdk-rds (1.252.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-ses (1.75.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-sesv2 (1.63.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-sqs (1.86.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sessionstore-dynamodb (2.2.0)
+      aws-sdk-dynamodb (~> 1, >= 1.85.0)
+      rack (>= 2, < 4)
+      rack-session (>= 1, < 3)
+    aws-sigv4 (1.10.0)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.2.0)
-    bcrypt (3.1.18)
+    bcrypt (3.1.20)
+    bigdecimal (3.1.8)
     bindata (2.5.0)
     bindex (0.8.1)
-    blazer (2.6.4)
+    blazer (2.6.5)
       activerecord (>= 5)
       chartkick (>= 3.2)
       railties (>= 5)
       safely_block (>= 0.1.1)
-    bootsnap (1.9.1)
-      msgpack (~> 1.0)
+    bootsnap (1.18.4)
+      msgpack (~> 1.2)
     bootstrap-sass (3.4.1)
       autoprefixer-rails (>= 5.2.1)
       sassc (>= 2.0.0)
     builder (3.3.0)
     byebug (11.1.3)
-    capybara (3.35.3)
+    capybara (3.40.0)
       addressable
+      matrix
       mini_mime (>= 0.1.3)
-      nokogiri (~> 1.8)
+      nokogiri (~> 1.11)
       rack (>= 1.6.0)
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
@@ -152,17 +220,19 @@ GEM
     capybara-email (3.0.2)
       capybara (>= 2.4, < 4.0)
       mail
-    capybara-screenshot (1.0.19)
+    capybara-screenshot (1.0.26)
       capybara (>= 1.0, < 4)
       launchy
-    cgi (0.3.6)
-    chartkick (4.2.1)
+    cgi (0.4.1)
+    chartkick (5.0.7)
+    childprocess (5.1.0)
+      logger (~> 1.5)
     choice (0.2.0)
     chronic (0.10.2)
     chunky_png (1.4.0)
     codecov (0.6.0)
       simplecov (>= 0.15, < 0.22)
-    coderay (1.1.1)
+    coderay (1.1.3)
     coffee-rails (5.0.0)
       coffee-script (>= 2.2.0)
       railties (>= 5.2.0)
@@ -182,92 +252,67 @@ GEM
       sass (>= 3.3.0, < 3.5)
     compass-import-once (1.0.5)
       sass (>= 3.2, < 3.5)
-    compass-rails (3.1.0)
+    compass-rails (4.0.0)
       compass (~> 1.0.0)
       sass-rails (< 5.1)
       sprockets (< 4.0)
     concurrent-ruby (1.3.4)
-    crack (0.4.5)
+    crack (1.0.0)
+      bigdecimal
       rexml
     crass (1.0.6)
-    css_parser (1.4.5)
+    css_parser (1.19.0)
       addressable
-    database_cleaner (1.8.5)
+    database_cleaner (2.0.2)
+      database_cleaner-active_record (>= 2, < 3)
+    database_cleaner-active_record (2.2.0)
+      activerecord (>= 5.a)
+      database_cleaner-core (~> 2.0.0)
+    database_cleaner-core (2.0.1)
     date (3.3.4)
-    db-query-matchers (0.6.0)
-    debase (0.2.4.1)
-      debase-ruby_core_source (>= 0.10.2)
-    debase-ruby_core_source (0.10.11)
+    db-query-matchers (0.13.0)
+      activesupport (>= 4.0, < 7.3)
+      rspec (>= 3.0)
     declarative (0.0.20)
-    declarative-option (0.1.0)
-    delayed_job (4.1.10)
+    delayed_job (4.1.12)
       activesupport (>= 3.0, < 8.0)
-    delayed_job_active_record (4.1.7)
+    delayed_job_active_record (4.1.10)
       activerecord (>= 3.0, < 8.0)
       delayed_job (>= 3.0, < 5)
-    delayed_job_heartbeat_plugin (0.4.0)
+    delayed_job_heartbeat_plugin (0.5.0)
       delayed_job (>= 4.1.0)
       delayed_job_active_record (>= 4.1.0)
-    delayed_job_worker_pool (0.3.0)
+    delayed_job_worker_pool (1.0.0)
       delayed_job (>= 3.0, < 4.2)
-    diff-lcs (1.4.4)
+    diff-lcs (1.5.1)
     diffy (3.4.2)
-    docile (1.4.0)
-    doorkeeper (5.1.2)
+    docile (1.4.1)
+    doorkeeper (5.7.1)
       railties (>= 5)
-    dotenv (2.7.6)
-    dotenv-rails (2.7.6)
-      dotenv (= 2.7.6)
+    dotenv (2.8.1)
+    dotenv-rails (2.8.1)
+      dotenv (= 2.8.1)
       railties (>= 3.2)
-    dry-configurable (0.9.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 0.4, >= 0.4.7)
-    dry-container (0.7.2)
-      concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.1, >= 0.1.3)
-    dry-core (0.4.9)
-      concurrent-ruby (~> 1.0)
-    dry-equalizer (0.3.0)
-    dry-inflector (0.2.0)
-    dry-logic (0.4.2)
-      dry-container (~> 0.2, >= 0.2.6)
-      dry-core (~> 0.2)
-      dry-equalizer (~> 0.2)
-    dry-types (0.13.4)
-      concurrent-ruby (~> 1.0)
-      dry-container (~> 0.3)
-      dry-core (~> 0.4, >= 0.4.4)
-      dry-equalizer (~> 0.2)
-      dry-inflector (~> 0.1, >= 0.1.2)
-      dry-logic (~> 0.4, >= 0.4.2)
-    dry-validation (0.12.3)
-      concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.1, >= 0.1.3)
-      dry-core (~> 0.2, >= 0.2.1)
-      dry-equalizer (~> 0.2)
-      dry-logic (~> 0.4.2)
-      dry-types (~> 0.13.1)
-    em-websocket (0.5.1)
+    em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
-      http_parser.rb (~> 0.6.0)
-    errbase (0.2.2)
+      http_parser.rb (~> 0)
     error_page_assets (0.4)
     erubi (1.13.0)
-    eventmachine (1.2.0.1)
+    eventmachine (1.2.7)
     exception_notification (4.5.0)
       actionmailer (>= 5.2, < 8)
       activesupport (>= 5.2, < 8)
-    execjs (2.8.1)
-    factory_bot (5.0.2)
-      activesupport (>= 4.2.0)
-    factory_bot_rails (5.0.2)
-      factory_bot (~> 5.0.2)
-      railties (>= 4.2.0)
-    faker (2.8.1)
-      i18n (>= 1.6, < 1.8)
-    fakeredis (0.6.0)
-      redis (~> 3.2)
-    faraday (1.10.3)
+    execjs (2.9.1)
+    factory_bot (6.5.0)
+      activesupport (>= 5.0.0)
+    factory_bot_rails (6.4.3)
+      factory_bot (~> 6.4)
+      railties (>= 5.0.0)
+    faker (3.4.2)
+      i18n (>= 1.8.11, < 2)
+    fakeredis (0.9.2)
+      redis (~> 4.8)
+    faraday (1.10.4)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
@@ -294,28 +339,24 @@ GEM
     faraday-patron (1.0.0)
     faraday-rack (1.0.0)
     faraday-retry (1.0.3)
-    faraday_middleware (1.2.0)
+    faraday_middleware (1.2.1)
       faraday (~> 1.0)
-    ffi (1.17.0)
-    fine_print (6.0.1)
-      action_interceptor
-      jquery-rails
-      rails (< 7)
-      responders
-    font-awesome-rails (4.7.0.5)
-      railties (>= 3.2, < 6.1)
-    formatador (0.2.5)
-    get_process_mem (0.2.7)
+    ffi (1.16.3)
+    font-awesome-rails (4.7.0.8)
+      railties (>= 3.2, < 8.0)
+    formatador (1.1.0)
+    get_process_mem (1.0.0)
+      bigdecimal (>= 2.0)
       ffi (~> 1.0)
-    globalid (1.1.0)
-      activesupport (>= 5.0)
-    guard (2.14.0)
+    globalid (1.2.1)
+      activesupport (>= 6.1)
+    guard (2.18.1)
       formatador (>= 0.2.4)
       listen (>= 2.7, < 4.0)
-      lumberjack (~> 1.0)
+      lumberjack (>= 1.0.12, < 2.0)
       nenv (~> 0.1)
       notiffany (~> 0.0)
-      pry (>= 0.9.12)
+      pry (>= 0.13.0)
       shellany (~> 0.0)
       thor (>= 0.18.1)
     guard-compat (1.2.1)
@@ -324,37 +365,41 @@ GEM
       guard (~> 2.8)
       guard-compat (~> 1.0)
       multi_json (~> 1.8)
-    guard-rspec (4.7.2)
+    guard-rspec (4.7.3)
       guard (~> 2.1)
       guard-compat (~> 1.1)
       rspec (>= 2.99.0, < 4.0)
-    hashdiff (1.0.1)
+    hashdiff (1.1.1)
     hashie (5.0.0)
-    highline (2.0.2)
+    highline (3.1.1)
+      reline
     htmlentities (4.3.4)
     http_accept_language (2.1.1)
-    http_parser.rb (0.6.0)
+    http_parser.rb (0.8.0)
     httpclient (2.8.3)
-    i18n (1.7.1)
+    i18n (1.14.6)
       concurrent-ruby (~> 1.0)
-    i18n-tasks (0.9.29)
+    i18n-tasks (1.0.14)
       activesupport (>= 4.0.2)
       ast (>= 2.1.0)
       erubi
       highline (>= 2.0.0)
       i18n
-      parser (>= 2.2.3.0)
+      parser (>= 3.2.2.1)
       rails-i18n
       rainbow (>= 2.2.2, < 4.0)
       terminal-table (>= 1.5.1)
-    jaro_winkler (1.5.3)
-    jbuilder (2.9.1)
-      activesupport (>= 4.2.0)
+    io-console (0.7.2)
+    jaro_winkler (1.5.6)
+    jbuilder (2.13.0)
+      actionview (>= 5.0.0)
+      activesupport (>= 5.0.0)
     jmespath (1.6.2)
-    jobba (1.4.0)
-      redis (~> 3.2)
+    jobba (2.0.0)
+      oj
+      redis (>= 4.0)
       redis-namespace
-    jquery-rails (4.4.0)
+    jquery-rails (4.6.0)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
@@ -363,29 +408,22 @@ GEM
       aes_key_wrap
       bindata
       httpclient
-    jwt (2.8.2)
+    jwt (2.9.3)
       base64
     keyword_search (1.5.0)
-    knockoutjs-rails (3.5.0)
-      railties (>= 3.1, < 6)
-    launchy (2.5.0)
-      addressable (~> 2.7)
-    lev (10.1.0)
-      actionpack (>= 4.2)
-      active_attr
-      activejob
-      activemodel (>= 4.2)
-      activerecord (>= 4.2)
-      hashie
-      transaction_isolation
-      transaction_retry
-    libv8-node (16.19.0.1)
-    libv8-node (16.19.0.1-x86_64-darwin)
-    libv8-node (16.19.0.1-x86_64-linux)
+    knockoutjs-rails (3.5.1.1)
+      railties (>= 3.1)
+    launchy (3.0.1)
+      addressable (~> 2.8)
+      childprocess (~> 5.0)
+    libv8-node (18.19.0.0)
+    libv8-node (18.19.0.0-x86_64-darwin)
+    libv8-node (18.19.0.0-x86_64-linux)
     listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    lograge (0.11.2)
+    logger (1.6.1)
+    lograge (0.14.0)
       actionpack (>= 4)
       activesupport (>= 4)
       railties (>= 4)
@@ -393,7 +431,7 @@ GEM
     loofah (2.22.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    lumberjack (1.0.10)
+    lumberjack (1.2.10)
     mail (2.8.1)
       mini_mime (>= 0.1.1)
       net-imap
@@ -401,21 +439,22 @@ GEM
       net-smtp
     marcel (1.0.4)
     maruku (0.7.3)
-    meta_request (0.7.2)
+    matrix (0.4.2)
+    meta_request (0.8.3)
       rack-contrib (>= 1.1, < 3)
-      railties (>= 3.0.0, < 7)
-    method_source (0.8.2)
+      railties (>= 3.0.0, < 8)
+    method_source (1.1.0)
     mini_mime (1.1.5)
     mini_portile2 (2.8.7)
-    mini_racer (0.6.4)
-      libv8-node (~> 16.19.0.0)
+    mini_racer (0.16.0)
+      libv8-node (~> 18.19.0.0)
     minitest (5.25.1)
-    msgpack (1.5.2)
+    msgpack (1.7.3)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.4.1)
     nenv (0.3.0)
-    net-imap (0.4.15)
+    net-imap (0.4.16)
       date
       net-protocol
     net-pop (0.1.2)
@@ -425,43 +464,53 @@ GEM
     net-smtp (0.5.0)
       net-protocol
     nio4r (2.7.3)
-    nokogiri (1.15.6)
+    nokogiri (1.16.7)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.15.6-x86_64-darwin)
+    nokogiri (1.16.7-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.15.6-x86_64-linux)
+    nokogiri (1.16.7-x86_64-linux)
       racc (~> 1.4)
-    notiffany (0.1.0)
+    notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
-    oauth (0.5.6)
-    oauth2 (1.4.4)
-      faraday (>= 0.8, < 2.0)
+    oauth (1.1.0)
+      oauth-tty (~> 1.0, >= 1.0.1)
+      snaky_hash (~> 2.0)
+      version_gem (~> 1.1)
+    oauth-tty (1.0.5)
+      version_gem (~> 1.1, >= 1.1.1)
+    oauth2 (1.4.11)
+      faraday (>= 0.17.3, < 3.0)
       jwt (>= 1.0, < 3.0)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    oj (3.7.12)
+      rack (>= 1.2, < 4)
+    oj (3.16.6)
+      bigdecimal (>= 3.0)
+      ostruct (>= 0.2)
     oj_mimic_json (1.0.1)
     omniauth (1.9.2)
       hashie (>= 3.4.6)
       rack (>= 1.6.2, < 3)
-    omniauth-facebook (6.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-google-oauth2 (0.8.0)
+    omniauth-facebook (10.0.0)
+      bigdecimal
+      omniauth-oauth2 (>= 1.2, < 3)
+    omniauth-google-oauth2 (0.8.2)
       jwt (>= 2.0)
-      omniauth (>= 1.1.1)
+      oauth2 (~> 1.1)
+      omniauth (~> 1.1)
       omniauth-oauth2 (>= 1.6)
     omniauth-identity (3.0.9)
       bcrypt
       omniauth
-    omniauth-oauth (1.1.0)
+    omniauth-oauth (1.2.1)
       oauth
-      omniauth (~> 1.0)
-    omniauth-oauth2 (1.6.0)
-      oauth2 (~> 1.1)
-      omniauth (~> 1.9)
+      omniauth (>= 1.0, < 3)
+      rack (>= 1.6.2, < 4)
+    omniauth-oauth2 (1.7.3)
+      oauth2 (>= 1.4, < 3)
+      omniauth (>= 1.9, < 3)
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
@@ -469,26 +518,27 @@ GEM
       active_attr
       rails (>= 5.0, < 7.0)
       restforce
-    openstax_api (9.4.0)
+    openstax_api (9.6.1)
+      addressable
       doorkeeper
       exception_notification
-      lev
+      lev (>= 12.1.0)
       openstax_utilities
-      rails (>= 5.2, < 7)
+      rails (>= 6, <= 8)
       representable
       responders
       roar
-      roar-rails
+      roar-rails (>= 1)
       uber
     openstax_healthcheck (1.0.1)
       rails (>= 3.0)
-    openstax_rescue_from (4.2.0)
+    openstax_rescue_from (4.2.2)
       rails (>= 3.1, < 7.0)
-    openstax_salesforce (8.0.0)
+    openstax_salesforce (8.1.0)
       openstax_active_force
       rails (>= 5.0, < 7.0)
       restforce
-    openstax_utilities (5.1.1)
+    openstax_utilities (5.1.2)
       aws-sdk-autoscaling
       faraday
       faraday-http-cache
@@ -496,160 +546,164 @@ GEM
       lev
       rails (>= 5.0, < 8.0)
       request_store
-    p3p (1.2.0)
-      rack
-    parallel (1.19.2)
-    parallel_tests (3.1.0)
+    ostruct (0.6.0)
+    p3p (2.0.0)
+      rack (>= 1.6.2)
+    parallel (1.26.3)
+    parallel_tests (4.7.2)
       parallel
-    parser (3.0.2.0)
+    parser (3.3.5.0)
       ast (~> 2.4.1)
-    pg (0.19.0)
-    premailer (1.8.7)
-      css_parser (>= 1.4.5)
+      racc
+    pg (1.5.8)
+    premailer (1.27.0)
+      addressable
+      css_parser (>= 1.19.0)
       htmlentities (>= 4.0.0)
-    premailer-rails (1.9.4)
-      actionmailer (>= 3, < 6)
+    premailer-rails (1.12.0)
+      actionmailer (>= 3)
+      net-smtp
       premailer (~> 1.7, >= 1.7.9)
-    pry (0.10.4)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    public_suffix (5.1.1)
-    puma (5.6.8)
+    pry (0.14.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    psych (3.3.4)
+    public_suffix (6.0.1)
+    puma (6.4.3)
       nio4r (~> 2.0)
-    puma_worker_killer (0.3.1)
-      get_process_mem (~> 0.2)
+    puma_worker_killer (1.0.0)
+      bigdecimal (>= 2.0)
+      get_process_mem (>= 0.2)
       puma (>= 2.7)
     racc (1.8.1)
-    rack (2.2.9)
+    rack (2.2.10)
     rack-contrib (2.5.0)
       rack (< 4)
-    rack-cors (1.1.1)
+    rack-cors (2.0.2)
       rack (>= 2.0.0)
+    rack-session (1.0.2)
+      rack (< 3)
     rack-test (2.1.0)
       rack (>= 1.3)
-    rails (5.2.8.1)
-      actioncable (= 5.2.8.1)
-      actionmailer (= 5.2.8.1)
-      actionpack (= 5.2.8.1)
-      actionview (= 5.2.8.1)
-      activejob (= 5.2.8.1)
-      activemodel (= 5.2.8.1)
-      activerecord (= 5.2.8.1)
-      activestorage (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
-      bundler (>= 1.3.0)
-      railties (= 5.2.8.1)
+    rails (6.1.7.8)
+      actioncable (= 6.1.7.8)
+      actionmailbox (= 6.1.7.8)
+      actionmailer (= 6.1.7.8)
+      actionpack (= 6.1.7.8)
+      actiontext (= 6.1.7.8)
+      actionview (= 6.1.7.8)
+      activejob (= 6.1.7.8)
+      activemodel (= 6.1.7.8)
+      activerecord (= 6.1.7.8)
+      activestorage (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
+      bundler (>= 1.15.0)
+      railties (= 6.1.7.8)
       sprockets-rails (>= 2.0.0)
-    rails-controller-testing (1.0.4)
-      actionpack (>= 5.0.1.x)
-      actionview (>= 5.0.1.x)
-      activesupport (>= 5.0.1.x)
+    rails-controller-testing (1.0.5)
+      actionpack (>= 5.0.1.rc1)
+      actionview (>= 5.0.1.rc1)
+      activesupport (>= 5.0.1.rc1)
     rails-dom-testing (2.2.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-erd (1.5.2)
-      activerecord (>= 3.2)
-      activesupport (>= 3.2)
+    rails-erd (1.7.2)
+      activerecord (>= 4.2)
+      activesupport (>= 4.2)
       choice (~> 0.2.0)
       ruby-graphviz (~> 1.2)
     rails-html-sanitizer (1.6.0)
       loofah (~> 2.21)
       nokogiri (~> 1.14)
-    rails-i18n (5.1.3)
+    rails-i18n (7.0.9)
       i18n (>= 0.7, < 2)
-      railties (>= 5.0, < 6)
-    rails-settings-cached (0.7.2)
-      rails (>= 4.2.0)
-    rails-settings-ui (1.3.5)
-      dry-types
-      dry-validation (< 1.0)
-      i18n
-      rails (>= 3.0)
-    railties (5.2.8.1)
-      actionpack (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
+      railties (>= 6.0.0, < 8)
+    rails-settings-cached (2.9.5)
+      activerecord (>= 5.0.0)
+      railties (>= 5.0.0)
+    railties (6.1.7.8)
+      actionpack (= 6.1.7.8)
+      activesupport (= 6.1.7.8)
       method_source
-      rake (>= 0.8.7)
-      thor (>= 0.19.0, < 2.0)
-    rainbow (3.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0)
+    rainbow (3.1.1)
     rake (13.2.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    redis (3.3.5)
-    redis-actionpack (5.0.2)
-      actionpack (>= 4.0, < 6)
-      redis-rack (>= 1, < 3)
+    redis (4.8.1)
+    redis-actionpack (5.4.0)
+      actionpack (>= 5, < 8)
+      redis-rack (>= 2.1.0, < 4)
       redis-store (>= 1.1.0, < 2)
-    redis-activesupport (5.0.4)
-      activesupport (>= 3, < 6)
+    redis-activesupport (5.3.0)
+      activesupport (>= 3, < 8)
       redis-store (>= 1.3, < 2)
-    redis-namespace (1.5.2)
-      redis (~> 3.0, >= 3.0.4)
-    redis-rack (2.0.4)
-      rack (>= 1.5, < 3)
+    redis-namespace (1.11.0)
+      redis (>= 4)
+    redis-rack (3.0.0)
+      rack-session (>= 0.2.0)
       redis-store (>= 1.2, < 2)
     redis-rails (5.0.2)
       redis-actionpack (>= 5.0, < 6)
       redis-activesupport (>= 5.0, < 6)
       redis-store (>= 1.2, < 2)
-    redis-store (1.4.1)
-      redis (>= 2.2, < 5)
-    regexp_parser (2.1.0)
-    render_anywhere (0.0.12)
-      rails (>= 3.0.7)
-    representable (3.0.4)
+    redis-store (1.11.0)
+      redis (>= 4, < 6)
+    regexp_parser (2.9.2)
+    reline (0.5.10)
+      io-console (~> 0.5)
+    representable (3.2.0)
       declarative (< 0.1.0)
-      declarative-option (< 0.2.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
       uber (< 0.2.0)
     request_store (1.7.0)
       rack (>= 1.4)
     responders (3.1.1)
       actionpack (>= 5.2)
       railties (>= 5.2)
-    restforce (6.2.4)
-      faraday (>= 1.1.0, < 2.8.0)
+    restforce (7.5.0)
+      faraday (>= 1.1.0, < 2.12.0)
       faraday-follow_redirects (<= 0.3.0, < 1.0.0)
       faraday-multipart (>= 1.0.0, < 2.0.0)
       faraday-net_http (< 4.0.0)
       hashie (>= 1.2.0, < 6.0)
       jwt (>= 1.5.6)
-    rexml (3.3.6)
-      strscan
-    roar (1.1.1)
-      representable (~> 3.0)
-    roar-rails (1.1.0)
+    rexml (3.3.8)
+    roar (1.2.0)
+      representable (~> 3.1)
+    roar-rails (1.2.0)
       actionpack
       railties (>= 3.0.0)
       responders
-      roar (~> 1.1.0)
+      roar (~> 1.2)
       test_xml (>= 0.1.6)
       uber (< 0.2.0)
-    rspec (3.10.0)
-      rspec-core (~> 3.10.0)
-      rspec-expectations (~> 3.10.0)
-      rspec-mocks (~> 3.10.0)
-    rspec-core (3.10.1)
-      rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.1)
+    rspec (3.13.0)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.1)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.3)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
+      rspec-support (~> 3.13.0)
     rspec-instafail (1.0.0)
       rspec
-    rspec-mocks (3.10.2)
+    rspec-mocks (3.13.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-rails (4.0.2)
-      actionpack (>= 4.2)
-      activesupport (>= 4.2)
-      railties (>= 4.2)
+      rspec-support (~> 3.13.0)
+    rspec-rails (5.1.2)
+      actionpack (>= 5.2)
+      activesupport (>= 5.2)
+      railties (>= 5.2)
       rspec-core (~> 3.10)
       rspec-expectations (~> 3.10)
       rspec-mocks (~> 3.10)
       rspec-support (~> 3.10)
-    rspec-support (3.10.2)
+    rspec-support (3.13.1)
     rubocop (0.76.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
@@ -657,41 +711,37 @@ GEM
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 1.7)
-    rubocop-rspec (1.36.0)
+    rubocop-rspec (1.41.0)
       rubocop (>= 0.68.1)
-    ruby-debug-ide (0.7.2)
-      rake (>= 0.8.1)
-    ruby-graphviz (1.2.3)
-    ruby-progressbar (1.10.1)
+    ruby-graphviz (1.2.5)
+      rexml
+    ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
-    safely_block (0.3.0)
-      errbase (>= 0.1.1)
-    sass (3.4.25)
+    safely_block (0.4.1)
+    sass (3.4.19)
     sass-rails (5.0.8)
       railties (>= 5.2.0)
       sass (~> 3.1)
       sprockets (>= 2.8, < 4.0)
       sprockets-rails (>= 2.0, < 4.0)
       tilt (>= 1.1, < 3)
-    sassc (2.0.1)
+    sassc (2.4.0)
       ffi (~> 1.9)
-      rake
     sd_notify (0.1.1)
-    selenium-webdriver (4.9.0)
+    selenium-webdriver (4.10.0)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
-    sentry-delayed_job (4.4.0)
-      sentry-ruby-core (~> 4.4.0.pre.beta)
-    sentry-rails (5.16.1)
+    sentry-delayed_job (5.20.1)
+      delayed_job (>= 4.0)
+      sentry-ruby (~> 5.20.1)
+    sentry-rails (5.20.1)
       railties (>= 5.0)
-      sentry-ruby (~> 5.16.1)
-    sentry-ruby (5.16.1)
+      sentry-ruby (~> 5.20.1)
+    sentry-ruby (5.20.1)
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
-    sentry-ruby-core (4.4.2)
-      concurrent-ruby
-      faraday
     shellany (0.0.1)
     shoulda-matchers (3.1.3)
       activesupport (>= 4.0.0)
@@ -699,72 +749,71 @@ GEM
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.12.3)
+    simplecov-html (0.13.1)
     simplecov_json_formatter (0.1.4)
-    slop (3.6.0)
-    smarter_csv (1.1.0)
-    spring (1.7.2)
+    smarter_csv (1.12.1)
+    snaky_hash (2.0.1)
+      hashie
+      version_gem (~> 1.1, >= 1.1.1)
+    spring (4.2.1)
     spring-commands-rspec (1.0.4)
       spring (>= 0.9.1)
-    sprockets (3.7.3)
+    sprockets (3.7.5)
       base64
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.4.2)
-      actionpack (>= 5.2)
-      activesupport (>= 5.2)
+    sprockets-rails (3.5.2)
+      actionpack (>= 6.1)
+      activesupport (>= 6.1)
       sprockets (>= 3.0.0)
-    strscan (3.1.0)
-    terminal-table (1.8.0)
-      unicode-display_width (~> 1.1, >= 1.1.1)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
     test_xml (0.1.8)
       diffy (~> 3.0)
       nokogiri (>= 1.3.2)
     thor (1.3.2)
-    thread_safe (0.3.6)
-    tilt (2.0.10)
-    timecop (0.8.1)
+    tilt (2.4.0)
+    timecop (0.9.10)
     timeout (0.4.1)
-    transaction_isolation (1.0.5)
-      activerecord (>= 3.0.11)
-    transaction_retry (1.0.3)
-      activerecord (>= 3.0.11)
-      transaction_isolation (>= 1.0.2)
-    tzinfo (1.2.11)
-      thread_safe (~> 0.1)
+    trailblazer-option (0.1.2)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
     uber (0.1.0)
-    uglifier (4.2.0)
+    uglifier (4.2.1)
       execjs (>= 0.3.0, < 3)
-    unicode-display_width (1.6.0)
-    vcr (3.0.3)
-    web-console (3.7.0)
-      actionview (>= 5.0)
-      activemodel (>= 5.0)
+    unicode-display_width (1.6.1)
+    vcr (6.3.1)
+      base64
+    version_gem (1.1.4)
+    web-console (4.2.1)
+      actionview (>= 6.0.0)
+      activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
-      railties (>= 5.0)
+      railties (>= 6.0.0)
     webdrivers (5.3.1)
       nokogiri (~> 1.6)
       rubyzip (>= 1.3.0)
       selenium-webdriver (~> 4.0, < 4.11)
-    webmock (3.11.2)
-      addressable (>= 2.3.6)
+    webmock (3.24.0)
+      addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    websocket (1.2.9)
+    websocket (1.2.11)
     websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    whenever (0.9.7)
+    whenever (1.0.0)
       chronic (>= 0.6.3)
     whenever-test (1.0.1)
       whenever
-    will_paginate (3.3.0)
+    will_paginate (4.0.1)
     xpath (3.2.0)
       nokogiri (~> 1.8)
+    zeitwerk (2.6.18)
 
 PLATFORMS
   ruby
-  x86_64-darwin-20
+  x86_64-darwin
   x86_64-linux
 
 DEPENDENCIES
@@ -776,10 +825,10 @@ DEPENDENCIES
   aws-sdk-cloudwatch
   aws-sdk-rails
   aws-sdk-rds
-  bcrypt (~> 3.1.7)
+  bcrypt
   blazer
   bootsnap
-  bootstrap-sass (~> 3.4.1)
+  bootstrap-sass
   byebug
   capybara
   capybara-email
@@ -787,26 +836,25 @@ DEPENDENCIES
   cgi
   chronic
   codecov
-  coffee-rails (= 5.0.0)
-  compass-rails (~> 3.1.0)
+  coffee-rails
+  compass-rails
   database_cleaner
   db-query-matchers
-  debase
   delayed_job_active_record
   delayed_job_heartbeat_plugin
   delayed_job_worker_pool
-  doorkeeper (~> 5.1.0)
+  doorkeeper
   dotenv-rails
-  dry-validation (= 0.12.3)
   error_page_assets
   factory_bot_rails
   faker
   fakeredis
   faraday
   faraday_middleware
-  fine_print
+  ffi (< 1.17)
+  fine_print!
   font-awesome-rails
-  guard-livereload (~> 2.5)
+  guard-livereload
   guard-rspec
   http_accept_language
   i18n-tasks
@@ -818,13 +866,13 @@ DEPENDENCIES
   keyword_search (~> 1.5.0)
   knockoutjs-rails
   launchy
-  lev (~> 10.1.0)
+  lev!
   listen
   lograge
   maruku
   meta_request
   mini_racer
-  oj (~> 3.7.12)
+  oj
   oj_mimic_json
   omniauth (~> 1.9)
   omniauth-facebook
@@ -836,43 +884,45 @@ DEPENDENCIES
   openstax_path_prefixer!
   openstax_rescue_from
   openstax_salesforce
+  openstax_transaction_isolation!
+  openstax_transaction_retry!
   openstax_utilities
   p3p
   parallel_tests
   pattern-library!
   pg
   premailer-rails
-  puma (~> 5.6.0)
+  psych (< 4)
+  puma
   puma_worker_killer
   rack-cors
-  rails (~> 5.2)
+  rails (= 6.1.7.8)
   rails-controller-testing
   rails-erd
-  rails-i18n (~> 5)
-  rails-settings-cached (= 0.7.2)
-  rails-settings-ui
+  rails-i18n
+  rails-settings-cached
   redis-rails
-  render_anywhere
-  representable (~> 3.0.0)
+  representable
+  rexml
   rspec-instafail
   rspec-rails
-  rubocop (~> 0.76.0)
+  rubocop
   rubocop-rspec
-  ruby-debug-ide
-  sass-rails (~> 5.0)
+  sass (= 3.4.19)
+  sass-rails
   sd_notify
   selenium-webdriver
   sentry-delayed_job
   sentry-rails
   sentry-ruby
-  shoulda-matchers (~> 3.1)
+  shoulda-matchers
   smarter_csv
   spring
   spring-commands-rspec
   timecop
-  uglifier (>= 1.3.0)
+  uglifier
   vcr
-  web-console (~> 3.7)
+  web-console
   webdrivers
   webmock
   whenever
@@ -880,4 +930,4 @@ DEPENDENCIES
   will_paginate
 
 BUNDLED WITH
-   2.3.13
+   2.3.27
diff --git a/Rakefile b/Rakefile
index 5728347294..cbd042a7d8 100644
--- a/Rakefile
+++ b/Rakefile
@@ -41,4 +41,4 @@ def process_error_files
       yield src, dst
     end
   end
-end
+end if Rails.env.production?
diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
index ebecdc12be..acc3ba1669 100644
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -144,7 +144,7 @@ def update_user
           application_user.roles = au[:roles].split(',').map(&:strip)
           application_user
         end
-        @user.update_attributes! user_params
+        @user.update! user_params
       end
     end
   end
diff --git a/app/controllers/api/v1/users_controller.rb b/app/controllers/api/v1/users_controller.rb
index 2b7038f40b..174c289f80 100644
--- a/app/controllers/api/v1/users_controller.rb
+++ b/app/controllers/api/v1/users_controller.rb
@@ -261,13 +261,12 @@ def create_external_id
   private
 
   def get_sso_token(application, user)
-    # Note: this method changes to keyword arguments in a future Doorkeeper version
     access_token = Doorkeeper::AccessToken.find_or_create_for(
-      application,
-      user.id,
-      '',
-      SSO_TOKEN_INITIAL_DURATION,
-      false,
+      application: application,
+      resource_owner: user.id,
+      scopes: '',
+      expires_in: SSO_TOKEN_INITIAL_DURATION,
+      use_refresh_token: false,
     )
 
     return access_token.token if access_token.created_at > user.updated_at &&
@@ -276,10 +275,9 @@ def get_sso_token(application, user)
                                    access_token.expires_at >= Time.current + SSO_TOKEN_MIN_DURATION
                                  )
 
-    # Note: replace with create_for() in  a future Doorkeeper version
-    access_token = Doorkeeper::AccessToken.create!(
-      application_id: application.id,
-      resource_owner_id: user.id,
+    access_token = Doorkeeper::AccessToken.create_for(
+      application: application.id,
+      resource_owner: user.id,
       scopes: '',
       expires_in: SSO_TOKEN_INITIAL_DURATION,
       use_refresh_token: false
diff --git a/app/controllers/legacy/users_controller.rb b/app/controllers/legacy/users_controller.rb
index 63086fdbd9..150e753ca5 100644
--- a/app/controllers/legacy/users_controller.rb
+++ b/app/controllers/legacy/users_controller.rb
@@ -18,7 +18,7 @@ def update
 
       respond_to do |format|
         format.json do
-          if current_user.update_attributes(user_params)
+          if current_user.update(user_params)
             security_log :user_updated, user_params: user_params
 
             render json: { full_name: current_user.full_name }, status: :ok
diff --git a/app/controllers/newflow/login_controller.rb b/app/controllers/newflow/login_controller.rb
index 4584418edb..9d6d58029f 100644
--- a/app/controllers/newflow/login_controller.rb
+++ b/app/controllers/newflow/login_controller.rb
@@ -48,7 +48,7 @@ def login
           case code
           when :cannot_find_user, :multiple_users, :incorrect_password, :too_many_login_attempts
             user = @handler_result.outputs.user
-            security_log(:sign_in_failed, { reason: code, email: email })
+            security_log(:sign_in_failed, { reason: code, email: email, user: user })
           end
 
           render :login_form
diff --git a/app/controllers/newflow/signup_controller.rb b/app/controllers/newflow/signup_controller.rb
index 3a6f393143..cf932a45bb 100644
--- a/app/controllers/newflow/signup_controller.rb
+++ b/app/controllers/newflow/signup_controller.rb
@@ -8,6 +8,9 @@ class SignupController < BaseController
     before_action(:newflow_authenticate_user!, only: :signup_done)
     before_action(:skip_signup_done_for_tutor_users, only: :signup_done)
 
+    def welcome
+    end
+
     def verify_email_by_code
       handle_with(
         VerifyEmailByCode,
diff --git a/app/controllers/oauth/applications_controller.rb b/app/controllers/oauth/applications_controller.rb
index 1a012b38fc..abe9ad3671 100644
--- a/app/controllers/oauth/applications_controller.rb
+++ b/app/controllers/oauth/applications_controller.rb
@@ -69,9 +69,9 @@ def edit
 
     def update
       OSU::AccessPolicy.require_action_allowed!(:update, @user, @application)
-      
+
       Doorkeeper::Application.transaction do
-        if add_application_owners && @application.update_attributes(app_params)
+        if add_application_owners && @application.update(app_params)
           security_log :application_updated, application_id: @application.id,
                                             application_params: app_params
           flash[:notice] = I18n.t(
@@ -137,18 +137,18 @@ def add_application_owners
       member_ids = validated_member_ids
       return false if @application.errors.any?
       return true if !current_user.is_administrator? && current_user.oauth_applications.include?(@application)
-    
-      @application.owner.update_attributes(member_ids: member_ids)
+
+      @application.owner.update(member_ids: member_ids)
     end
 
     def validated_member_ids
       return [] if !params[:member_ids].present?
-    
+
       if !params[:member_ids].match(SPACE_SEPARATED_NUMBERS_REGEX)
         @application.errors.add(:owner, 'Member Ids must be a space separated list of integers')
         return false
       end
-    
+
       member_ids = params[:member_ids].split.map(&:to_i)
       member_ids.each do |member_id|
         if !User.where(id: member_id).exists?
@@ -165,7 +165,7 @@ def set_current_member_ids
 
     def authenticate_admin_or_oauth_application_owner!
       return if current_user.oauth_applications.any?
-      admin_authentication! 
+      admin_authentication!
     end
   end
 end
diff --git a/app/handlers/signup_start.rb b/app/handlers/signup_start.rb
index e9f33254a6..b1bb0e0854 100644
--- a/app/handlers/signup_start.rb
+++ b/app/handlers/signup_start.rb
@@ -26,7 +26,7 @@ def handle
 
     # is there a pre_auth_state and it's email is unchanged
     if existing_pre_auth_state.try(:contact_info_value) == email
-      existing_pre_auth_state.update_attributes(role: signup_params.role)
+      existing_pre_auth_state.update(role: signup_params.role)
       outputs.pre_auth_state = existing_pre_auth_state
       # pre_auth_state may have been created in session start
       # and the the confirmation email will not yet have been sent
diff --git a/app/models/application_user.rb b/app/models/application_user.rb
index fe693a0a57..da304d91b8 100644
--- a/app/models/application_user.rb
+++ b/app/models/application_user.rb
@@ -3,9 +3,9 @@ class ApplicationUser < ApplicationRecord
                            inverse_of: :application_users
   belongs_to :user, inverse_of: :application_users
 
-  belongs_to :default_contact_info, class_name: 'ContactInfo'
+  belongs_to :default_contact_info, optional: true, class_name: 'ContactInfo'
 
-  validates_presence_of :user, :application
+  validates_presence_of :application
   validates_uniqueness_of :user_id, scope: :application_id
   validate :contact_info_belongs_to_user
 
diff --git a/app/models/contact_info.rb b/app/models/contact_info.rb
index 7a794471b7..8df7047528 100644
--- a/app/models/contact_info.rb
+++ b/app/models/contact_info.rb
@@ -4,7 +4,6 @@ class ContactInfo < ApplicationRecord
   before_create :set_confirmation_pin_code
   before_destroy :check_if_last_verified
 
-  validates :user, presence: true
   validates :type, presence: true
   validates :value,
             presence: true,
diff --git a/app/models/email_address.rb b/app/models/email_address.rb
index e679c55546..16012da35b 100644
--- a/app/models/email_address.rb
+++ b/app/models/email_address.rb
@@ -33,12 +33,6 @@ def mx_domain_validation
     end
   end
 
-  def customize_value_error_message(error:, message:)
-    if self.errors && self.errors.types.fetch(:value, {}).include?(error)
-      self.errors.messages[:value][0] = message
-    end
-  end
-
   protected
 
   def is_domain_trusted?
diff --git a/app/models/message.rb b/app/models/message.rb
index c7db748f29..b38317f514 100644
--- a/app/models/message.rb
+++ b/app/models/message.rb
@@ -1,6 +1,5 @@
 class Message < ApplicationRecord
-  belongs_to :application, class_name: 'Doorkeeper::Application',
-                           inverse_of: :messages
+  belongs_to :application, class_name: 'Doorkeeper::Application', inverse_of: :messages
   belongs_to :user, inverse_of: :sent_messages
 
   has_one :body, class_name: 'MessageBody', inverse_of: :message
diff --git a/app/models/message_recipient.rb b/app/models/message_recipient.rb
index d977d38a21..b580b0add5 100644
--- a/app/models/message_recipient.rb
+++ b/app/models/message_recipient.rb
@@ -1,7 +1,7 @@
 class MessageRecipient < ApplicationRecord
   belongs_to :message, inverse_of: :message_recipients
   belongs_to :contact_info, inverse_of: :message_recipients
-  belongs_to :user, inverse_of: :message_recipients
+  belongs_to :user, optional: true, inverse_of: :message_recipients
 
   validates :message, presence: true
   validates_uniqueness_of :contact_info_id, scope: :message_id,
diff --git a/app/models/pre_auth_state.rb b/app/models/pre_auth_state.rb
index 97a63be5eb..b71a076e59 100644
--- a/app/models/pre_auth_state.rb
+++ b/app/models/pre_auth_state.rb
@@ -1,6 +1,4 @@
 class PreAuthState < ApplicationRecord
-  belongs_to :user
-
   enum contact_info_kind: [:email_address]
 
   before_validation :prepare
diff --git a/app/models/user.rb b/app/models/user.rb
index d83b6baa3d..d32591a2bd 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -135,7 +135,8 @@ class User < ApplicationRecord
 
   belongs_to :school, optional: true, inverse_of: :users
 
-  belongs_to :source_application, class_name: "Doorkeeper::Application", foreign_key: "source_application_id"
+  belongs_to :source_application, optional: true,
+             class_name: 'Doorkeeper::Application', foreign_key: :source_application_id
 
   has_one :identity, dependent: :destroy, inverse_of: :user
   has_one :pre_auth_state
@@ -270,7 +271,7 @@ def step_3_complete?
   # A User can also be created by a one of the consumer applications as a stand-in
   # for a person who has not yet (or may never) created an account.  In this case
   # the User model will be in the "unclaimed" state.  When the User does signup, they
-  # can claim the account and recieve all the permissions and tasks
+  # can claim the account and receive all the permissions and tasks
   # that were assigned to it in the interm.
   #
   # Once a User model is cleared for use, the state is set to "activated"
diff --git a/app/routines/newflow/create_email_for_user.rb b/app/routines/newflow/create_email_for_user.rb
index 2f74613ed6..05014c85f3 100644
--- a/app/routines/newflow/create_email_for_user.rb
+++ b/app/routines/newflow/create_email_for_user.rb
@@ -9,10 +9,6 @@ def exec(email:, user:, is_school_issued: nil)
       @email = EmailAddress.find_or_create_by(value: email&.downcase, user_id: user.id)
       @email.is_school_issued = is_school_issued
 
-      @email.customize_value_error_message(
-        error: :missing_mx_records,
-        message: I18n.t(:"login_signup_form.invalid_email_provider", email: @email.value)
-      )
       transfer_errors_from(@email, { scope: :email }, :fail_if_errors)
 
       if @email.new_record? || !@email.verified?
diff --git a/app/routines/newflow/ensure_unverified_user.rb b/app/routines/newflow/ensure_unverified_user.rb
index ade20b548c..8458f7c9e0 100644
--- a/app/routines/newflow/ensure_unverified_user.rb
+++ b/app/routines/newflow/ensure_unverified_user.rb
@@ -7,7 +7,7 @@ class EnsureUnverifiedUser
 
     def exec(user)
       if user.state == 'needs_profile'
-        user.update_attributes(state: 'unverified', is_newflow: true)
+        user.update(state: 'unverified', is_newflow: true)
         transfer_errors_from(user, { type: :verbatim }, :fail_if_errors)
 
         SecurityLog.create(
diff --git a/app/routines/transfer_authentications.rb b/app/routines/transfer_authentications.rb
index dd56a9ea9d..c6aecfea7f 100644
--- a/app/routines/transfer_authentications.rb
+++ b/app/routines/transfer_authentications.rb
@@ -1,4 +1,4 @@
-# Firstly, persists or updates (with `update_attributes`) an `Authentication` for the given user.
+# Firstly, persists or updates (with `update`) an `Authentication` for the given user.
 #
 # Secondly, if the authentication(s) already belonged to a user, and
 # that user can be destroyed, then we destroy that user.
@@ -13,7 +13,7 @@ def exec(authentications, newer_user)
     authentications = [authentications] if !(authentications.is_a?(Array))
     authentications.each do |authentication|
       existing_user = authentication.user
-      authentication.update_attributes(user_id: newer_user.id)
+      authentication.update(user_id: newer_user.id)
       transfer_errors_from(authentication, {type: :verbatim}, :fail_if_errors)
 
       if existing_user && can_be_destroyed?(existing_user)
diff --git a/app/views/faculty_access/apply.html.erb b/app/views/faculty_access/apply.html.erb
index e618fcd4dd..74289922bc 100644
--- a/app/views/faculty_access/apply.html.erb
+++ b/app/views/faculty_access/apply.html.erb
@@ -24,12 +24,12 @@
 
   <%= lev_form_for :apply, url: faculty_access_apply_path, html: {class: 'full-width'} do |f| %>
 
-    <% fh = FormHelper::One.new(f: f,
-                                limit_to: :any,
-                                context: self,
-                                params: params,
-                                errors: @handler_result.try(:errors),
-                                error_field_classes: "alert alert-danger") %>
+    <% fh = ::FormHelper::One.new(f: f,
+                                  limit_to: :any,
+                                  context: self,
+                                  params: params,
+                                  errors: @handler_result.try(:errors),
+                                  error_field_classes: "alert alert-danger") %>
 
     <p><%= t :".instructions" %></p>
 
diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb
index b3908d5a79..80ddb75acd 100644
--- a/app/views/layouts/admin.html.erb
+++ b/app/views/layouts/admin.html.erb
@@ -50,8 +50,6 @@
 
             <li><%= link_to 'Security Log', main_app.routes.url_helpers.admin_security_log_path %></li>
 
-            <li><%= link_to 'Settings', main_app.routes.url_helpers.admin_rails_settings_ui_path %></li>
-
             <li class="dropdown">
               <a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Banners<span class="caret"></span></a>
               <ul class="dropdown-menu">
diff --git a/app/views/legacy/identities/_set.html.erb b/app/views/legacy/identities/_set.html.erb
index 534caec6ce..59e1f59e3a 100644
--- a/app/views/legacy/identities/_set.html.erb
+++ b/app/views/legacy/identities/_set.html.erb
@@ -21,10 +21,10 @@
 
   <%= lev_form_for :set_password, url: '' do |f| %>
 
-    <% fh = FormHelper::One.new(f: f,
-                                context: self,
-                                errors: all_errors,
-                                error_field_classes: "alert alert-danger") %>
+    <% fh = ::FormHelper::One.new(f: f,
+                                  context: self,
+                                  errors: all_errors,
+                                  error_field_classes: "alert alert-danger") %>
 
     <%= fh.text_field name: :password, type: :password,
                       label: :".password",
diff --git a/app/views/legacy/sessions/_authenticate_options.html.erb b/app/views/legacy/sessions/_authenticate_options.html.erb
index 1684e83505..4f33075950 100644
--- a/app/views/legacy/sessions/_authenticate_options.html.erb
+++ b/app/views/legacy/sessions/_authenticate_options.html.erb
@@ -55,7 +55,7 @@
         html: {class: 'identity-password'} do |f| %>
 
     <%
-      fh = FormHelper::One.new(
+      fh = ::FormHelper::One.new(
         f: f,
         context: self,
         errors: @errors || @handler_result.try(:errors),
diff --git a/app/views/legacy/sessions/start.html.erb b/app/views/legacy/sessions/start.html.erb
index 182307588a..5e632981b4 100644
--- a/app/views/legacy/sessions/start.html.erb
+++ b/app/views/legacy/sessions/start.html.erb
@@ -31,10 +31,10 @@
 
   <%= lev_form_for :login, url: lookup_login_path do |f| %>
 
-      <% fh = FormHelper::One.new(f: f,
-                                  context: self,
-                                  errors: @handler_result.try(:errors),
-                                  error_field_classes: "alert alert-danger") %>
+      <% fh = ::FormHelper::One.new(f: f,
+                                    context: self,
+                                    errors: @handler_result.try(:errors),
+                                    error_field_classes: "alert alert-danger") %>
 
       <% if @client_app  %>
           <% if @client_app.name.downcase.include? "tutor" %>
diff --git a/app/views/legacy/signup/password.html.erb b/app/views/legacy/signup/password.html.erb
index 6466259b69..2512de07df 100644
--- a/app/views/legacy/signup/password.html.erb
+++ b/app/views/legacy/signup/password.html.erb
@@ -5,9 +5,9 @@
 
     <p><%= t :".password_requirements" %></p>
 
-    <% fh = FormHelper::One.new(f: f,
-                                context: self,
-                                errors: @handler_result.try(:errors)) %>
+    <% fh = ::FormHelper::One.new(f: f,
+                                  context: self,
+                                  errors: @handler_result.try(:errors)) %>
     <section>
       <%= fh.text_field name: :password, type: :password, autofocus: true %>
       <%= fh.text_field name: :password_confirmation, type: :password %>
diff --git a/app/views/legacy/signup/profile.html.erb b/app/views/legacy/signup/profile.html.erb
index 1b3ceffb4f..148075648f 100644
--- a/app/views/legacy/signup/profile.html.erb
+++ b/app/views/legacy/signup/profile.html.erb
@@ -4,11 +4,11 @@
 
   <%= lev_form_for :profile, url: signup_profile_path, html: {class: 'full-width'} do |f| %>
 
-    <% fh = FormHelper::One.new(f: f,
-                                limit_to: role,
-                                context: self,
-                                errors: @handler_result.try(:errors),
-                                error_field_classes: "alert alert-danger") %>
+    <% fh = ::FormHelper::One.new(f: f,
+                                  limit_to: role,
+                                  context: self,
+                                  errors: @handler_result.try(:errors),
+                                  error_field_classes: "alert alert-danger") %>
 
     <%= fh.text_field name: :first_name, value: current_user.first_name, autofocus: true %>
     <%= fh.text_field name: :last_name, value: current_user.last_name %>
diff --git a/app/views/legacy/signup/start.html.erb b/app/views/legacy/signup/start.html.erb
index db48ae4631..b35f25e7c7 100644
--- a/app/views/legacy/signup/start.html.erb
+++ b/app/views/legacy/signup/start.html.erb
@@ -39,10 +39,10 @@
 
   <%= lev_form_for :signup, url: signup_path, method: :post, html: {class: 'full-width'} do |f| %>
 
-    <% fh = FormHelper::One.new(f: f,
-                                context: self,
-                                errors: @handler_result.try(:errors),
-                                error_field_classes: "alert alert-danger") %>
+    <% fh = ::FormHelper::One.new(f: f,
+                                  context: self,
+                                  errors: @handler_result.try(:errors),
+                                  error_field_classes: "alert alert-danger") %>
 
     <%
       known_role = session[:signup_role]
diff --git a/app/views/legacy/signup/verify_email.html.erb b/app/views/legacy/signup/verify_email.html.erb
index 2b5ccb790c..6a7977acf8 100644
--- a/app/views/legacy/signup/verify_email.html.erb
+++ b/app/views/legacy/signup/verify_email.html.erb
@@ -15,7 +15,7 @@
     <%= lev_form_for :pin, url: signup_verify_email_path, method: :post,
         html: {class: collect_errors.any? ? 'is-invalid' : ''} do |f| %>
 
-      <% fh = FormHelper::One.new(f: f, context: self) %>
+      <% fh = ::FormHelper::One.new(f: f, context: self) %>
 
       <%= fh.text_field name: :pin, autofocus: true %>
       <%= render(partial: "layouts/attention") %>
diff --git a/bin/rails b/bin/rails
index 0739660237..21d3e02d89 100755
--- a/bin/rails
+++ b/bin/rails
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+load File.expand_path("spring", __dir__)
 APP_PATH = File.expand_path('../config/application', __dir__)
-require_relative '../config/boot'
-require 'rails/commands'
+require_relative "../config/boot"
+require "rails/commands"
diff --git a/bin/rake b/bin/rake
index 17240489f6..7327f471e4 100755
--- a/bin/rake
+++ b/bin/rake
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
-require_relative '../config/boot'
-require 'rake'
+load File.expand_path("spring", __dir__)
+require_relative "../config/boot"
+require "rake"
 Rake.application.run
diff --git a/bin/setup b/bin/setup
index 94fd4d7977..57923026c4 100755
--- a/bin/setup
+++ b/bin/setup
@@ -1,6 +1,5 @@
 #!/usr/bin/env ruby
-require 'fileutils'
-include FileUtils
+require "fileutils"
 
 # path to your application root.
 APP_ROOT = File.expand_path('..', __dir__)
@@ -9,24 +8,22 @@ def system!(*args)
   system(*args) || abort("\n== Command #{args} failed ==")
 end
 
-chdir APP_ROOT do
-  # This script is a starting point to setup your application.
+FileUtils.chdir APP_ROOT do
+  # This script is a way to set up or update your development environment automatically.
+  # This script is idempotent, so that you can run it at any time and get an expectable outcome.
   # Add necessary setup steps to this file.
 
   puts '== Installing dependencies =='
   system! 'gem install bundler --conservative'
   system('bundle check') || system!('bundle install')
 
-  # Install JavaScript dependencies if using Yarn
-  # system('bin/yarn')
-
   # puts "\n== Copying sample files =="
   # unless File.exist?('config/database.yml')
-  #   cp 'config/database.yml.sample', 'config/database.yml'
+  #   FileUtils.cp 'config/database.yml.sample', 'config/database.yml'
   # end
 
   puts "\n== Preparing database =="
-  system! 'bin/rails db:setup'
+  system! 'bin/rails db:prepare'
 
   puts "\n== Removing old logs and tempfiles =="
   system! 'bin/rails log:clear tmp:clear'
diff --git a/bin/spring b/bin/spring
index 7fe232c3aa..b4147e8437 100755
--- a/bin/spring
+++ b/bin/spring
@@ -1,15 +1,14 @@
 #!/usr/bin/env ruby
+if !defined?(Spring) && [nil, "development", "test"].include?(ENV["RAILS_ENV"])
+  gem "bundler"
+  require "bundler"
 
-# This file loads spring without using Bundler, in order to be fast.
-# It gets overwritten when you run the `spring binstub` command.
-
-unless defined?(Spring)
-  require 'rubygems'
-  require 'bundler'
-
-  if (match = Bundler.default_lockfile.read.match(/^GEM$.*?^    (?:  )*spring \((.*?)\)$.*?^$/m))
-    Gem.paths = { 'GEM_PATH' => [Bundler.bundle_path.to_s, *Gem.path].uniq.join(Gem.path_separator) }
-    gem 'spring', match[1]
-    require 'spring/binstub'
+  # Load Spring without loading other gems in the Gemfile, for speed.
+  Bundler.locked_gems&.specs&.find { |spec| spec.name == "spring" }&.tap do |spring|
+    Gem.use_paths Gem.dir, Bundler.bundle_path.to_s, *Gem.path
+    gem "spring", spring.version
+    require "spring/binstub"
+  rescue Gem::LoadError
+    # Ignore when Spring is not installed.
   end
 end
diff --git a/bin/update b/bin/update
old mode 100644
new mode 100755
diff --git a/config.ru b/config.ru
index 6ac7b45089..4a3c09a688 100644
--- a/config.ru
+++ b/config.ru
@@ -1,5 +1,6 @@
 # This file is used by Rack-based servers to start the application.
 
-require ::File.expand_path('../config/environment',  __FILE__)
+require_relative "config/environment"
 
 run Rails.application
+Rails.application.load_server
diff --git a/config/app.yml b/config/app.yml
deleted file mode 100644
index f236987554..0000000000
--- a/config/app.yml
+++ /dev/null
@@ -1,112 +0,0 @@
-# config/app.yml for rails-settings-cached
-
-# Subjects list generated from spreadsheet via IRB:
-# require 'active_support'; include ActiveSupport::Inflector
-# books = File.read('/tmp/books.txt').split("\n")
-# books.sort.each{|bt| (b,t)=bt.split("\t"); puts underscore(b.gsub(/([\W|\s]+)/, '_'))+":\n  title: #{t}\n  sf: #{b}\n" }; 1
-
-defaults: &defaults
-  push_salesforce_lead_enabled: false
-  user_info_error_emails_enabled: false
-  send_google_analytics: false
-  google_analytics_code: UA-73668038-2
-  google_tag_manager_code: GTM-W6N7PB
-  subjects:
-    ap_macro_econ:
-      title: Principles of Macroeconomics for AP® Courses
-      sf: AP Macro Econ
-    ap_micro_econ:
-      title: Principles of Microeconomics for AP® Courses
-      sf: AP Micro Econ
-    ap_physics:
-      title: The AP Physics Collection
-      sf: AP Physics
-    accounting:
-      title: Accounting
-      sf: Accounting
-    algebra_and_trigonometry:
-      title: Algebra and Trigonometry
-      sf: Algebra and Trigonometry
-    american_government:
-      title: American Government
-      sf: American Government
-    anatomy_physiology:
-      title: Anatomy and Physiology
-      sf: Anatomy & Physiology
-    astronomy:
-      title: Astronomy
-      sf: Astronomy
-    biology:
-      title: Biology
-      sf: Biology
-    calculus:
-      title: Calculus
-      sf: Calculus
-    chem_atoms_first:
-      title: 'Chemistry: Atoms First'
-      sf: 'Chem: Atoms First'
-    chemistry:
-      title: Chemistry
-      sf: Chemistry
-    college_algebra:
-      title: College Algebra
-      sf: College Algebra
-    college_physics_algebra:
-      title: College Physics
-      sf: College Physics (Algebra)
-    concepts_of_bio_non_majors:
-      title: Concepts of Biology
-      sf: Concepts of Bio (non-majors)
-    economics:
-      title: Principles of Economics
-      sf: Economics
-    introduction_to_business:
-      title: Introduction to Business
-      sf: Introduction to Business
-    introduction_to_sociology:
-      title: Introduction to Sociology 2e
-      sf: Introduction to Sociology
-    introductory_statistics:
-      title: Introductory Statistics
-      sf: Introductory Statistics
-    macro_econ:
-      title: Principles of Macroeconomics
-      sf: Macro Econ
-    micro_econ:
-      title: Principles of Microeconomics
-      sf: Micro Econ
-    microbiology:
-      title: Microbiology
-      sf: Microbiology
-    not_listed:
-      title: Not Listed
-      sf: Not Listed
-    pre_algebra:
-      title: Prealgebra
-      sf: PreAlgebra
-    precalc:
-      title: Precalculus
-      sf: Precalc
-    psychology:
-      title: Psychology
-      sf: Psychology
-    us_history:
-      title: U.S. History
-      sf: US History
-    university_physics_calc:
-      title: University Physics
-      sf: University Physics (Calc)
-  student_feature_flag: true
-  educator_feature_flag: false
-  sheer_id_base_url: https://offers.sheerid.com/openstax/staging/teacher/?env=dev
-  number_of_days_contacts_modified: 7
-
-development:
-  <<: *defaults
-
-test:
-  <<: *defaults
-  student_feature_flag: false # until we get rid of the old flow code and tests, to make life simpler.
-
-production:
-  <<: *defaults
diff --git a/config/application.rb b/config/application.rb
index 5ba078b4f9..ae67fac812 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -1,4 +1,5 @@
 require_relative 'boot'
+
 require 'rails/all'
 
 # Require the gems listed in Gemfile, including any gems
@@ -8,60 +9,17 @@
 module Accounts
   class Application < Rails::Application
     # Initialize configuration defaults for originally generated Rails version.
-    config.load_defaults 5.2
-
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded after loading
-    # the framework and any gems in your application.
-
-    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
-    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
-    # config.time_zone = 'Central Time (US & Canada)'
-
-    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
-    # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
-    # config.i18n.default_locale = :de
-    config.i18n.default_locale = :en
-    config.i18n.available_locales = %w(en pl)
-
-    config.accounts = ActiveSupport::OrderedOptions.new
-    # configure how long a login token is valid for
-    config.accounts.default_login_token_expiration_period = 2.days
-    # configure how long a password is valid for
-    config.accounts.default_password_expiration_period = nil
-
-    # Suppress a warning
-    config.i18n.enforce_available_locales = true
-
-    # Use the ExceptionsController to rescue routing/bad request exceptions
-    # https://coderwall.com/p/w3ghqq/rails-3-2-error-handling-with-exceptions_app
-    config.exceptions_app = ->(env) { ExceptionsController.action(:rescue_from).call(env) }
-
-    # Use delayed_job for background jobs
-    config.active_job.queue_adapter = :delayed_job
-
-    redis_secrets = secrets[:redis]
-
-    # Generate the Redis URL from the its components if unset
-    redis_secrets[:url] ||= "redis#{'s' unless redis_secrets[:password].blank?}://#{
-      ":#{redis_secrets[:password]}@" unless redis_secrets[:password].blank? }#{
-      redis_secrets[:host]}#{":#{redis_secrets[:port]}" unless redis_secrets[:port].blank?}/#{
-      "/#{redis_secrets[:db]}" unless redis_secrets[:db].blank?}"
-
-    config.cache_store = :redis_store, {
-      url: redis_secrets[:url],
-      namespace: redis_secrets[:namespaces][:cache],
-      expires_in: 90.minutes,
-      compress: true,
-    }
+    config.load_defaults 6.1
 
-    def is_real_production?
-      [ 'production', 'prodtutor' ].include? secrets.environment_name
-    end
+    # Configuration for the application, engines, and railties goes here.
+    #
+    # These settings can be overridden in specific environments using the files
+    # in config/environments, which are processed later.
+    #
+    # config.time_zone = "Central Time (US & Canada)"
+    # config.eager_load_paths << Rails.root.join("extras")
 
-    # https://guides.rubyonrails.org/upgrading_ruby_on_rails.html#new-framework-defaults
-    config.active_record.belongs_to_required_by_default = false
+    # Autoload all files in lib
     config.autoload_paths += %W(#{config.root}/lib)
   end
 end
diff --git a/config/boot.rb b/config/boot.rb
index 281a7f1440..38e6c68dfc 100644
--- a/config/boot.rb
+++ b/config/boot.rb
@@ -1,7 +1,6 @@
-# Set up gems listed in the Gemfile.
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
 
 require 'bundler/setup' # Set up gems listed in the Gemfile.
-require 'bootsnap/setup' # Speed up boot time by caching expensive operations
+require 'bootsnap/setup' # Speed up boot time by caching expensive operations.
 
 require_relative 'dev_url_options'
diff --git a/config/cable.yml b/config/cable.yml
index c4df575a0b..2ae8db81fd 100644
--- a/config/cable.yml
+++ b/config/cable.yml
@@ -2,7 +2,7 @@ development:
   adapter: async
 
 test:
-  adapter: async
+  adapter: test
 
 production:
   adapter: redis
diff --git a/config/database.yml b/config/database.yml
index 8d63585e37..e09f93990c 100644
--- a/config/database.yml
+++ b/config/database.yml
@@ -9,6 +9,7 @@ default: &default
 development:
   <<: *default
   database: <%= ENV['OXA_DEV_DB'] || 'ox_accounts_dev' %>
+  <% if RUBY_PLATFORM =~ /darwin/ %>gssencmode: disable<% end %> # Prevent OS X OBJC crash
 
 # Warning: The database defined as "test" will be erased and
 # re-generated from your development database when you run "rake".
diff --git a/config/environment.rb b/config/environment.rb
index d1b115e8b8..2919ba356f 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -1,4 +1,4 @@
-# Load the Rails application
+# Load the Rails application.
 require_relative 'application'
 
 require 'env_utilities'
@@ -25,12 +25,5 @@
 require 'date_time'
 require 'educator_signup_flow_decorator'
 
-SITE_NAME = 'OpenStax Accounts'
-PAGE_TITLE_SUFFIX = SITE_NAME
-TEAM_NAME = 'OpenStax' # used when talking about our team
-COPYRIGHT_HOLDER = 'Rice University'
-
-UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
-
-# Initialize the Rails application
+# Initialize the Rails application.
 Rails.application.initialize!
diff --git a/config/environments/development.rb b/config/environments/development.rb
index 3591d23265..2fdaa7555e 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -1,8 +1,10 @@
+require 'active_support/core_ext/integer/time'
+
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
-  # In the development environment your application's code is reloaded on
-  # every request. This slows down response time but is perfect for development
+  # In the development environment your application's code is reloaded any time
+  # it changes. This slows down response time but is perfect for development
   # since you don't have to restart the web server when you make code changes.
   config.cache_classes = false
 
@@ -16,6 +18,7 @@
   # Run rails dev:cache to toggle caching.
   if Rails.root.join('tmp', 'caching-dev.txt').exist?
     config.action_controller.perform_caching = true
+    config.action_controller.enable_fragment_cache_logging = true
 
     config.cache_store = :memory_store
     config.public_file_server.headers = {
@@ -27,7 +30,7 @@
     config.cache_store = :null_store
   end
 
-  # Store uploaded files on the local file system (see config/storage.yml for options)
+  # Store uploaded files on the local file system (see config/storage.yml for options).
   config.active_storage.service = :local
 
   # Don't care if the mailer can't send.
@@ -40,6 +43,12 @@
   # Print deprecation notices to the Rails logger.
   config.active_support.deprecation = :log
 
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+
   # Raise an error on page load if there are pending migrations.
   config.active_record.migration_error = :page_load
 
@@ -54,10 +63,16 @@
   # Suppress logger output for asset requests.
   config.assets.quiet = true
 
-  # Raises error for missing translations
-  config.action_view.raise_on_missing_translations = true
+  # Raises error for missing translations.
+  config.i18n.raise_on_missing_translations = true
+
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
 
   # Use an evented file watcher to asynchronously detect changes in source code,
   # routes, locales, etc. This feature depends on the listen gem.
   config.file_watcher = ActiveSupport::EventedFileUpdateChecker
+
+  # Uncomment if you wish to allow Action Cable access from any origin.
+  # config.action_cable.disable_request_forgery_protection = true
 end
diff --git a/config/environments/production.rb b/config/environments/production.rb
index af256dede8..a656ce6873 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -1,68 +1,76 @@
+require 'active_support/core_ext/integer/time'
+
 secrets = Rails.application.secrets
 
 Rails.application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # Forgery Protection with Origin Check
-   # -- In Rails 5 you can now configure your application to check if the HTTP Origin header
-    # should be checked against the site's origin as an additional CSRF defense.
-  # https://guides.rubyonrails.org/upgrading_ruby_on_rails.html#forgery-protection-with-origin-check
-  # config.action_controller.forgery_protection_origin_check = false
+  # Settings specified here will take precedence over those in config/application.rb.
 
-  # Code is not reloaded between requests
+  # Code is not reloaded between requests.
   config.cache_classes = true
 
   # Eager load code on boot. This eager loads most of Rails and
-  # your application in memory, allowing both thread web servers
+  # your application in memory, allowing both threaded web servers
   # and those relying on copy on write to perform better.
   # Rake tasks automatically ignore this option for performance.
   config.eager_load = true
 
-  # Full error reports are disabled and caching is turned on
+  # Full error reports are disabled and caching is turned on.
   config.consider_all_requests_local       = false
   config.action_controller.perform_caching = true
 
-  # Enable Rack::Cache to put a simple HTTP cache in front of your application
-  # Add `rack-cache` to your Gemfile before enabling this.
-  # For large-scale production use, consider using a caching reverse proxy like nginx, varnish or squid.
-  # config.action_dispatch.rack_cache = true
+  # Ensures that a master key has been made available in either ENV["RAILS_MASTER_KEY"]
+  # or in config/master.key. This key is used to decrypt credentials (and other encrypted files).
+  # config.require_master_key = true
 
-  # Disable Rails's static asset server (Apache or nginx will already do this)
-  config.serve_static_files = false
+  # Disable serving static files from the `/public` folder by default since
+  # Apache or NGINX already handles this.
+  config.public_file_server.enabled = ENV['RAILS_SERVE_STATIC_FILES'].present?
 
-  # Compress JavaScripts and CSS
+  # Compress JS
   config.assets.js_compressor = Uglifier.new(harmony: true)
+
+  # Compress CSS using a preprocessor.
   # config.assets.css_compressor = :sass
 
-  # Don't fallback to assets pipeline if a precompiled asset is missed
+  # Do not fallback to assets pipeline if a precompiled asset is missed.
   config.assets.compile = false
 
+  # Enable serving of images, stylesheets, and JavaScripts from an asset server.
+  # config.asset_host = 'http://assets.example.com'
+
   # Generate digests for assets URLs
   config.assets.digest = true
 
-  # `config.assets.precompile` and `config.assets.version` have moved to config/initializers/assets.rb
+  # Specifies the header that your server uses for sending files.
+  # config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
+  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX
+
+  # Store uploaded files on the local file system (see config/storage.yml for options).
+  config.active_storage.service = :local
 
-  # Specifies the header that your server uses for sending files
-  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache
-  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx
+  # Mount Action Cable outside main process or domain.
+  # config.action_cable.mount_path = nil
+  # config.action_cable.url = 'wss://example.com/cable'
+  # config.action_cable.allowed_request_origins = [ 'http://example.com', /http:\/\/example.*/ ]
 
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
   config.force_ssl = true
 
-  # Set to :debug to see everything in the log.
+  # Include generic and useful information about system operation, but avoid logging too much
+  # information to avoid inadvertent exposure of personally identifiable information (PII).
   config.log_level = :info
 
-  # Prepend all log lines with the following tags
-  # config.log_tags = [ :subdomain, :uuid ]
+  # Prepend all log lines with the following tags.
+  config.log_tags = [ :request_id ]
 
-  # Use a different logger for distributed setups
-  # config.logger = ActiveSupport::TaggedLogging.new(SyslogLogger.new)
-
-  # Use a different cache store in production
+  # Use a different cache store in production.
   # config.cache_store = :mem_cache_store
 
-  # Enable serving of images, stylesheets, and JavaScripts from an asset server
-  # config.action_controller.asset_host = "http://assets.example.com"
+  # Use a real queuing backend for Active Job (and separate queues per environment).
+  # config.active_job.queue_adapter     = :resque
+  # config.active_job.queue_name_prefix = "accounts_production"
+
+  config.action_mailer.perform_caching = false
 
   # Ignore bad email addresses and do not raise email delivery errors.
   # Set this to true and configure the email server for immediate delivery to raise delivery errors.
@@ -72,22 +80,29 @@
   config.action_mailer.default_url_options = { protocol: 'https', host: secrets[:email_host] }
 
   # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
-  # the I18n.default_locale when a translation can not be found)
+  # the I18n.default_locale when a translation cannot be found).
   config.i18n.fallbacks = true
 
-  # Send deprecation notices to registered listeners
+  # Send deprecation notices to registered listeners.
   config.active_support.deprecation = :notify
 
-  # Disable automatic flushing of the log to improve performance.
-  # config.autoflush_log = false
+  # Log disallowed deprecations.
+  config.active_support.disallowed_deprecation = :log
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
 
   # Use default logging formatter so that PID and timestamp are not suppressed.
   config.log_formatter = ::Logger::Formatter.new
 
-  # Log to STDOUT and let systemd/journald handle the logs
-  logger           = ActiveSupport::Logger.new(STDOUT)
-  logger.formatter = config.log_formatter
-  config.logger    = ActiveSupport::TaggedLogging.new(logger)
+  # Use a different logger for distributed setups.
+  # require "syslog/logger"
+  # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name')
+  if ENV["RAILS_LOG_TO_STDOUT"].present?
+    logger           = ActiveSupport::Logger.new(STDOUT)
+    logger.formatter = config.log_formatter
+    config.logger    = ActiveSupport::TaggedLogging.new(logger)
+  end
 
   # Lograge configuration (one-line logs in production)
   config.lograge.enabled = true
@@ -102,4 +117,25 @@
 
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
+
+  # Inserts middleware to perform automatic connection switching.
+  # The `database_selector` hash is used to pass options to the DatabaseSelector
+  # middleware. The `delay` is used to determine how long to wait after a write
+  # to send a subsequent read to the primary.
+  #
+  # The `database_resolver` class is used by the middleware to determine which
+  # database is appropriate to use based on the time delay.
+  #
+  # The `database_resolver_context` class is used by the middleware to set
+  # timestamps for the last write to the primary. The resolver uses the context
+  # class timestamps to determine how long to wait before reading from the
+  # replica.
+  #
+  # By default Rails will store a last write timestamp in the session. The
+  # DatabaseSelector middleware is designed as such you can define your own
+  # strategy for connection switching and pass that into the middleware through
+  # these configuration options.
+  # config.active_record.database_selector = { delay: 2.seconds }
+  # config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
+  # config.active_record.database_resolver_context = ActiveRecord::Middleware::DatabaseSelector::Resolver::Session
 end
diff --git a/config/environments/test.rb b/config/environments/test.rb
index 8e2059c788..1d5663d862 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -1,42 +1,63 @@
+require 'active_support/core_ext/integer/time'
+
+# The test environment is used exclusively to run your application's
+# test suite. You never need to work with it otherwise. Remember that
+# your test database is "scratch space" for the test suite and is wiped
+# and recreated between test runs. Don't rely on the data there!
+
 Rails.application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
+  # Settings specified here will take precedence over those in config/application.rb.
 
-  # The test environment is used exclusively to run your application's
-  # test suite. You never need to work with it otherwise. Remember that
-  # your test database is "scratch space" for the test suite and is wiped
-  # and recreated between test runs. Don't rely on the data there!
-  config.cache_classes = true
+  config.cache_classes = false
+  config.action_view.cache_template_loading = true
 
   # Do not eager load code on boot. This avoids loading your whole application
   # just for the purpose of running a single test. If you are using a tool that
   # preloads Rails for running tests, you may have to set it to true.
   config.eager_load = ENV['CI'] == 'true'
 
-  # Configure static asset server for tests with Cache-Control for performance
-  config.serve_static_files = true
-  config.static_cache_control = 'public, max-age=3600'
+  # Configure public file server for tests with Cache-Control for performance.
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = {
+    'Cache-Control' => "public, max-age=#{1.hour.to_i}"
+  }
 
-  # Show full error reports and disable caching
+  # Show full error reports and disable caching.
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
+  config.cache_store = :null_store
 
-  # Raise exceptions instead of rendering exception templates
+  # Raise exceptions instead of rendering exception templates.
   config.action_dispatch.show_exceptions = false
 
-  # Disable request forgery protection in test environment
+  # Disable request forgery protection in test environment.
   config.action_controller.allow_forgery_protection = false
 
+  # Store uploaded files on the local file system in a temporary directory.
+  config.active_storage.service = :test
+
+  config.action_mailer.perform_caching = false
+
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
   config.action_mailer.delivery_method = :test
   config.action_mailer.default_url_options = DEV_URL_OPTIONS
 
-  # Print deprecation notices to the stderr
+  # Print deprecation notices to the stderr.
   config.active_support.deprecation = :stderr
 
-  # Raises error for missing translations
-  # config.action_view.raise_on_missing_translations = true
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+
+  # Raises error for missing translations.
+  # config.i18n.raise_on_missing_translations = true
+
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
 
   config.active_support.test_order = :random
 end
diff --git a/config/initializers/04-debugger.rb b/config/initializers/1-debugger.rb
similarity index 84%
rename from config/initializers/04-debugger.rb
rename to config/initializers/1-debugger.rb
index 0b5f26dda7..2fb7240816 100644
--- a/config/initializers/04-debugger.rb
+++ b/config/initializers/1-debugger.rb
@@ -5,7 +5,7 @@
     require 'byebug'
   else
     # Debug in VS Code
-    require 'ruby-debug-ide'
-    require 'debase'
+    # require 'ruby-debug-ide'
+    # require 'debase'
   end
 end
diff --git a/config/initializers/constants.rb b/config/initializers/2-constants.rb
similarity index 89%
rename from config/initializers/constants.rb
rename to config/initializers/2-constants.rb
index 057a7fa3cc..0a8f7d454e 100644
--- a/config/initializers/constants.rb
+++ b/config/initializers/2-constants.rb
@@ -1,3 +1,10 @@
+SITE_NAME = 'OpenStax Accounts'
+PAGE_TITLE_SUFFIX = SITE_NAME
+TEAM_NAME = 'OpenStax' # used when talking about our team
+COPYRIGHT_HOLDER = 'Rice University'
+
+UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+
 US_STATES = [ "AK",
            "Alaska",
            "AL",
@@ -107,4 +114,4 @@
            "WV",
            "West Virginia",
            "WY",
-           "Wyoming"].freeze
\ No newline at end of file
+           "Wyoming"].freeze
diff --git a/config/initializers/05-settings.rb b/config/initializers/3-settings.rb
similarity index 100%
rename from config/initializers/05-settings.rb
rename to config/initializers/3-settings.rb
diff --git a/config/initializers/4-accounts.rb b/config/initializers/4-accounts.rb
new file mode 100644
index 0000000000..15b99211a3
--- /dev/null
+++ b/config/initializers/4-accounts.rb
@@ -0,0 +1,6 @@
+accounts = ActiveSupport::OrderedOptions.new
+# configure how long a login token is valid for
+accounts.default_login_token_expiration_period = 2.days
+# configure how long a password is valid for
+accounts.default_password_expiration_period = nil
+Rails.application.config.accounts = accounts
diff --git a/config/initializers/access_policies.rb b/config/initializers/access_policies.rb
index bda01c1018..3a27faa408 100644
--- a/config/initializers/access_policies.rb
+++ b/config/initializers/access_policies.rb
@@ -1,18 +1,19 @@
 require_relative 'doorkeeper'
 
-OSU::AccessPolicy.register(Doorkeeper::Application,
-                           Doorkeeper::ApplicationAccessPolicy)
-OSU::AccessPolicy.register(User, UserAccessPolicy)
-OSU::AccessPolicy.register(AnonymousUser, UserAccessPolicy)
-OSU::AccessPolicy.register(Identity, IdentityAccessPolicy)
-OSU::AccessPolicy.register(ContactInfo, ContactInfoAccessPolicy)
-OSU::AccessPolicy.register(EmailAddress, ContactInfoAccessPolicy)
-OSU::AccessPolicy.register(Authentication, AuthenticationAccessPolicy)
-OSU::AccessPolicy.register(ApplicationUser, ApplicationUserAccessPolicy)
-OSU::AccessPolicy.register(Message, MessageAccessPolicy)
-OSU::AccessPolicy.register(Group, GroupAccessPolicy)
-OSU::AccessPolicy.register(GroupMember, GroupMemberAccessPolicy)
-OSU::AccessPolicy.register(GroupOwner, GroupOwnerAccessPolicy)
-OSU::AccessPolicy.register(GroupNesting, GroupNestingAccessPolicy)
-OSU::AccessPolicy.register(ApplicationGroup, ApplicationGroupAccessPolicy)
-OSU::AccessPolicy.register(ExternalId, ExternalIdAccessPolicy)
+Rails.application.config.after_initialize do
+  OSU::AccessPolicy.register(Doorkeeper::Application, Doorkeeper::ApplicationAccessPolicy)
+  OSU::AccessPolicy.register(User, UserAccessPolicy)
+  OSU::AccessPolicy.register(AnonymousUser, UserAccessPolicy)
+  OSU::AccessPolicy.register(Identity, IdentityAccessPolicy)
+  OSU::AccessPolicy.register(ContactInfo, ContactInfoAccessPolicy)
+  OSU::AccessPolicy.register(EmailAddress, ContactInfoAccessPolicy)
+  OSU::AccessPolicy.register(Authentication, AuthenticationAccessPolicy)
+  OSU::AccessPolicy.register(ApplicationUser, ApplicationUserAccessPolicy)
+  OSU::AccessPolicy.register(Message, MessageAccessPolicy)
+  OSU::AccessPolicy.register(Group, GroupAccessPolicy)
+  OSU::AccessPolicy.register(GroupMember, GroupMemberAccessPolicy)
+  OSU::AccessPolicy.register(GroupOwner, GroupOwnerAccessPolicy)
+  OSU::AccessPolicy.register(GroupNesting, GroupNestingAccessPolicy)
+  OSU::AccessPolicy.register(ApplicationGroup, ApplicationGroupAccessPolicy)
+  OSU::AccessPolicy.register(ExternalId, ExternalIdAccessPolicy)
+end
diff --git a/config/initializers/action_mailer.rb b/config/initializers/action_mailer.rb
index f3e88ed275..74276d1e23 100644
--- a/config/initializers/action_mailer.rb
+++ b/config/initializers/action_mailer.rb
@@ -1,12 +1,14 @@
-ActionMailer::DeliveryJob.rescue_from('AWS::SES::ResponseError') do |exception|
-  # play it extra safe with `try` in case expection schema changes we don't explode within
-  # an explosion.
-  if exception.try(:response).try(:error).try(:[],'Code') == "InvalidParameterValue"
-    # Will never succeed, so log/email the exception and don't reraise
-    OpenStax::RescueFrom.do_not_reraise do
-      OpenStax::RescueFrom.perform_rescue(exception)
+ActiveSupport.on_load(:action_mailer) do
+  ActionMailer::DeliveryJob.rescue_from('AWS::SES::ResponseError') do |exception|
+    # play it extra safe with `try` in case expection schema changes we don't explode within
+    # an explosion.
+    if exception.try(:response).try(:error).try(:[],'Code') == "InvalidParameterValue"
+      # Will never succeed, so log/email the exception and don't reraise
+      OpenStax::RescueFrom.do_not_reraise do
+        OpenStax::RescueFrom.perform_rescue(exception)
+      end
+    else
+      raise exception
     end
-  else
-    raise exception
   end
 end
diff --git a/config/initializers/active_job.rb b/config/initializers/active_job.rb
new file mode 100644
index 0000000000..6627277b2d
--- /dev/null
+++ b/config/initializers/active_job.rb
@@ -0,0 +1,2 @@
+# Use delayed_job for background jobs
+Rails.application.config.active_job.queue_adapter = :delayed_job
diff --git a/config/initializers/apipie.rb b/config/initializers/apipie.rb
index d20648602c..2b5a4f8e5f 100644
--- a/config/initializers/apipie.rb
+++ b/config/initializers/apipie.rb
@@ -9,7 +9,7 @@
   config.namespaced_resources    = false
   config.default_version         = 'v1'
   config.link_extension          = ''
-  config.app_info =              <<-eos
+  config.app_info =              <<-EOS
     Access to the API must be achieved through an OAuth flow or by having a user
     that is logged in to the system (with a session, etc).
 
@@ -34,5 +34,6 @@
     times these schemas aren't overly specific to the actions they are listed under, e.g. they
     always say that an `id` is required but that isn't the case when new data is being posted to
     a `create` call.
-    eos
+  EOS
+  config.validate = false
 end
diff --git a/config/initializers/application_controller_renderer.rb b/config/initializers/application_controller_renderer.rb
new file mode 100644
index 0000000000..89d2efab2b
--- /dev/null
+++ b/config/initializers/application_controller_renderer.rb
@@ -0,0 +1,8 @@
+# Be sure to restart your server when you modify this file.
+
+# ActiveSupport::Reloader.to_prepare do
+#   ApplicationController.renderer.defaults.merge!(
+#     http_host: 'example.org',
+#     https: false
+#   )
+# end
diff --git a/config/initializers/assets.rb b/config/initializers/assets.rb
index 2ce94c93bb..ed70d93f0b 100644
--- a/config/initializers/assets.rb
+++ b/config/initializers/assets.rb
@@ -3,8 +3,12 @@
 # Version of your assets, change this if you want to expire all your assets.
 Rails.application.config.assets.version = '1.0'
 
+# Add additional assets to the asset load path.
+# Rails.application.config.assets.paths << Emoji.images_path
+
 # Precompile additional assets.
-# application.js, application.css, and all non-JS/CSS in app/assets folder are already added.
+# application.js, application.css, and all non-JS/CSS in the app/assets
+# folder are already added.
 Rails.application.config.assets.precompile += %w(
   admin.css
   admin.js
diff --git a/config/initializers/backtrace_silencers.rb b/config/initializers/backtrace_silencers.rb
index 59385cdf37..33699c3091 100644
--- a/config/initializers/backtrace_silencers.rb
+++ b/config/initializers/backtrace_silencers.rb
@@ -1,7 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
 # You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.
-# Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ }
+# Rails.backtrace_cleaner.add_silencer { |line| /my_noisy_library/.match?(line) }
 
-# You can also remove all the silencers if you're trying to debug a problem that might stem from framework code.
-# Rails.backtrace_cleaner.remove_silencers!
+# You can also remove all the silencers if you're trying to debug a problem that might stem from framework code
+# by setting BACKTRACE=1 before calling your invocation, like "BACKTRACE=1 ./bin/rails runner 'MyClass.perform'".
+Rails.backtrace_cleaner.remove_silencers! if ENV["BACKTRACE"]
diff --git a/config/initializers/cache_store.rb b/config/initializers/cache_store.rb
new file mode 100644
index 0000000000..bfc66b4b11
--- /dev/null
+++ b/config/initializers/cache_store.rb
@@ -0,0 +1,14 @@
+redis_secrets = Rails.application.secrets[:redis]
+
+# Generate the Redis URL from the its components if unset
+redis_secrets[:url] ||= "redis#{'s' unless redis_secrets[:password].blank?}://#{
+  ":#{redis_secrets[:password]}@" unless redis_secrets[:password].blank? }#{
+  redis_secrets[:host]}#{":#{redis_secrets[:port]}" unless redis_secrets[:port].blank?}/#{
+  "/#{redis_secrets[:db]}" unless redis_secrets[:db].blank?}"
+
+Rails.application.config.cache_store = :redis_store, {
+  url: redis_secrets[:url],
+  namespace: redis_secrets[:namespaces][:cache],
+  expires_in: 90.minutes,
+  compress: true,
+}
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
new file mode 100644
index 0000000000..41c43016f1
--- /dev/null
+++ b/config/initializers/content_security_policy.rb
@@ -0,0 +1,28 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy
+# For further information see the following documentation
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
+# Rails.application.config.content_security_policy do |policy|
+#   policy.default_src :self, :https
+#   policy.font_src    :self, :https, :data
+#   policy.img_src     :self, :https, :data
+#   policy.object_src  :none
+#   policy.script_src  :self, :https
+#   policy.style_src   :self, :https
+
+#   # Specify URI for violation reports
+#   # policy.report_uri "/csp-violation-report-endpoint"
+# end
+
+# If you are using UJS then enable automatic nonce generation
+# Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }
+
+# Set the nonce only to specific directives
+# Rails.application.config.content_security_policy_nonce_directives = %w(script-src)
+
+# Report CSP violations to a specified URI
+# For further information see the following documentation:
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
+# Rails.application.config.content_security_policy_report_only = true
diff --git a/config/initializers/controllers.rb b/config/initializers/controllers.rb
index dbb539f902..9dba867b0e 100644
--- a/config/initializers/controllers.rb
+++ b/config/initializers/controllers.rb
@@ -1,98 +1,100 @@
-ActionController::Base.class_exec do
-  # We need some of the methods added here in all controllers
-  # For example, `current_user` is used in the layout so it needs to exist everywhere
-  # OpenStax Accounts's controllers all inherit from ApplicationController,
-  # but gem controllers like FinePrint's and Blazer's do not, so adding them there wouldn't work
-  # However, all controllers inherit from ActionController::Base,
-  # so adding these methods to ActionController::Base directly here should work
-  include UserSessionManagement
-  include ApplicationHelper
-  include OSU::OsuHelper
-  include HttpAcceptLanguage::AutoLocale
-  include RequireRecentSignin
-
-  include AuthenticateMethods
-
-  include ContractsNotRequired
-  helper_method :contracts_not_required
-
-  helper OSU::OsuHelper, ApplicationHelper, UserSessionManagement
-
-  prepend_before_action :set_device_id
-  before_action :save_redirect
-  before_action :set_locale
-  before_action :complete_signup_profile
-
-  fine_print_require :general_terms_of_use, :privacy_policy, unless: :disable_fine_print
-
-  protected
-
-  def complete_signup_profile
-    return true if request.format != :html || request.options?
-    redirect_to '/signup/profile' if current_user.is_needs_profile?
-    # TODO: uncomment this line after fixing openstax_path_prefixer
-    # redirect_to main_app.signup_profile_path if current_user.is_needs_profile?
-  end
-
-  def security_log(event_type, event_data = {})
-    user = event_data[:user]
-
-    if respond_to?(:current_api_user)
-      api_user = current_api_user
-      user ||= api_user.human_user
-      application = api_user.application
-    else
-      user ||= current_user
-      application = nil
+ActiveSupport.on_load(:action_controller_base) do
+  ActionController::Base.class_exec do
+    # We need some of the methods added here in all controllers
+    # For example, `current_user` is used in the layout so it needs to exist everywhere
+    # OpenStax Accounts's controllers all inherit from ApplicationController,
+    # but gem controllers like FinePrint's and Blazer's do not, so adding them there wouldn't work
+    # However, all controllers inherit from ActionController::Base,
+    # so adding these methods to ActionController::Base directly here should work
+    include UserSessionManagement
+    include ApplicationHelper
+    include OSU::OsuHelper
+    include HttpAcceptLanguage::AutoLocale
+    include RequireRecentSignin
+
+    include AuthenticateMethods
+
+    include ContractsNotRequired
+    helper_method :contracts_not_required
+
+    helper OSU::OsuHelper, ApplicationHelper, UserSessionManagement
+
+    prepend_before_action :set_device_id
+    before_action :save_redirect
+    before_action :set_locale
+    before_action :complete_signup_profile
+
+    fine_print_require :general_terms_of_use, :privacy_policy, unless: :disable_fine_print
+
+    protected
+
+    def complete_signup_profile
+      return true if request.format != :html || request.options?
+      redirect_to '/signup/profile' if current_user.is_needs_profile?
+      # TODO: uncomment this line after fixing openstax_path_prefixer
+      # redirect_to main_app.signup_profile_path if current_user.is_needs_profile?
     end
 
-    SecurityLog.create!(
-      user: user.try(:is_anonymous?) ? nil : user,
-      application: application,
-      remote_ip: request.remote_ip,
-      event_type: event_type,
-      event_data: event_data.except!(:user)
-    )
-  end
+    def security_log(event_type, event_data = {})
+      user = event_data[:user]
+
+      if respond_to?(:current_api_user)
+        api_user = current_api_user
+        user ||= api_user.human_user
+        application = api_user.application
+      else
+        user ||= current_user
+        application = nil
+      end
+
+      SecurityLog.create!(
+        user: user.try(:is_anonymous?) ? nil : user,
+        application: application,
+        remote_ip: request.remote_ip,
+        event_type: event_type,
+        event_data: event_data.except!(:user)
+      )
+    end
 
-  def save_redirect
-    return true if request.format != :html || request.options?
+    def save_redirect
+      return true if request.format != :html || request.options?
 
-    url = params[:r]
+      url = params[:r]
 
-    return true if url.blank? || !Host.trusted?(url)
+      return true if url.blank? || !Host.trusted?(url)
 
-    store_url(url: url)
-  end
+      store_url(url: url)
+    end
 
-  def disable_fine_print
-    user = respond_to?(:current_human_user) ? current_human_user : current_user
-    api_call? ||
-    user&.is_anonymous? ||
-    request.options? ||
-    contracts_not_required
-  end
+    def disable_fine_print
+      user = respond_to?(:current_human_user) ? current_human_user : current_user
+      api_call? ||
+      user&.is_anonymous? ||
+      request.options? ||
+      contracts_not_required
+    end
 
-  def set_locale
-    I18n.locale = http_accept_language.compatible_language_from(I18n.available_locales)
-  end
+    def set_locale
+      I18n.locale = http_accept_language.compatible_language_from(I18n.available_locales)
+    end
 
-  def set_device_id
-    cookies.delete(:oxdid) if device_id_invalid?
+    def set_device_id
+      cookies.delete(:oxdid) if device_id_invalid?
 
-    cookies[:oxdid] ||= {
-      value: SecureRandom.uuid,
-      expires: 20.years.from_now,
-      domain: :all,
-      secure: Rails.env.production?
-    }
-  end
+      cookies[:oxdid] ||= {
+        value: SecureRandom.uuid,
+        expires: 20.years.from_now,
+        domain: :all,
+        secure: Rails.env.production?
+      }
+    end
 
-  def get_device_id
-    cookies[:oxdid]
-  end
+    def get_device_id
+      cookies[:oxdid]
+    end
 
-  def device_id_invalid?
-    cookies[:oxdid] && !(cookies[:oxdid] =~ UUID_REGEX)
+    def device_id_invalid?
+      cookies[:oxdid] && !(cookies[:oxdid] =~ UUID_REGEX)
+    end
   end
 end
diff --git a/config/initializers/cors.rb b/config/initializers/cors.rb
index 1e34ce4f60..39ad8f3111 100644
--- a/config/initializers/cors.rb
+++ b/config/initializers/cors.rb
@@ -6,11 +6,11 @@
 # Read more: https://github.com/cyu/rack-cors
 
 Rails.application.config.middleware.insert_before 0, Rack::Cors do
-	allow do
-		origins /(.*\.|)localhost\:?.*/, /(.*\.|)127.0.0.1\:?.*/, /(.*\.|)openstax\.org/, 'www.example.com'
-		resource '*',
-		         headers: :any,
-		         methods: %i[get post put patch delete options head],
-		         credentials: true
-	end
+  allow do
+    origins /(.*\.|)localhost\:?.*/, /(.*\.|)127.0.0.1\:?.*/, /(.*\.|)openstax\.org/
+    resource '*',
+      headers: :any,
+      methods: [:get, :post, :put, :patch, :delete, :options, :head],
+      credentials: true
+  end
 end
diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb
index 94aacd4fec..55b2c32ece 100644
--- a/config/initializers/doorkeeper.rb
+++ b/config/initializers/doorkeeper.rb
@@ -101,7 +101,7 @@
   # For more information go to
   # https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-Scopes
   #
-  # default_scopes  :public
+  default_scopes :all
   # optional_scopes :write, :update
 
   # Change the way client credentials are retrieved from the request object.
diff --git a/config/initializers/exceptions.rb b/config/initializers/exceptions.rb
new file mode 100644
index 0000000000..939ae0f9ef
--- /dev/null
+++ b/config/initializers/exceptions.rb
@@ -0,0 +1,5 @@
+# Use the ExceptionsController to rescue routing/bad request exceptions
+# https://coderwall.com/p/w3ghqq/rails-3-2-error-handling-with-exceptions_app
+Rails.application.config.exceptions_app = ->(env) {
+  ExceptionsController.action(:rescue_from).call(env)
+}
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index 4a994e1e7b..6a1041bda3 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -1,4 +1,6 @@
 # Be sure to restart your server when you modify this file.
 
 # Configure sensitive parameters which will be filtered from the log file.
-Rails.application.config.filter_parameters += [:password]
+Rails.application.config.filter_parameters += [
+  :passw, :password, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
+]
diff --git a/config/initializers/i18n.rb b/config/initializers/i18n.rb
new file mode 100644
index 0000000000..2999cb2489
--- /dev/null
+++ b/config/initializers/i18n.rb
@@ -0,0 +1,3 @@
+i18n = Rails.application.config.i18n
+i18n.available_locales = %w(en pl)
+i18n.enforce_available_locales = true
diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb
index 9262c3379f..ac033bf9dc 100644
--- a/config/initializers/inflections.rb
+++ b/config/initializers/inflections.rb
@@ -9,7 +9,7 @@
 #   inflect.irregular 'person', 'people'
 #   inflect.uncountable %w( fish sheep )
 # end
-#
+
 # These inflection rules are supported but not enabled by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
 #   inflect.acronym 'RESTful'
diff --git a/config/initializers/lev.rb b/config/initializers/lev.rb
index 745b6f8315..1adb6c5bd9 100644
--- a/config/initializers/lev.rb
+++ b/config/initializers/lev.rb
@@ -1,4 +1,6 @@
-Lev.configure do |config|
-  config.raise_fatal_errors = false
-  config.job_class = ActiveJob::Base
+ActiveSupport.on_load(:active_job) do
+  Lev.configure do |config|
+    config.raise_fatal_errors = false
+    config.job_class = ActiveJob::Base
+  end
 end
diff --git a/config/initializers/openstax_utilities.rb b/config/initializers/openstax_utilities.rb
index 861d70dc3d..d1fe13c7ba 100644
--- a/config/initializers/openstax_utilities.rb
+++ b/config/initializers/openstax_utilities.rb
@@ -9,9 +9,8 @@
       next
     end
 
-    next if !Rails.application.is_real_production? || current_user.is_administrator?
-
-    raise SecurityTransgression
+    raise SecurityTransgression if Rails.application.secrets.environment_name == 'production' &&
+                                   !current_user.is_administrator?
   end
   secrets = Rails.application.secrets
   config.environment_name = secrets.environment_name
diff --git a/config/initializers/permissions_policy.rb b/config/initializers/permissions_policy.rb
new file mode 100644
index 0000000000..00f64d71b0
--- /dev/null
+++ b/config/initializers/permissions_policy.rb
@@ -0,0 +1,11 @@
+# Define an application-wide HTTP permissions policy. For further
+# information see https://developers.google.com/web/updates/2018/06/feature-policy
+#
+# Rails.application.config.permissions_policy do |f|
+#   f.camera      :none
+#   f.gyroscope   :none
+#   f.microphone  :none
+#   f.usb         :none
+#   f.fullscreen  :self
+#   f.payment     :self, "https://secure.example.com"
+# end
diff --git a/config/initializers/rails_settings_ui.rb b/config/initializers/rails_settings_ui.rb
deleted file mode 100644
index e69311601d..0000000000
--- a/config/initializers/rails_settings_ui.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-require 'rails-settings-ui'
-
-# Uncomment the following once we upgrade to a newer version of rails-settings-cached:
-#
-# # Compatibility with newer versions of rails-settings-cached
-# module RailsSettingsUi
-#   class << self
-#     def default_settings
-#       settings = RailsSettingsUi.settings_klass.defaults
-#       settings.reject { |name, _description| ignored_settings.include?(name.to_sym) }
-#     end
-#   end
-# end
-
-RailsSettingsUi.setup do |config|
-  # Specify a controller for RailsSettingsUi::ApplicationController to inherit from:
-  config.parent_controller = 'Admin::BaseController' # default: '::ApplicationController'
-
-  config.settings_class = 'Settings::Db::Store'
-end
-
-Rails.application.config.to_prepare do
-  # If you use a *custom layout*, make route helpers available to RailsSettingsUi:
-  # RailsSettingsUi.inline_engine_routes!
-  RailsSettingsUi::ApplicationController.module_eval do
-    # Render RailsSettingsUi inside a custom layout
-    # (set to 'application' to use app layout, default is RailsSettingsUi's own layout)
-    layout 'admin'
-  end
-end
diff --git a/config/initializers/rescue_from.rb b/config/initializers/rescue_from.rb
index 38d5bb6d35..c05d0918be 100644
--- a/config/initializers/rescue_from.rb
+++ b/config/initializers/rescue_from.rb
@@ -4,7 +4,10 @@
 exception_secrets = secrets.exception
 OpenStax::RescueFrom.configure do |config|
   # Show the default Rails exception debugging page on dev
-  config.raise_exceptions = EnvUtilities.load_boolean(name: 'RAISE', default: Rails.env.development?)
+  config.raise_exceptions = EnvUtilities.load_boolean(
+    name: 'RAISE',
+    default: Rails.env.development? && Rails.application.config.consider_all_requests_local
+  )
 
   config.app_name = 'Accounts'
   config.contact_name = exception_secrets[:contact_name]&.html_safe
@@ -23,11 +26,15 @@
 
 OpenStax::RescueFrom.register_exception('Lev::SecurityTransgression', notify: false, status: :forbidden)
 
-# Exceptions in controllers are not automatically reraised in production-like environments
-ActionController::Base.use_openstax_exception_rescue
+ActiveSupport.on_load(:action_controller_base) do
+  # Exceptions in controllers are not automatically reraised in production-like environments
+  ActionController::Base.use_openstax_exception_rescue
+end
 
-# RescueFrom always reraises background exceptions so that the background job may properly fail
-ActiveJob::Base.use_openstax_exception_rescue
+ActiveSupport.on_load(:active_job) do
+  # RescueFrom always reraises background exceptions so that the background job may properly fail
+  ActiveJob::Base.use_openstax_exception_rescue
+end
 
 module OpenStax::RescueFrom
   def self.default_friendly_message
diff --git a/config/initializers/wrap_parameters.rb b/config/initializers/wrap_parameters.rb
index c3c181bdc1..bbfc3961bf 100644
--- a/config/initializers/wrap_parameters.rb
+++ b/config/initializers/wrap_parameters.rb
@@ -1,5 +1,5 @@
 # Be sure to restart your server when you modify this file.
-#
+
 # This file contains settings for ActionController::ParamsWrapper which
 # is enabled by default.
 
@@ -10,5 +10,5 @@
 
 # To enable root element in JSON for ActiveRecord objects.
 # ActiveSupport.on_load(:active_record) do
-#  self.include_root_in_json = true
+#   self.include_root_in_json = true
 # end
diff --git a/config/locales/activerecord.en.yml b/config/locales/activerecord.en.yml
index 3deae3a55b..2a95fd64c5 100644
--- a/config/locales/activerecord.en.yml
+++ b/config/locales/activerecord.en.yml
@@ -132,8 +132,8 @@ en:
           attributes:
             # Marking &email_address for reference later.
             value: &email_addres_validations
-              invalid: “%{value}” is not a valid email address
-              missing_mx_records: “%{value}” is not a valid email address
+              invalid: <b>%{value}</b> is not a valid email address
+              missing_mx_records: <b>%{value}</b> is not a valid email address
               too_many_dots: This email has too many dots in a row
               ends_with_dot: An email cannot end with a dot
               contains_tick: An email should not contain a tick (`)
diff --git a/config/locales/activerecord.pl.yml b/config/locales/activerecord.pl.yml
index af8e170a87..e63d6eacd3 100644
--- a/config/locales/activerecord.pl.yml
+++ b/config/locales/activerecord.pl.yml
@@ -135,8 +135,8 @@ pl:
         email_address:
           attributes:
             value: &email_address_validations
-              invalid: „%{value}” nie jest poprawnym adresem e-mail
-              missing_mx_records: „%{value}” nie jest poprawnym adresem e-mail
+              invalid: <b>%{value}</b> nie jest poprawnym adresem e-mail
+              missing_mx_records: <b>%{value}</b> nie jest poprawnym adresem e-mail
               too_many_dots: Adres e-mail ma zbyt wiele kropek pod rząd
               ends_with_dot: Adres e-mail nie może kończyć się kropką
               contains_tick: Adres e-mail nie może zawierać znaku „`”
diff --git a/config/locales/doorkeeper.en.yml b/config/locales/doorkeeper.en.yml
index 0e5bbf2f46..8fb47302c0 100644
--- a/config/locales/doorkeeper.en.yml
+++ b/config/locales/doorkeeper.en.yml
@@ -87,7 +87,11 @@ en:
     errors:
       messages:
         # Common error messages
-        invalid_request: 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.'
+        invalid_request:
+          unknown: 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.'
+          missing_param: 'Missing required parameter: %{value}.'
+          not_support_pkce: 'Invalid code_verifier parameter. Server does not support pkce.'
+          request_not_authorized: 'Request need to be authorized. Required parameter for authorizing request is missing or invalid.'
         invalid_redirect_uri: "The requested redirect uri is malformed or doesn't match client redirect URI."
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'
@@ -135,3 +139,8 @@ en:
           home: 'Home'
       application:
         title: 'OAuth authorization required'
+
+    scopes:
+      public: 'Access your public data'
+      write: 'Update your information'
+      admin: 'Change your preferences'
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 785665e878..e7d4c9f712 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1,3 +1,34 @@
+# Files in the config/locales directory are used for internationalization
+# and are automatically loaded by Rails. If you want to use locales other
+# than English, add the necessary files in this directory.
+#
+# To use the locales, use `I18n.t`:
+#
+#     I18n.t 'hello'
+#
+# In views, this is aliased to just `t`:
+#
+#     <%= t('hello') %>
+#
+# To use a different locale, set it with `I18n.locale`:
+#
+#     I18n.locale = :es
+#
+# This would use the information in config/locales/es.yml.
+#
+# The following keys must be escaped otherwise they will not be retrieved by
+# the default I18n backend:
+#
+# true, false, on, off, yes, no
+#
+# Instead, surround them with single quotes.
+#
+# en:
+#   'true': 'foo'
+#
+# To learn more, please read the Rails Internationalization guide
+# available at https://guides.rubyonrails.org/i18n.html.
+
 en:
   educator_profile_form:
     complete_page_header: Complete your profile
@@ -143,7 +174,6 @@ en:
       Your new password cannot be the same as your current password.
     same_password_error: Your new password cannot be the same as your current password
     email_address_taken: Email already in use
-    invalid_email_provider: '"%{email}" is not a valid email'
     too_many_login_attempts: >-
       You have made too many login attempts recently. Please
       reset your password or try again later.
@@ -380,42 +410,6 @@ en:
     attention:
       please_enable_javascript: Please enable JavaScript.
 
-  settings:
-    attributes:
-      subjects:
-        name: Subjects
-        help_block: List of subjects that teachers choose from whe signing up
-      push_salesforce_lead_enabled:
-        name: 'Push leads to Salesforce?'
-        help_block: 'If checked (and SF configured), new accounts will be pushed to SF as Leads'
-      user_info_error_emails_enabled:
-        name: 'Enable user info update error emails?'
-        help_block: 'If checked (and SF configured), once-a-day user update error emails will go out'
-      send_google_analytics:
-        name: 'Send Google Analytics data?'
-        help_block: 'If checked Google Analytics data will be sent.'
-      google_analytics_code:
-        name: 'Google Analytics Code'
-        help_block: 'Example: UA-XXXXXXXX-X'
-      google_tag_manager_code:
-        name: 'Google Tag Manager Code'
-        help_block: 'Example: GTM-XXXX'
-      student_feature_flag:
-        name: New student flow feature flag
-        help_block: New student flow activated?
-      educator_feature_flag:
-        name: New educator flow feature flag
-        help_block: New educator flow activated?
-      sheer_id_base_url:
-        name: SheerID base URL
-        help_block: >-
-          ie. https://offers.sheerid.com/openstax/staging/teacher/?env=dev
-          With the parameters that pre-populate the SheerID form, the full URL will look like
-          ie. https://offers.sheerid.com/openstax/staging/teacher/?env=dev&first_name=Elon&last_name=Musk&email=ceo@spacex.com
-      number_of_days_contacts_modified:
-        name: Contacts modified in last x days
-        help_block: Retrieve contacts modified in the last X days in update_user_salesforce_info
-
   faculty_access:
     apply:
       page_heading: Apply for instructor access
diff --git a/config/locales/pl.yml b/config/locales/pl.yml
index 3a875be57d..fee2a83a80 100644
--- a/config/locales/pl.yml
+++ b/config/locales/pl.yml
@@ -101,7 +101,7 @@ pl:
        W międzyczasie możesz uzyskać dostęp do wszystkich książek i zasobów
        z wyjątkiem tych, które wymagają weryfikacji instruktora.
     join_as_student_description: >-
-      Zarejestruj się jako <b>Student</b>, aby tworzyć i zapisywać 
+      Zarejestruj się jako <b>Student</b>, aby tworzyć i zapisywać
       notatki i podkreślenia w materiałach do nauki OpenStax.
     join_as_educator_description: >-
       Zarejestruj się jako <b>Nauczyciel</b>, by zgłosić nam, że korzystasz z podręcznika,
@@ -141,7 +141,6 @@ pl:
       Twoje nowe hasło nie może być takie samo jak Twoje aktualne hasło.
     same_password_error: Twoje nowe hasło nie może być takie samo jak Twoje aktualne hasło
     email_address_taken: Ten adres e-mail jest już w użyciu
-    invalid_email_provider: '"%{email}" nie jest poprawnym adresem e-mail'
     too_many_login_attempts: >-
       Limit nieudanych prób logowania na Twoje konto został przekroczony.
       Zmień hasło albo spróbuj ponownie później.
diff --git a/config/puma.rb b/config/puma.rb
index 9c3dae996b..2e447bc7d8 100644
--- a/config/puma.rb
+++ b/config/puma.rb
@@ -11,35 +11,12 @@
 
 NUM_WORKERS = ENV.fetch('WEB_CONCURRENCY') { Etc.nprocessors }.to_i
 
-worker_timeout ENV.fetch('WORKER_TIMEOUT', 60).to_i
-
 stdout_redirect(
   ENV.fetch('STDOUT_LOGFILE', "#{APP_DIR}/log/puma.stdout.log"),
   ENV.fetch('STDERR_LOGFILE', "#{APP_DIR}/log/puma.stderr.log"),
   true
 ) if ActiveModel::Type::Boolean.new.cast(ENV.fetch('REDIRECT_STDOUT', false))
 
-before_fork do
-  require 'puma_worker_killer'
-
-  PumaWorkerKiller.config do |config|
-    # Restart workers when they start consuming too much of the RAM
-    config.ram = ENV.fetch('MAX_MEMORY') do
-      ENV.fetch('MAX_WORKER_MEMORY', 1024).to_i * NUM_WORKERS
-    end.to_i
-
-    config.frequency = 10
-
-    config.percent_usage = 0.75
-
-    config.rolling_restart_frequency = false
-
-    config.reaper_status_logs = false
-  end
-
-  PumaWorkerKiller.start
-end
-
 # https://github.com/rails/rails/blob/master/railties/lib/rails/generators/rails/app/templates/config/puma.rb.tt
 
 # Puma can serve each request in a thread from an internal thread pool.
@@ -48,24 +25,28 @@
 # the maximum value specified for Puma. Default is set to 5 threads for minimum
 # and maximum; this matches the default thread size of Active Record.
 #
-max_threads = ENV.fetch('RAILS_MAX_THREADS', 5).to_i
-threads ENV.fetch('RAILS_MIN_THREADS', max_threads).to_i, max_threads
+max_threads_count = ENV.fetch('RAILS_MAX_THREADS') { 5 }
+min_threads_count = ENV.fetch('RAILS_MIN_THREADS') { max_threads_count }
+threads min_threads_count, max_threads_count
+
+# Specifies the `worker_timeout` threshold that Puma will use to wait before
+# terminating a worker in development environments.
+#
+worker_timeout ENV.fetch('WORKER_TIMEOUT', 60).to_i
 
 if ENV['SOCKET']
   # Specifies the `socket` to which Puma will bind to receive requests.
   bind ENV['SOCKET']
 else
   # Specifies the `port` that Puma will listen on to receive requests; default is DEV_PORT (2999).
-  port ENV.fetch('PORT', DEV_PORT)
+  port ENV.fetch('PORT') { DEV_PORT }
 end
 
 # Specifies the `environment` that Puma will run in.
-#
-environment ENV.fetch('RAILS_ENV', 'development')
+environment ENV.fetch('RAILS_ENV') { 'development' }
 
 # Specifies the `pidfile` that Puma will use.
-#
-pidfile ENV.fetch('PIDFILE', 'tmp/pids/puma.pid')
+pidfile ENV.fetch('PIDFILE') { 'tmp/pids/server.pid' }
 
 # Specifies the number of `workers` to boot in clustered mode.
 # Workers are forked web server processes. If using threads and workers together
@@ -82,13 +63,30 @@
 #
 preload_app! if ActiveModel::Type::Boolean.new.cast(ENV.fetch('PRELOAD_APP', false))
 
+before_fork do
+  require 'puma_worker_killer'
+
+  PumaWorkerKiller.config do |config|
+    # Restart workers when they start consuming too much of the RAM
+    config.ram = ENV.fetch('MAX_MEMORY') do
+      ENV.fetch('MAX_WORKER_MEMORY', 1024).to_i * NUM_WORKERS
+    end.to_i
+
+    config.frequency = 10
+
+    config.percent_usage = 0.75
+
+    config.rolling_restart_frequency = false
+
+    config.reaper_status_logs = false
+  end
+
+  PumaWorkerKiller.start
+end
+
 # Allow puma to be restarted by `rails restart` command.
-#
 plugin :tmp_restart
 
-# Call GC.start and GC.compact before forking to try to reduce worker memory usage
-nakayoshi_fork
-
 # Adds a small delay before accepting requests if the worker (process) has threads already
 # processing other requests, to try to get idle workers to accept the request
 wait_for_less_busy_worker ENV.fetch('WAIT_FOR_LESS_BUSY_WORKERS', '0.005').to_f
diff --git a/config/routes.rb b/config/routes.rb
index 8cabcb5004..60c914cff2 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,6 +1,6 @@
 # rubocop:disable Metrics/BlockLength
 Rails.application.routes.draw do
-  # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
+  # For details on the DSL available within this file, see https://guides.rubyonrails.org/routing.html
   root to: 'static_pages#home'
 
   direct :salesforce_knowledge_base do
@@ -310,15 +310,13 @@
     resources :external_ids, only: [:destroy]
 
     mount Blazer::Engine, at: "blazer", as: 'blazer_admin'
-
-    mount RailsSettingsUi::Engine, at: 'settings'
   end
 
   namespace 'dev' do
     resources :users, only: [:create] do
       post 'generate', on: :collection
     end
-  end
+  end unless Rails.env.production?
 
   if Rails.env.test?
     get '/external_app_for_specs' => 'external_app_for_specs#index'
diff --git a/config/spring.rb b/config/spring.rb
index 9fa7863f99..db5bf1307a 100644
--- a/config/spring.rb
+++ b/config/spring.rb
@@ -1,6 +1,6 @@
-%w[
-  .ruby-version
-  .rbenv-vars
-  tmp/restart.txt
-  tmp/caching-dev.txt
-].each { |path| Spring.watch(path) }
+Spring.watch(
+  ".ruby-version",
+  ".rbenv-vars",
+  "tmp/restart.txt",
+  "tmp/caching-dev.txt"
+)
diff --git a/db/migrate/20241004201505_add_foreign_key_constraint_to_active_storage_attachments_for_blob_id.active_storage.rb b/db/migrate/20241004201505_add_foreign_key_constraint_to_active_storage_attachments_for_blob_id.active_storage.rb
new file mode 100644
index 0000000000..ff5d72c7ea
--- /dev/null
+++ b/db/migrate/20241004201505_add_foreign_key_constraint_to_active_storage_attachments_for_blob_id.active_storage.rb
@@ -0,0 +1,10 @@
+# This migration comes from active_storage (originally 20180723000244)
+class AddForeignKeyConstraintToActiveStorageAttachmentsForBlobId < ActiveRecord::Migration[6.0]
+  def up
+    return if foreign_key_exists?(:active_storage_attachments, column: :blob_id)
+
+    if table_exists?(:active_storage_blobs)
+      add_foreign_key :active_storage_attachments, :active_storage_blobs, column: :blob_id
+    end
+  end
+end
diff --git a/db/migrate/20241008205807_add_service_name_to_active_storage_blobs.active_storage.rb b/db/migrate/20241008205807_add_service_name_to_active_storage_blobs.active_storage.rb
new file mode 100644
index 0000000000..a15c6ce8e5
--- /dev/null
+++ b/db/migrate/20241008205807_add_service_name_to_active_storage_blobs.active_storage.rb
@@ -0,0 +1,22 @@
+# This migration comes from active_storage (originally 20190112182829)
+class AddServiceNameToActiveStorageBlobs < ActiveRecord::Migration[6.0]
+  def up
+    return unless table_exists?(:active_storage_blobs)
+
+    unless column_exists?(:active_storage_blobs, :service_name)
+      add_column :active_storage_blobs, :service_name, :string
+
+      if configured_service = ActiveStorage::Blob.service.name
+        ActiveStorage::Blob.unscoped.update_all(service_name: configured_service)
+      end
+
+      change_column :active_storage_blobs, :service_name, :string, null: false
+    end
+  end
+
+  def down
+    return unless table_exists?(:active_storage_blobs)
+
+    remove_column :active_storage_blobs, :service_name
+  end
+end
diff --git a/db/migrate/20241008205808_create_active_storage_variant_records.active_storage.rb b/db/migrate/20241008205808_create_active_storage_variant_records.active_storage.rb
new file mode 100644
index 0000000000..94ac83af0b
--- /dev/null
+++ b/db/migrate/20241008205808_create_active_storage_variant_records.active_storage.rb
@@ -0,0 +1,27 @@
+# This migration comes from active_storage (originally 20191206030411)
+class CreateActiveStorageVariantRecords < ActiveRecord::Migration[6.0]
+  def change
+    return unless table_exists?(:active_storage_blobs)
+
+    # Use Active Record's configured type for primary key
+    create_table :active_storage_variant_records, id: primary_key_type, if_not_exists: true do |t|
+      t.belongs_to :blob, null: false, index: false, type: blobs_primary_key_type
+      t.string :variation_digest, null: false
+
+      t.index %i[ blob_id variation_digest ], name: "index_active_storage_variant_records_uniqueness", unique: true
+      t.foreign_key :active_storage_blobs, column: :blob_id
+    end
+  end
+
+  private
+    def primary_key_type
+      config = Rails.configuration.generators
+      config.options[config.orm][:primary_key_type] || :primary_key
+    end
+
+    def blobs_primary_key_type
+      pkey_name = connection.primary_key(:active_storage_blobs)
+      pkey_column = connection.columns(:active_storage_blobs).find { |c| c.name == pkey_name }
+      pkey_column.bigint? ? :bigint : pkey_column.type
+    end
+end
diff --git a/db/migrate/20241015172425_set_doorkeeper_scopes.rb b/db/migrate/20241015172425_set_doorkeeper_scopes.rb
new file mode 100644
index 0000000000..99bd501636
--- /dev/null
+++ b/db/migrate/20241015172425_set_doorkeeper_scopes.rb
@@ -0,0 +1,23 @@
+class SetDoorkeeperScopes < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+
+  def up
+    change_column_default :oauth_access_grants, :scopes, ''
+    Doorkeeper::AccessGrant.in_batches.update_all scopes: 'all'
+    change_column_null :oauth_access_grants, :scopes, false
+
+    change_column_default :oauth_access_tokens, :scopes, ''
+    Doorkeeper::AccessToken.in_batches.update_all scopes: 'all'
+    change_column_null :oauth_access_tokens, :scopes, false
+  end
+
+  def down
+    change_column_null :oauth_access_tokens, :scopes, true
+    Doorkeeper::AccessToken.in_batches.update_all scopes: ''
+    change_column_default :oauth_access_tokens, :scopes, nil
+
+    change_column_null :oauth_access_grants, :scopes, true
+    Doorkeeper::AccessGrant.in_batches.update_all scopes: ''
+    change_column_default :oauth_access_grants, :scopes, nil
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 25d004d8e7..74bf3a5095 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -2,15 +2,15 @@
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
 #
-# Note that this schema.rb definition is the authoritative source for your
-# database schema. If you need to create the application database on another
-# system, you should be using db:schema:load, not running all the migrations
-# from scratch. The latter is a flawed and unsustainable approach (the more migrations
-# you'll amass, the slower it'll run and the greater likelihood for issues).
+# This file is the source Rails uses to define your schema when running `bin/rails
+# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to
+# be faster and is potentially less error prone than running all of your
+# migrations from scratch. Old migrations may fail to apply correctly if those
+# migrations use external dependencies or application code.
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2024_08_08_171751) do
+ActiveRecord::Schema.define(version: 2024_10_15_172425) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "citext"
@@ -289,7 +289,7 @@
     t.text "redirect_uri", null: false
     t.datetime "created_at", null: false
     t.datetime "revoked_at"
-    t.string "scopes"
+    t.string "scopes", default: "", null: false
     t.index ["token"], name: "index_oauth_access_grants_on_token", unique: true
   end
 
@@ -301,7 +301,7 @@
     t.integer "expires_in"
     t.datetime "revoked_at"
     t.datetime "created_at", null: false
-    t.string "scopes"
+    t.string "scopes", default: "", null: false
     t.string "previous_refresh_token", default: "", null: false
     t.index ["application_id", "created_at"], name: "index_oauth_access_tokens_on_application_id_and_created_at", where: "((resource_owner_id IS NULL) AND (revoked_at IS NULL))"
     t.index ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
diff --git a/lib/error_page_builder.rb b/lib/error_page_builder.rb
index a84b585dc2..bd5180eab9 100644
--- a/lib/error_page_builder.rb
+++ b/lib/error_page_builder.rb
@@ -1,8 +1,4 @@
-require 'render_anywhere'
-
 class ErrorPageBuilder
-  include RenderAnywhere
-
   attr_reader :view, :message, :code
 
   def initialize(view:, message:, code:)
@@ -12,8 +8,10 @@ def initialize(view:, message:, code:)
   end
 
   def build
-    render template: 'errors/static',
-           layout: 'static_error',
-           locals: { view: view, message: message, code: code }
+    ApplicationController.renderer.render(
+      template: 'errors/static',
+      layout: 'static_error',
+      locals: { view: view, message: message, code: code }
+    )
   end
 end
diff --git a/lib/json_serialize.rb b/lib/json_serialize.rb
index 26468fccaa..a372c943c8 100644
--- a/lib/json_serialize.rb
+++ b/lib/json_serialize.rb
@@ -50,4 +50,4 @@ def validate_each(record, attribute, value)
 
 end
 
-ActiveRecord::Base.extend JsonSerialize::ClassMethods
+ActiveSupport.on_load(:active_record) { ActiveRecord::Base.extend JsonSerialize::ClassMethods }
diff --git a/lib/settings.rb b/lib/settings.rb
index e07bb9fc30..3e291278c3 100644
--- a/lib/settings.rb
+++ b/lib/settings.rb
@@ -16,16 +16,131 @@
 module Settings
   module Db
     class Store < RailsSettings::Base
-      source Rails.root.join("config/app.yml")
-      namespace Rails.env
-
-      # Workaround (this method missing in current implementation, but RailsSettings-UI
-      # expects it -- doesn't really need to use it any more b/c RailsSettingsCached
-      # deals with defaults internally)
-      def self.defaults
-        result = RailsSettings::Default.enabled? ? RailsSettings::Default.instance : {}
-        result.with_indifferent_access
-      end
+      field :push_salesforce_lead_enabled, type: :boolean, default: false
+      field :user_info_error_emails_enabled, type: :boolean, default: false
+      field :send_google_analytics, type: :boolean, default: false
+      field :google_analytics_code, type: :string, default: 'UA-73668038-2'
+      field :google_tag_manager_code, type: :string, default: 'GTM-W6N7PB'
+      field :subjects, type: :hash, default: {
+        ap_macro_econ: {
+          title: 'Principles of Macroeconomics for AP® Courses',
+          sf: 'AP Macro Econ'
+        },
+        ap_micro_econ: {
+          title: 'Principles of Microeconomics for AP® Courses',
+          sf: 'AP Micro Econ'
+        },
+        ap_physics: {
+          title: 'The AP Physics Collection',
+          sf: 'AP Physics'
+        },
+        accounting: {
+          title: 'Accounting',
+          sf: 'Accounting'
+        },
+        algebra_and_trigonometry: {
+          title: 'Algebra and Trigonometry',
+          sf: 'Algebra and Trigonometry'
+        },
+        american_government: {
+          title: 'American Government',
+          sf: 'American Government'
+        },
+        anatomy_physiology: {
+          title: 'Anatomy and Physiology',
+          sf: 'Anatomy & Physiology'
+        },
+        astronomy: {
+          title: 'Astronomy',
+          sf: 'Astronomy'
+        },
+        biology: {
+          title: 'Biology',
+          sf: 'Biology'
+        },
+        calculus: {
+          title: 'Calculus',
+          sf: 'Calculus'
+        },
+        chem_atoms_first: {
+          title: 'Chemistry: Atoms First',
+          sf: 'Chem: Atoms First'
+        },
+        chemistry: {
+          title: 'Chemistry',
+          sf: 'Chemistry'
+        },
+        college_algebra: {
+          title: 'College Algebra',
+          sf: 'College Algebra'
+        },
+        college_physics_algebra: {
+          title: 'College Physics',
+          sf: 'College Physics (Algebra)'
+        },
+        concepts_of_bio_non_majors: {
+          title: 'Concepts of Biology',
+          sf: 'Concepts of Bio (non-majors)'
+        },
+        economics: {
+          title: 'Principles of Economics',
+          sf: 'Economics'
+        },
+        introduction_to_business: {
+          title: 'Introduction to Business',
+          sf: 'Introduction to Business'
+        },
+        introduction_to_sociology: {
+          title: 'Introduction to Sociology 2e',
+          sf: 'Introduction to Sociology'
+        },
+        introductory_statistics: {
+          title: 'Introductory Statistics',
+          sf: 'Introductory Statistics'
+        },
+        macro_econ: {
+          title: 'Principles of Macroeconomics',
+          sf: 'Macro Econ'
+        },
+        micro_econ: {
+          title: 'Principles of Microeconomics',
+          sf: 'Micro Econ'
+        },
+        microbiology: {
+          title: 'Microbiology',
+          sf: 'Microbiology'
+        },
+        not_listed: {
+          title: 'Not Listed',
+          sf: 'Not Listed'
+        },
+        pre_algebra: {
+          title: 'Prealgebra',
+          sf: 'PreAlgebra'
+        },
+        precalc: {
+          title: 'Precalculus',
+          sf: 'Precalc'
+        },
+        psychology: {
+          title: 'Psychology',
+          sf: 'Psychology'
+        },
+        us_history: {
+          title: 'U.S. History',
+          sf: 'US History'
+        },
+        university_physics_calc: {
+          title: 'University Physics',
+          sf: 'University Physics (Calc)'
+        }
+      }
+      # The default here enables the old login flow in the test env
+      field :student_feature_flag, type: :boolean, default: true
+      field :educator_feature_flag, type: :boolean, default: true
+      field :sheer_id_base_url,
+            type: :string, default: 'https://offers.sheerid.com/openstax/staging/teacher/?env=dev'
+      field :number_of_days_contacts_modified, type: :integer, default: 7
     end
 
     mattr_accessor :store
@@ -43,4 +158,4 @@ module Redis
 end
 
 # Load the settings wrappers
-Dir[File.join(__dir__, 'settings', '*.rb')].each{ |file| require file }
+Dir[File.join(__dir__, 'settings', '*.rb')].each { |file| require file }
diff --git a/lib/sso_cookie_jar.rb b/lib/sso_cookie_jar.rb
index ca6ee284cf..4b5cbe9b16 100644
--- a/lib/sso_cookie_jar.rb
+++ b/lib/sso_cookie_jar.rb
@@ -18,11 +18,11 @@ def delete(options = {})
     @parent_jar.delete @@cookie_name, options.reverse_merge(@@cookie_options)
   end
 
-  def parse(name, encrypted_message, purpose: nil)
-    SsoCookie.read encrypted_message
+  def parse(name, data, purpose: nil)
+    SsoCookie.read data
   end
 
-  def commit(options)
+  def commit(name, options)
     options[:value] = SsoCookie.generate options
     options.reverse_merge! @@cookie_options
   end
diff --git a/lib/user_session_management.rb b/lib/user_session_management.rb
index c1c659cb6f..a081dddcbe 100644
--- a/lib/user_session_management.rb
+++ b/lib/user_session_management.rb
@@ -38,7 +38,7 @@ def current_user
     end
   end
 
-  def sign_in!(user, security_log_data: {})
+  def sign_in!(user, security_log_data = {})
     clear_login_state
 
     @current_user = user || AnonymousUser.instance
diff --git a/spec/access_policies/contact_info_access_policy_spec.rb b/spec/access_policies/contact_info_access_policy_spec.rb
index d7e31ff1d8..02e31f2efb 100644
--- a/spec/access_policies/contact_info_access_policy_spec.rb
+++ b/spec/access_policies/contact_info_access_policy_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ContactInfoAccessPolicy do
+describe ContactInfoAccessPolicy do
 
   let!(:contact_info) { FactoryBot.create :email_address }
   let!(:anon)         { AnonymousUser.instance }
diff --git a/spec/access_policies/external_id_access_policy_spec.rb b/spec/access_policies/external_id_access_policy_spec.rb
index 2c7699ea74..76248f5511 100644
--- a/spec/access_policies/external_id_access_policy_spec.rb
+++ b/spec/access_policies/external_id_access_policy_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ExternalIdAccessPolicy do
+describe ExternalIdAccessPolicy do
   let!(:anon)        { AnonymousUser.instance }
   let!(:temp)        { FactoryBot.create :temp_user }
   let!(:user)        { FactoryBot.create :user }
@@ -13,16 +13,16 @@
 
   context 'create' do
     it 'cannot be accessed by users or untrusted apps' do
-      expect(OSU::AccessPolicy.action_allowed?(:search, anon, external_id)).to eq false
-      expect(OSU::AccessPolicy.action_allowed?(:search, temp, external_id)).to eq false
-      expect(OSU::AccessPolicy.action_allowed?(:search, user, external_id)).to eq false
-      expect(OSU::AccessPolicy.action_allowed?(:search, new_social, external_id)).to eq false
-      expect(OSU::AccessPolicy.action_allowed?(:search, admin, external_id)).to eq false
-      expect(OSU::AccessPolicy.action_allowed?(:search, app, external_id)).to eq false
+      expect(OSU::AccessPolicy.action_allowed?(:create, anon, external_id)).to eq false
+      expect(OSU::AccessPolicy.action_allowed?(:create, temp, external_id)).to eq false
+      expect(OSU::AccessPolicy.action_allowed?(:create, user, external_id)).to eq false
+      expect(OSU::AccessPolicy.action_allowed?(:create, new_social, external_id)).to eq false
+      expect(OSU::AccessPolicy.action_allowed?(:create, admin, external_id)).to eq false
+      expect(OSU::AccessPolicy.action_allowed?(:create, app, external_id)).to eq false
     end
 
     it 'can be accessed by trusted apps' do
-      expect(OSU::AccessPolicy.action_allowed?(:search, trusted_app, User)).to eq true
+      expect(OSU::AccessPolicy.action_allowed?(:create, trusted_app, external_id)).to eq true
     end
   end
-end
\ No newline at end of file
+end
diff --git a/spec/access_policies/identity_access_policy_spec.rb b/spec/access_policies/identity_access_policy_spec.rb
index 11b9467f99..db04296707 100644
--- a/spec/access_policies/identity_access_policy_spec.rb
+++ b/spec/access_policies/identity_access_policy_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe IdentityAccessPolicy do
+describe IdentityAccessPolicy do
 
   let!(:identity)  { FactoryBot.create :identity }
   let!(:anon)      { AnonymousUser.instance }
diff --git a/spec/access_policies/user_access_policy_spec.rb b/spec/access_policies/user_access_policy_spec.rb
index 1b5244ef5f..3ffe087ef5 100644
--- a/spec/access_policies/user_access_policy_spec.rb
+++ b/spec/access_policies/user_access_policy_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe UserAccessPolicy do
+describe UserAccessPolicy do
 
   let!(:anon)        { AnonymousUser.instance }
   let!(:temp)        { FactoryBot.create :temp_user }
diff --git a/spec/cassettes/Change_Salesforce_contact_manually/can_be_set_if_the_Contact_exists_in_SF.yml b/spec/cassettes/Change_Salesforce_contact_manually/can_be_set_if_the_Contact_exists_in_SF.yml
index 4ea686fd74..281fddf476 100644
--- a/spec/cassettes/Change_Salesforce_contact_manually/can_be_set_if_the_Contact_exists_in_SF.yml
+++ b/spec/cassettes/Change_Salesforce_contact_manually/can_be_set_if_the_Contact_exists_in_SF.yml
@@ -2,7 +2,7 @@
 http_interactions:
 - request:
     method: get
-    uri: "<salesforce_instance_url>/services/data/v51.0/query?q=SELECT%20Id,%20Name,%20BillingCity,%20BillingState,%20BillingCountry,%20Type,%20School_Location__c,%20SheerID_School_Name__c,%20K_I_P__c,%20child_of_kip__c,%20Total_School_Enrollment__c%20FROM%20Account%20WHERE%20(Name%20IN%20(%27RSpec%20University%27))"
+    uri: "<salesforce_instance_url>/services/data/v51.0/query?q=SELECT%20Id,%20Name,%20BillingCity,%20BillingState,%20BillingCountry,%20Type,%20School_Location__c,%20SheerID_School_Name__c,%20K_I_P__c,%20child_of_kip__c,%20Total_School_Enrollment__c,%20Has_Assignable_Contacts__c%20FROM%20Account%20WHERE%20(Name%20IN%20(%27RSpec%20University%27))"
     body:
       encoding: US-ASCII
       string: ''
diff --git a/spec/cassettes/Newflow_CreateOrUpdateSalesforceLead/works_on_the_happy_path.yml b/spec/cassettes/Newflow_CreateOrUpdateSalesforceLead/works_on_the_happy_path.yml
index 94c9dd96ca..8a3c4101e9 100644
--- a/spec/cassettes/Newflow_CreateOrUpdateSalesforceLead/works_on_the_happy_path.yml
+++ b/spec/cassettes/Newflow_CreateOrUpdateSalesforceLead/works_on_the_happy_path.yml
@@ -2,7 +2,7 @@
 http_interactions:
 - request:
     method: get
-    uri: "<salesforce_instance_url>/services/data/v51.0/query?q=SELECT%20Id,%20Name,%20BillingCity,%20BillingState,%20BillingCountry,%20Type,%20School_Location__c,%20SheerID_School_Name__c,%20K_I_P__c,%20child_of_kip__c,%20Total_School_Enrollment__c%20FROM%20Account%20WHERE%20(Name%20=%20%27Find%20Me%20A%20Home%27)%20LIMIT%201"
+    uri: "<salesforce_instance_url>/services/data/v51.0/query?q=SELECT%20Id,%20Name,%20BillingCity,%20BillingState,%20BillingCountry,%20Type,%20School_Location__c,%20SheerID_School_Name__c,%20K_I_P__c,%20child_of_kip__c,%20Total_School_Enrollment__c,%20Has_Assignable_Contacts__c%20FROM%20Account%20WHERE%20(Name%20=%20%27Find%20Me%20A%20Home%27)%20LIMIT%201"
     body:
       encoding: US-ASCII
       string: ''
@@ -58,7 +58,7 @@ http_interactions:
       string: '{"totalSize":1,"done":true,"records":[{"attributes":{"type":"Account","url":"/services/data/v51.0/sobjects/Account/0016f00002iPs9mAAC"},"Id":"0016f00002iPs9mAAC","Name":"Find
         Me A Home","BillingCity":"Abu Dhabi","BillingState":null,"BillingCountry":"United
         Arab Emirates","Type":"Other","School_Location__c":"Foreign","SheerID_School_Name__c":"Find
-        Me A Home","K_I_P__c":false,"child_of_kip__c":false,"Total_School_Enrollment__c":null}]}'
+        Me A Home","K_I_P__c":false,"child_of_kip__c":false,"Total_School_Enrollment__c":null,"20Has_Assignable_Contacts__c":false}]}'
     http_version:
   recorded_at: Wed, 04 Sep 2024 16:55:26 GMT
 - request:
diff --git a/spec/controllers/admin/contact_infos_controller_spec.rb b/spec/controllers/admin/contact_infos_controller_spec.rb
index ed32ffe32e..c8183d1445 100644
--- a/spec/controllers/admin/contact_infos_controller_spec.rb
+++ b/spec/controllers/admin/contact_infos_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::ContactInfosController, type: :controller do
+describe Admin::ContactInfosController, type: :controller do
   let!(:user) { FactoryBot.create :user_with_emails }
   let(:admin) { FactoryBot.create :user, :admin, :terms_agreed }
   let(:email) { user.email_addresses.first }
diff --git a/spec/controllers/admin/external_ids_controller_spec.rb b/spec/controllers/admin/external_ids_controller_spec.rb
index 0c2698cd9c..abd0388ba6 100644
--- a/spec/controllers/admin/external_ids_controller_spec.rb
+++ b/spec/controllers/admin/external_ids_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::ExternalIdsController, type: :controller do
+describe Admin::ExternalIdsController, type: :controller do
   let!(:external_id) { FactoryBot.create :external_id }
   let(:admin)        { FactoryBot.create :user, :admin, :terms_agreed }
 
diff --git a/spec/controllers/admin/pre_auth_states_controller_spec.rb b/spec/controllers/admin/pre_auth_states_controller_spec.rb
index 139fe2bb71..fc8be5a47e 100644
--- a/spec/controllers/admin/pre_auth_states_controller_spec.rb
+++ b/spec/controllers/admin/pre_auth_states_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::PreAuthStatesController, type: :controller do
+describe Admin::PreAuthStatesController, type: :controller do
   let(:admin) { FactoryBot.create :user, :admin, :terms_agreed }
 
   before(:each) do
diff --git a/spec/controllers/admin/reports_controller_spec.rb b/spec/controllers/admin/reports_controller_spec.rb
index 4436dbd4fa..c2d0aca760 100644
--- a/spec/controllers/admin/reports_controller_spec.rb
+++ b/spec/controllers/admin/reports_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::ReportsController, type: :controller do
+describe Admin::ReportsController, type: :controller do
   let(:admin) { FactoryBot.create :user, :admin, :terms_agreed }
 
   before(:each) do
diff --git a/spec/controllers/admin/security_logs_controller_spec.rb b/spec/controllers/admin/security_logs_controller_spec.rb
index 1471bed7dc..88dbd2819e 100644
--- a/spec/controllers/admin/security_logs_controller_spec.rb
+++ b/spec/controllers/admin/security_logs_controller_spec.rb
@@ -16,7 +16,7 @@
     end
 
     it 'passes search parameters to Admin::SearchSecurityLog' do
-      expect(Admin::SearchSecurityLog).to receive(:call).with(query: 'test').and_return(no_results)
+      expect(Admin::SearchSecurityLog).to receive(:call).with({query: 'test'}).and_return(no_results)
 
       get(:show, params: { search: {query: 'test'} })
     end
diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb
index 7df2e6074b..1b95c57412 100644
--- a/spec/controllers/admin/users_controller_spec.rb
+++ b/spec/controllers/admin/users_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::UsersController, type: :controller do
+describe Admin::UsersController, type: :controller do
   let!(:user) { FactoryBot.create :user }
   let!(:identity) { FactoryBot.create :identity, user: user }
   let(:admin) { FactoryBot.create :user, :admin, :terms_agreed }
diff --git a/spec/controllers/api/v1/application_groups_controller_spec.rb b/spec/controllers/api/v1/application_groups_controller_spec.rb
index 66ca57852f..3fd8503d11 100644
--- a/spec/controllers/api/v1/application_groups_controller_spec.rb
+++ b/spec/controllers/api/v1/application_groups_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::ApplicationGroupsController, type: :controller, api: true, version: :v1 do
+describe Api::V1::ApplicationGroupsController, type: :controller, api: true, version: :v1 do
 
   let!(:untrusted_application) { FactoryBot.create :doorkeeper_application }
   let!(:trusted_application)   { FactoryBot.create :doorkeeper_application, :trusted }
diff --git a/spec/controllers/api/v1/application_users_controller_spec.rb b/spec/controllers/api/v1/application_users_controller_spec.rb
index f15e081cd2..de93fbebe0 100644
--- a/spec/controllers/api/v1/application_users_controller_spec.rb
+++ b/spec/controllers/api/v1/application_users_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::ApplicationUsersController, type: :controller, api: true, version: :v1 do
+describe Api::V1::ApplicationUsersController, type: :controller, api: true, version: :v1 do
 
   let!(:untrusted_application) { FactoryBot.create :doorkeeper_application }
   let!(:trusted_application)   { FactoryBot.create :doorkeeper_application, can_access_private_user_data: true }
diff --git a/spec/controllers/api/v1/contact_infos_controller_spec.rb b/spec/controllers/api/v1/contact_infos_controller_spec.rb
index 23db8b67b8..b62bee42f0 100644
--- a/spec/controllers/api/v1/contact_infos_controller_spec.rb
+++ b/spec/controllers/api/v1/contact_infos_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::ContactInfosController, type: :controller, api: true, version: :v1 do
+describe Api::V1::ContactInfosController, type: :controller, api: true, version: :v1 do
 
   let!(:untrusted_application)     { FactoryBot.create :doorkeeper_application }
 
diff --git a/spec/controllers/api/v1/messages_controller_spec.rb b/spec/controllers/api/v1/messages_controller_spec.rb
index cd949ec77c..fe26e4a83d 100644
--- a/spec/controllers/api/v1/messages_controller_spec.rb
+++ b/spec/controllers/api/v1/messages_controller_spec.rb
@@ -1,7 +1,6 @@
 require 'rails_helper'
 
 describe Api::V1::MessagesController, type: :controller, api: true, version: :v1 do
-
   let!(:untrusted_application) {
     FactoryBot.create :doorkeeper_application,
                        email_from_address: 'app@example.com'
@@ -98,6 +97,8 @@
       outcome = JSON.parse(response.body)
       expect(outcome.except('id')).to eq(expected_response)
 
+      perform_enqueued_jobs
+
       expect(Mail::TestMailer.deliveries.length).to eq(1)
     end
 
diff --git a/spec/controllers/api/v1/users_controller_spec.rb b/spec/controllers/api/v1/users_controller_spec.rb
index 61a7efd006..af95dfdf8b 100644
--- a/spec/controllers/api/v1/users_controller_spec.rb
+++ b/spec/controllers/api/v1/users_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::UsersController, type: :controller, api: true, version: :v1 do
+describe Api::V1::UsersController, type: :controller, api: true, version: :v1 do
   let!(:untrusted_application) { FactoryBot.create :doorkeeper_application }
   let!(:trusted_application)   { FactoryBot.create :doorkeeper_application, :trusted }
 
diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb
index fc04f1e0bf..c5ee698a68 100644
--- a/spec/controllers/application_controller_spec.rb
+++ b/spec/controllers/application_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ApplicationController, type: :controller do
+describe ApplicationController, type: :controller do
 
   let!(:user)               { FactoryBot.create :user, :terms_agreed }
   let!(:app_token)          { FactoryBot.create :doorkeeper_access_token, resource_owner_id: nil }
diff --git a/spec/controllers/contact_infos_controller_spec.rb b/spec/controllers/contact_infos_controller_spec.rb
index eacc93a112..338e8fba8b 100644
--- a/spec/controllers/contact_infos_controller_spec.rb
+++ b/spec/controllers/contact_infos_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ContactInfosController, type: :controller do
+describe ContactInfosController, type: :controller do
 
   let!(:user)         { FactoryBot.create :user, :terms_agreed }
   let!(:another_user) { FactoryBot.create :user, :terms_agreed }
diff --git a/spec/controllers/controllers_spec.rb b/spec/controllers/controllers_spec.rb
index b5bb5154f2..168c89650b 100644
--- a/spec/controllers/controllers_spec.rb
+++ b/spec/controllers/controllers_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe 'Controllers affected by initializers/controllers.rb', type: :controller do
+describe 'Controllers affected by initializers/controllers.rb', type: :controller do
 
   context '#save_redirect' do
 
diff --git a/spec/controllers/doorkeeper/authorizations_controller_spec.rb b/spec/controllers/doorkeeper/authorizations_controller_spec.rb
index 776edb12e5..0caa92298d 100644
--- a/spec/controllers/doorkeeper/authorizations_controller_spec.rb
+++ b/spec/controllers/doorkeeper/authorizations_controller_spec.rb
@@ -1,15 +1,19 @@
 require 'rails_helper'
 
-RSpec.describe Doorkeeper::AuthorizationsController, type: :controller do
+describe Doorkeeper::AuthorizationsController, type: :controller do
   before { controller.sign_in! user }
 
+  let(:app) { FactoryBot.create :doorkeeper_application }
+
   context '#create' do
     context 'when a student uses social auth' do
       context 'user without a profile' do
         let(:user) { FactoryBot.create :user, state: :needs_profile }
 
         it 'redirects to /signup/profile' do
-          post :create, params: { response_type: :code }
+          post :create, params: {
+            client_id: app.uid, redirect_uri: app.redirect_uri, response_type: :code
+          }
           expect(response).to redirect_to signup_profile_url
         end
       end
@@ -17,9 +21,11 @@
       context 'user with a profile' do
         let(:user) { FactoryBot.create :user, :terms_agreed }
 
-        it 'does not redirect' do
-          post :create, params: { response_type: :code }
-          expect(response).to have_http_status(:unauthorized)
+        it 'redirects to the app, not to /signup/profile' do
+          post :create, params: {
+            client_id: app.uid, redirect_uri: app.redirect_uri, response_type: :code
+          }
+          expect(response).to redirect_to a_string_matching(app.redirect_uri)
         end
       end
     end
diff --git a/spec/controllers/external_user_credentials_controller_spec.rb b/spec/controllers/external_user_credentials_controller_spec.rb
index 6be717d7a8..e4ef0d6069 100644
--- a/spec/controllers/external_user_credentials_controller_spec.rb
+++ b/spec/controllers/external_user_credentials_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ExternalUserCredentialsController, type: :controller do
+describe ExternalUserCredentialsController, type: :controller do
   render_views
 
   let(:user)             { FactoryBot.create :user, :terms_agreed, state: User::EXTERNAL }
diff --git a/spec/controllers/faculty_access_controller_spec.rb b/spec/controllers/faculty_access_controller_spec.rb
index ae60dcbca7..4310ac9b1b 100644
--- a/spec/controllers/faculty_access_controller_spec.rb
+++ b/spec/controllers/faculty_access_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe FacultyAccessController, type: :controller do
+describe FacultyAccessController, type: :controller do
   let(:user) do
     create_user('user')
   end
diff --git a/spec/controllers/newflow/educator_signup_controller_spec.rb b/spec/controllers/newflow/educator_signup_controller_spec.rb
index 20469109b9..694ceea0a5 100644
--- a/spec/controllers/newflow/educator_signup_controller_spec.rb
+++ b/spec/controllers/newflow/educator_signup_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe EducatorSignupController, type: :controller do
+  describe EducatorSignupController, type: :controller do
     before { turn_on_educator_feature_flag }
 
     describe 'GET #educator_signup_form' do
diff --git a/spec/controllers/newflow/login_controller_spec.rb b/spec/controllers/newflow/login_controller_spec.rb
index 4f13c78bd1..5aee6253d3 100644
--- a/spec/controllers/newflow/login_controller_spec.rb
+++ b/spec/controllers/newflow/login_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe LoginController, type: :controller do
+  describe LoginController, type: :controller do
     before { turn_on_educator_feature_flag }
 
     describe 'GET #login_form' do
@@ -147,7 +147,7 @@ module Newflow
         describe 'when cannot_find_user' do
           let(:noones_email){ 'noone@openstax.org' }
 
-          xit 'creates a security log' do
+          it 'creates a security log' do
             expect {
               post('login', params: { login_form: { email: noones_email, password: 'password' } })
             }.to change {
@@ -169,7 +169,7 @@ module Newflow
             'user@example.com'
           end
 
-          xit 'creates a security log' do
+          it 'creates a security log' do
             expect {
               post('login', params: { login_form: { email: email_address, password: 'password' } })
             }.to change {
@@ -187,7 +187,7 @@ module Newflow
           let(:user) { FactoryBot.create(:user) }
           let(:max_attempts_per_user) { 0 }
 
-          xit 'creates a security log' do
+          it 'creates a security log' do
             expect {
               post('login', params: { login_form: { email: email.value, password: 'wrongpassword' } })
             }.to change {
diff --git a/spec/controllers/newflow/password_management_controller_spec.rb b/spec/controllers/newflow/password_management_controller_spec.rb
index 49df1faeac..acd6cb65e8 100644
--- a/spec/controllers/newflow/password_management_controller_spec.rb
+++ b/spec/controllers/newflow/password_management_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe PasswordManagementController, type: :controller do
+  describe PasswordManagementController, type: :controller do
     describe 'GET #forgot_password_form' do
       it 'has a 200 status code' do
         get('forgot_password_form')
diff --git a/spec/controllers/newflow/signup_controller_spec.rb b/spec/controllers/newflow/signup_controller_spec.rb
index 7d18a8d4be..4848e0920b 100644
--- a/spec/controllers/newflow/signup_controller_spec.rb
+++ b/spec/controllers/newflow/signup_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe SignupController, type: :controller do
+  describe SignupController, type: :controller do
     describe 'GET #welcome' do
       it 'renders welcome form/page' do
         get(:welcome)
diff --git a/spec/controllers/newflow/social_auth_controller_spec.rb b/spec/controllers/newflow/social_auth_controller_spec.rb
index bb8208a462..31869db76c 100644
--- a/spec/controllers/newflow/social_auth_controller_spec.rb
+++ b/spec/controllers/newflow/social_auth_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe SocialAuthController, type: :controller do
+  describe SocialAuthController, type: :controller do
     describe 'GET #oauth_callback' do
       let(:info) do
         { email: 'user@openstax.org', name: Faker::Name.name }
diff --git a/spec/controllers/newflow/student_signup_controller_spec.rb b/spec/controllers/newflow/student_signup_controller_spec.rb
index 9519621001..b22fd0b2d1 100644
--- a/spec/controllers/newflow/student_signup_controller_spec.rb
+++ b/spec/controllers/newflow/student_signup_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe StudentSignupController, type: :controller do
+  describe StudentSignupController, type: :controller do
     describe 'GET #student_signup_form' do
       it 'renders student signup_form' do
         get(:student_signup_form)
diff --git a/spec/controllers/other_controller_spec.rb b/spec/controllers/other_controller_spec.rb
index 27f35f471e..2de728d635 100644
--- a/spec/controllers/other_controller_spec.rb
+++ b/spec/controllers/other_controller_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe OtherController, type: :controller do
+describe OtherController, type: :controller do
   describe 'GET #profile_newflow' do
     context 'when logged in' do
       before do
diff --git a/spec/controllers/terms_controller_spec.rb b/spec/controllers/terms_controller_spec.rb
index d90df7c590..58c01456b5 100644
--- a/spec/controllers/terms_controller_spec.rb
+++ b/spec/controllers/terms_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 require 'byebug'
 
-RSpec.describe TermsController, type: :controller do
+describe TermsController, type: :controller do
   let(:contract) { FactoryBot.create :fine_print_contract, :published }
   let!(:user_1)  { create_user 'user1' }
   let!(:user_2)  { create_user 'user2' }
diff --git a/spec/delayed/worker_spec.rb b/spec/delayed/worker_spec.rb
index 879dc310a6..74af501a1c 100644
--- a/spec/delayed/worker_spec.rb
+++ b/spec/delayed/worker_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Delayed::Worker, type: :lib do
+describe Delayed::Worker, type: :lib do
   let(:job)                { ::ActiveJob::Base.new }
   let(:delayed_job)        { ::Delayed::Job.create!(payload_object: job) }
   subject(:delayed_worker) { described_class.new }
diff --git a/spec/factories/doorkeeper_access_grant.rb b/spec/factories/doorkeeper_access_grant.rb
index 3bbbdabcca..e7f750372f 100644
--- a/spec/factories/doorkeeper_access_grant.rb
+++ b/spec/factories/doorkeeper_access_grant.rb
@@ -2,7 +2,8 @@
   factory :doorkeeper_access_grant, class: Doorkeeper::AccessGrant do
     sequence(:resource_owner_id) { |n| n }
     association :application, factory: :doorkeeper_application
-    redirect_uri { 'urn:ietf:wg:oauth:2.0:oob' }
     expires_in { 10.minutes }
+    redirect_uri { 'urn:ietf:wg:oauth:2.0:oob' }
+    scopes { 'all' }
   end
 end
diff --git a/spec/factories/doorkeeper_access_token.rb b/spec/factories/doorkeeper_access_token.rb
index 4ab86ad07b..e5f36e19bc 100644
--- a/spec/factories/doorkeeper_access_token.rb
+++ b/spec/factories/doorkeeper_access_token.rb
@@ -2,5 +2,6 @@
   factory :doorkeeper_access_token, class: Doorkeeper::AccessToken do
     association :application, factory: :doorkeeper_application
     expires_in { 2.hours }
+    scopes { 'all' }
   end
 end
diff --git a/spec/factories/message.rb b/spec/factories/message.rb
index 448bb93567..5a14a5d369 100644
--- a/spec/factories/message.rb
+++ b/spec/factories/message.rb
@@ -13,8 +13,7 @@
     after(:build) do |message, evaluator|
       message.body ||= FactoryBot.build(:message_body, message: message)
       evaluator.recipients_count.times do
-        message.message_recipients << FactoryBot.build(:message_recipient,
-                                                        message: message)
+        message.message_recipients << FactoryBot.build(:message_recipient, message: message)
       end
     end
   end
diff --git a/spec/factories/sheerid_verification.rb b/spec/factories/sheerid_verification.rb
index 27c046d371..7a3be19095 100644
--- a/spec/factories/sheerid_verification.rb
+++ b/spec/factories/sheerid_verification.rb
@@ -3,7 +3,7 @@
     current_step do
       [ SheeridVerification::VERIFIED, SheeridVerification::REJECTED, 'pending' ].sample
     end
-    email { Faker::Internet.free_email }
+    email { Faker::Internet.email }
     verification_id { Faker::Internet.uuid }
     first_name { Faker::Name.first_name }
     last_name { Faker::Name.last_name }
diff --git a/spec/features/add_application_spec.rb b/spec/features/add_application_spec.rb
index 425f2da8a3..f72ec42b24 100644
--- a/spec/features/add_application_spec.rb
+++ b/spec/features/add_application_spec.rb
@@ -9,8 +9,7 @@
   # scenario 'as an admin user' do
   #   create_admin_user
   #   visit '/'
-  #   complete_login_username_or_email_screen('admin')
-  #   complete_login_password_screen('password')
+  #   complete_newflow_log_in_screen('admin')
   #
   #   visit '/oauth/applications'
   #   expect(page).to have_content('OAuth2 Provider')
diff --git a/spec/features/admin/change_salesforce_contact_manually_spec.rb b/spec/features/admin/change_salesforce_contact_manually_spec.rb
index 123cff3079..07ea6df8d5 100644
--- a/spec/features/admin/change_salesforce_contact_manually_spec.rb
+++ b/spec/features/admin/change_salesforce_contact_manually_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 require 'vcr_helper'
 
-RSpec.describe "Change Salesforce contact manually", vcr: VCR_OPTS do
+feature 'Change Salesforce contact manually', js: true, vcr: VCR_OPTS do
   before(:all) do
     VCR.use_cassette('Change_Salesforce_contact_manually/sf_setup', VCR_OPTS) do
       @proxy = SalesforceProxy.new
@@ -12,8 +12,7 @@
   before(:each) do
     @admin_user = create_admin_user
     visit '/'
-    complete_login_username_or_email_screen('admin')
-    complete_login_password_screen('password')
+    complete_newflow_log_in_screen('admin')
 
     @target_user = FactoryBot.create(:user)
 
diff --git a/spec/features/admin/create_banners_spec.rb b/spec/features/admin/create_banners_spec.rb
index 4067668b66..b9ce4d75d3 100644
--- a/spec/features/admin/create_banners_spec.rb
+++ b/spec/features/admin/create_banners_spec.rb
@@ -5,8 +5,7 @@
     before(:each) do
       @admin_user = create_admin_user
       visit '/'
-      complete_login_username_or_email_screen('admin')
-      complete_login_password_screen('password')
+      complete_newflow_log_in_screen('admin')
     end
 
     it 'can visit the banners page' do
diff --git a/spec/features/admin/oauth_application_crud_spec.rb b/spec/features/admin/oauth_application_crud_spec.rb
index 481e9bffe5..1b78cf7156 100644
--- a/spec/features/admin/oauth_application_crud_spec.rb
+++ b/spec/features/admin/oauth_application_crud_spec.rb
@@ -5,8 +5,7 @@
     before(:each) do
       @admin_user = create_admin_user
       visit '/'
-      complete_login_username_or_email_screen('admin')
-      complete_login_password_screen('password')
+      complete_newflow_log_in_screen('admin')
     end
 
     it 'can create and edit applications' do
diff --git a/spec/features/admin/reports_spec.rb b/spec/features/admin/reports_spec.rb
index 79d8d1c1ca..4d1b7330ee 100644
--- a/spec/features/admin/reports_spec.rb
+++ b/spec/features/admin/reports_spec.rb
@@ -4,8 +4,7 @@
   before(:each) do
     create_admin_user.update!(role: User::ADMINISTRATOR_ROLE)
     visit '/'
-    complete_login_username_or_email_screen('admin')
-    complete_login_password_screen('password')
+    complete_newflow_log_in_screen('admin')
   end
 
   it 'counts student users created in the last week' do
diff --git a/spec/features/admin/settings_spec.rb b/spec/features/admin/settings_spec.rb
deleted file mode 100644
index f8e419b9bf..0000000000
--- a/spec/features/admin/settings_spec.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-require 'rails_helper'
-
-feature 'Admin settings page', js: true do
-  context 'as an admin user' do
-    before(:each) do
-      create_admin_user
-      visit '/'
-      complete_login_username_or_email_screen('admin')
-      complete_login_password_screen('password')
-    end
-
-    it 'is well formed' do
-      OpenStax::RescueFrom.do_reraise do
-        visit '/admin/settings'
-      end
-
-      expect(page).to have_content("Push leads to Salesforce?")
-    end
-
-  end
-end
diff --git a/spec/features/admin/users_spec.rb b/spec/features/admin/users_spec.rb
index 7bc3feb2f2..c4b80f0bf3 100644
--- a/spec/features/admin/users_spec.rb
+++ b/spec/features/admin/users_spec.rb
@@ -5,8 +5,7 @@
     before(:each) do
       @admin_user = create_admin_user
       visit '/'
-      complete_login_username_or_email_screen('admin')
-      complete_login_password_screen('password')
+      complete_newflow_log_in_screen('admin', 'password')
     end
 
     context "with a user with salesforce contact ID set" do
@@ -35,6 +34,7 @@
 
       context 'popup console' do
         it 'searches users and does not explode' do
+          Capybara.current_session.current_window.resize_to 1200, 1200
           visit '/'
           click_link 'Popup Console'
           wait_for_ajax(10) # for some reason this is slow
diff --git a/spec/features/cache_headers_spec.rb b/spec/features/cache_headers_spec.rb
index 52db5ac0a4..18aa518f12 100644
--- a/spec/features/cache_headers_spec.rb
+++ b/spec/features/cache_headers_spec.rb
@@ -32,9 +32,9 @@
 
   context "Requests should get cached headers after a while" do
     it 'status code is 200' do
-      get '/profile'
+      get profile_newflow_path
       assert_response 200
-      expect(response.headers["Cache-Control"]).to eq("no-cache, no-store")
+      expect(response.headers["Cache-Control"]).to eq("no-store")
     end
 
     it 'should not allow caching' do
diff --git a/spec/features/log_out_inactive_admins_spec.rb b/spec/features/log_out_inactive_admins_spec.rb
index a0f0b75b03..219c581b9e 100644
--- a/spec/features/log_out_inactive_admins_spec.rb
+++ b/spec/features/log_out_inactive_admins_spec.rb
@@ -15,7 +15,7 @@
   context "logged-in admin user" do
     before(:each) do
       create_admin_user
-      log_in 'admin'
+      newflow_log_in_user 'admin'
       visit admin_feature_url
     end
 
@@ -41,7 +41,7 @@
         Timecop.travel(login_time + 31.minutes)
         visit admin_feature_url
 
-        expect(page).to have_current_path(login_path)
+        expect(page).to have_current_path(newflow_login_path)
       end
     end
 
@@ -63,7 +63,7 @@
         Timecop.travel(login_time + 31.minutes)
         visit admin_feature_url
 
-        expect(page).to have_current_path(login_path)
+        expect(page).to have_current_path(newflow_login_path)
       end
     end
 
@@ -84,7 +84,7 @@
   context "logged-in non-admin user" do
     before(:each) do
       create_user 'user'
-      log_in 'user'
+      newflow_log_in_user 'user'
     end
 
     context "when accessing only non-admin features" do
@@ -132,7 +132,7 @@
     scenario "cannot access user features" do
       visit non_admin_feature_url
 
-      expect(page).to have_current_path(login_path)
+      expect(page).to have_current_path(newflow_login_path)
     end
 
     scenario "can access visitor pages" do
@@ -145,7 +145,7 @@
   context "non-admin user logs in" do
     scenario "later someone makes him/her an admin" do
       current_user = create_user 'user'
-      log_in 'user'
+      newflow_log_in_user 'user'
       expect(current_user.is_administrator?).to eq false
 
       Timecop.travel(login_time + 31.minutes)
@@ -169,7 +169,7 @@ def admin_feature_url
   end
 
   def non_admin_feature_url
-    "/profile"
+    "/i/profile"
   end
 
   def visitor_page_url
diff --git a/spec/features/newflow/adding_and_resetting_password_from_profile.rb b/spec/features/newflow/adding_and_resetting_password_from_profile.rb
index 0722b8de3c..a5fde9b679 100644
--- a/spec/features/newflow/adding_and_resetting_password_from_profile.rb
+++ b/spec/features/newflow/adding_and_resetting_password_from_profile.rb
@@ -99,11 +99,11 @@
     expect(page).to have_current_path newflow_login_path
 
     # try logging in with the old password
-    newflow_log_in_user('user', 'password')
+    complete_newflow_log_in_screen('user', 'password')
     expect(page).to have_content(t(:"login_signup_form.incorrect_password"))
 
     # try logging in with the new password
-    newflow_log_in_user('user', 'newpassword')
+    complete_newflow_log_in_screen('user', 'newpassword')
     visit profile_newflow_path
     expect_newflow_profile_page
     expect(page).to have_no_missing_translations
diff --git a/spec/features/newflow/educator_signup_flow_spec.rb b/spec/features/newflow/educator_signup_flow_spec.rb
index a1c20ccf0b..ff7ff7bb7b 100644
--- a/spec/features/newflow/educator_signup_flow_spec.rb
+++ b/spec/features/newflow/educator_signup_flow_spec.rb
@@ -34,6 +34,8 @@ module Newflow
           submit_signup_form
           screenshot!
 
+          perform_enqueued_jobs
+
           # Step 2
           # sends an email address confirmation email
           expect(page.current_path).to eq(educator_email_verification_form_path)
@@ -84,6 +86,8 @@ module Newflow
           submit_signup_form
           screenshot!
 
+          perform_enqueued_jobs
+
           # Step 2
           # sends an email address confirmation email
           expect(page.current_path).to eq(educator_email_verification_form_path)
@@ -127,7 +131,7 @@ module Newflow
 
       it 'allows the educator to reset their password' do
         visit(newflow_login_path)
-        newflow_log_in_user(email_address.value, 'WRONGpassword')
+        complete_newflow_log_in_screen(email_address.value, 'WRONGpassword')
         find('[id=forgot-password-link]').click
         expect(page.current_path).to eq(forgot_password_form_path)
         expect(find('#forgot_password_form_email')['value']).to eq(email_address.value)
@@ -198,6 +202,8 @@ module Newflow
         submit_signup_form
         screenshot!
 
+        perform_enqueued_jobs
+
         # Step 2
         # sends an email address confirmation email
         expect(page.current_path).to eq(educator_email_verification_form_path)
@@ -227,7 +233,7 @@ module Newflow
 
         # LOG IN
         visit(login_path(return_param))
-        newflow_log_in_user(email_value, password)
+        complete_newflow_log_in_screen(email_value, password)
 
         # Step 3
         expect_sheerid_iframe
diff --git a/spec/features/newflow/require_recent_sign_in_to_change_authentications_spec.rb b/spec/features/newflow/require_recent_sign_in_to_change_authentications_spec.rb
index ebeb65cddc..0065f92d73 100644
--- a/spec/features/newflow/require_recent_sign_in_to_change_authentications_spec.rb
+++ b/spec/features/newflow/require_recent_sign_in_to_change_authentications_spec.rb
@@ -17,7 +17,7 @@
 
   # scenario 'adding Facebook' do
   #   visit '/'
-  #   newflow_log_in_user(email_value, 'password')
+  #   complete_newflow_log_in_screen(email_value, 'password')
   #
   #   expect(page.current_path).to eq(profile_newflow_path)
   #
@@ -48,7 +48,7 @@
   scenario 'changing the password' do
     with_forgery_protection do
       visit '/'
-      newflow_log_in_user(email_value, 'password')
+      complete_newflow_log_in_screen(email_value, 'password')
       expect(page).to have_no_missing_translations
 
       Timecop.freeze(Time.now + RequireRecentSignin::REAUTHENTICATE_AFTER) do
diff --git a/spec/features/newflow/reset_password_spec.rb b/spec/features/newflow/reset_password_spec.rb
index 74abec7649..5860e64a2e 100644
--- a/spec/features/newflow/reset_password_spec.rb
+++ b/spec/features/newflow/reset_password_spec.rb
@@ -34,6 +34,8 @@
         )
       )
 
+      perform_enqueued_jobs
+
       open_email('user@openstax.org')
       password_reset_link = get_path_from_absolute_link(current_email, 'a')
       visit password_reset_link
@@ -63,6 +65,7 @@
           t(:'login_signup_form.password_reset_email_sent_description', email: 'user@openstax.org')
         )
       )
+      perform_enqueued_jobs
       open_email('user@openstax.org')
       expect(current_email).to have_content('reset')
     end
@@ -71,7 +74,7 @@
   # scenario 'reset password links stay constant for a fixed time' do
   #   visit newflow_login_path
   #   screenshot!
-  #   newflow_log_in_user('user@openstax.org', 'WRONGpassword')
+  #   complete_newflow_log_in_screen('user@openstax.org', 'WRONGpassword')
   #   screenshot!
   #
   #   click_on(I18n.t(:"login_signup_form.forgot_password"))
@@ -85,12 +88,13 @@
   #   expect(page).to have_content(I18n.t(:"login_signup_form.password_reset_email_sent"))
   #   screenshot!
   #
+  #   perform_enqueued_jobs
   #   open_email('user@openstax.org')
   #   change_password_link_1 = get_path_from_absolute_link(current_email, 'a')
   #   clear_emails
   #
   #   visit newflow_login_path
-  #   newflow_log_in_user('user@openstax.org', 'WRONGpassword')
+  #   complete_newflow_log_in_screen('user@openstax.org', 'WRONGpassword')
   #   click_on(I18n.t(:"login_signup_form.forgot_password"))
   #   expect(page.current_path).to eq(forgot_password_form_path)
   #   # pre-populates the email for them since they already typed it in the login form
@@ -99,6 +103,7 @@
   #   click_on(I18n.t(:"login_signup_form.reset_my_password_button"))
   #   expect(page).to have_content(I18n.t(:"login_signup_form.password_reset_email_sent"))
   #
+  #   perform_enqueued_jobs
   #   open_email('user@openstax.org')
   #   change_password_link_2 = get_path_from_absolute_link(current_email, 'a')
   #   clear_emails
@@ -107,7 +112,7 @@
   #
   #   Timecop.freeze(Time.now + IdentitiesSendPasswordEmail::LOGIN_TOKEN_EXPIRES_AFTER + 1.hour) do
   #     visit newflow_login_path
-  #     newflow_log_in_user('user@openstax.org', 'WRONGpassword')
+  #     complete_newflow_log_in_screen('user@openstax.org', 'WRONGpassword')
   #     click_on(I18n.t(:"login_signup_form.forgot_password"))
   #     expect(page.current_path).to eq(forgot_password_form_path)
   #     # pre-populates the email for them since they already typed it in the login form
@@ -116,6 +121,7 @@
   #     click_on(I18n.t(:"login_signup_form.reset_my_password_button"))
   #     expect(page).to have_content(I18n.t(:"login_signup_form.password_reset_email_sent"))
   #
+  #     perform_enqueued_jobs
   #     open_email('user@openstax.org')
   #     change_password_link_3 = get_path_from_absolute_link(current_email, 'a')
   #     clear_emails
@@ -126,7 +132,7 @@
 
   # scenario 'failure to send reset email (re-) renders the forgot password form' do
   #   visit newflow_login_path
-  #   newflow_log_in_user('user@openstax.org', 'WRONGpassword')
+  #   complete_newflow_log_in_screen('user@openstax.org', 'WRONGpassword')
   #   click_on(I18n.t(:"login_signup_form.forgot_password"))
   #
   #   # Cause an error to occur in the handler that sends the email
diff --git a/spec/features/newflow/student_login_flow_spec.rb b/spec/features/newflow/student_login_flow_spec.rb
index 1ba6da7b49..9d9f3a16f3 100644
--- a/spec/features/newflow/student_login_flow_spec.rb
+++ b/spec/features/newflow/student_login_flow_spec.rb
@@ -16,7 +16,7 @@ module Newflow
             return_to = capybara_url(external_app_for_specs_path)
             visit newflow_login_path(r: return_to)
             screenshot!
-            newflow_log_in_user('user@openstax.org', 'password')
+            complete_newflow_log_in_screen('user@openstax.org', 'password')
             expect(page.current_url).to eq(return_to)
             screenshot!
           end
@@ -29,7 +29,7 @@ module Newflow
             with_forgery_protection do
               arrive_from_app
               screenshot!
-              newflow_log_in_user('user@openstax.org', 'password')
+              complete_newflow_log_in_screen('user@openstax.org', 'password')
               expect_back_at_app
               screenshot!
             end
@@ -49,7 +49,7 @@ module Newflow
             with_forgery_protection do
               arrive_from_app
               screenshot!
-              newflow_log_in_user('needs_profile_user@openstax.org', 'password')
+              complete_newflow_log_in_screen('needs_profile_user@openstax.org', 'password')
               screenshot!
               expect(page.current_path).to match(signup_profile_path)
             end
@@ -65,7 +65,7 @@ module Newflow
         it 'sends the student to their profile' do
           with_forgery_protection do
             visit newflow_login_path
-            newflow_log_in_user('user@openstax.org', 'password')
+            complete_newflow_log_in_screen('user@openstax.org', 'password')
             expect(page.current_url).to match(profile_newflow_path)
           end
         end
@@ -166,7 +166,7 @@ module Newflow
       xit 'adds a message to the email input field' do
         with_forgery_protection do
           visit newflow_login_path
-          newflow_log_in_user('NOone@openstax.org', 'password')
+          complete_newflow_log_in_screen('NOone@openstax.org', 'password')
           expect(page.current_url).to match(newflow_login_path)
           field_text = find('#login_form_email + .errors.invalid-message').text
           expect(field_text).to  eq(I18n.t(:"login_signup_form.cannot_find_user"))
@@ -178,7 +178,7 @@ module Newflow
       xit 'adds a message to the password input field' do
         with_forgery_protection do
             visit newflow_login_path
-            newflow_log_in_user('user@openstax.org', 'WRONGpassword')
+            complete_newflow_log_in_screen('user@openstax.org', 'WRONGpassword')
             expect(page.current_url).to match(newflow_login_path)
             field_text = find('#login_form_password + .errors.invalid-message').text
             expect(field_text).to  eq(I18n.t(:"login_signup_form.incorrect_password"))
@@ -191,7 +191,7 @@ module Newflow
         with_forgery_protection do
           visit newflow_login_path
           screenshot!
-          newflow_log_in_user('user@openstax.org', 'WRONGpassword')
+          complete_newflow_log_in_screen('user@openstax.org', 'WRONGpassword')
           screenshot!
 
           click_on(I18n.t(:"login_signup_form.forgot_password"))
@@ -205,6 +205,8 @@ module Newflow
           expect(page).to have_content(I18n.t(:"login_signup_form.password_reset_email_sent"))
           screenshot!
 
+          perform_enqueued_jobs
+
           open_email('user@openstax.org')
           capture_email!
           change_password_link = get_path_from_absolute_link(current_email, 'a')
@@ -223,7 +225,7 @@ module Newflow
           # user is subsequently able to log in with the new password
           click_on('Log out')
           screenshot!
-          newflow_log_in_user('user@openstax.org', 'NEWpassword')
+          complete_newflow_log_in_screen('user@openstax.org', 'NEWpassword')
           expect(page).to  have_content('My Account')
         end
       end
diff --git a/spec/features/newflow/student_signup_flow_spec.rb b/spec/features/newflow/student_signup_flow_spec.rb
index 19f4289bba..0f7d376e9c 100644
--- a/spec/features/newflow/student_signup_flow_spec.rb
+++ b/spec/features/newflow/student_signup_flow_spec.rb
@@ -16,7 +16,7 @@ module Newflow
     end
 
     let(:email) do
-      Faker::Internet::free_email
+      Faker::Internet::email
     end
 
     let(:password) do
@@ -34,6 +34,8 @@ module Newflow
         submit_signup_form
         screenshot!
 
+        perform_enqueued_jobs
+
         # sends an email address confirmation email
         expect(page.current_path).to eq student_email_verification_form_path
         open_email email
@@ -92,8 +94,7 @@ module Newflow
       # TODO: this works - something with the selector, also the id on the element is misspelled
       xit 'allows the student to reset their password' do
         visit(newflow_login_path)
-        #byebug
-        newflow_log_in_user(email_address.value, 'WRONGpassword')
+        complete_newflow_log_in_screen(email_address.value, 'WRONGpassword')
         click_link_or_button(t :"login_signup_form.forgot_password")
         expect(page.current_path).to eq(forgot_password_form_path)
         expect(find('#forgot_password_form_email')['value']).to eq(email_address.value)
@@ -104,30 +105,32 @@ module Newflow
     end
 
   example 'arriving from Tutor (a Doorkeeper app)' do
-      app = create_tutor_application
-      visit_authorize_uri(app: app, params: { go: 'student_signup' })
-      fill_in 'signup_first_name',	with: 'Sally'
-      fill_in 'signup_last_name',	with: 'Port'
-      fill_in 'signup_email',	with: email
-      fill_in 'signup_password',	with: password
-      submit_signup_form
-      screenshot!
-
-      # sends an email address confirmation email
-      expect(page.current_path).to eq student_email_verification_form_path
-      open_email email
-      capture_email!(address: email)
-      expect(current_email).to be_truthy
-
-        # ... with a link
-        pin = current_email.find('#pin').text
-        fill_in('confirm_pin', with: pin)
-        screenshot!
-        click_on('commit')
-
-        # ... redirects you back to Tutor
-        expect(page).not_to have_text(t(:"login_signup_form.youre_done", first_name: 'Sally'))
-        expect(page.current_path).to eq('/external_app_for_specs')
+    app = create_tutor_application
+    visit_authorize_uri(app: app, params: { go: 'student_signup' })
+    fill_in 'signup_first_name',	with: 'Sally'
+    fill_in 'signup_last_name',	with: 'Port'
+    fill_in 'signup_email',	with: email
+    fill_in 'signup_password',	with: password
+    submit_signup_form
+    screenshot!
+
+    perform_enqueued_jobs
+
+    # sends an email address confirmation email
+    expect(page.current_path).to eq student_email_verification_form_path
+    open_email email
+    capture_email!(address: email)
+    expect(current_email).to be_truthy
+
+    # ... with a link
+    pin = current_email.find('#pin').text
+    fill_in('confirm_pin', with: pin)
+    screenshot!
+    click_on('commit')
+
+    # ... redirects you back to Tutor
+    expect(page).not_to have_text(t(:"login_signup_form.youre_done", first_name: 'Sally'))
+    expect(page.current_path).to eq('/external_app_for_specs')
     end
 
     context 'not happy path' do
@@ -171,6 +174,8 @@ module Newflow
         submit_signup_form
         screenshot!
 
+        perform_enqueued_jobs
+
         # an email gets sent
         open_email email
         # capture_email!(address: email)
@@ -184,7 +189,7 @@ module Newflow
         # page contains tooltip
         expect(page).to have_text(t(:"login_signup_form.change_signup_email_form_tooltip"))
 
-        new_email = Faker::Internet::free_email
+        new_email = Faker::Internet.email
         fill_in('change_signup_email_email', with: new_email)
         screenshot!
         find('#login-signup-form').click
@@ -193,6 +198,8 @@ module Newflow
         screenshot!
         expect(page).to have_text(t(:"login_signup_form.check_your_updated_email"))
 
+        perform_enqueued_jobs
+
         # a different pin is sent in the edited email
         open_email new_email
         capture_email!(address: new_email)
diff --git a/spec/features/newflow/user_cant_sign_in_spec.rb b/spec/features/newflow/user_cant_sign_in_spec.rb
index 0b703abd5d..067f29dba8 100644
--- a/spec/features/newflow/user_cant_sign_in_spec.rb
+++ b/spec/features/newflow/user_cant_sign_in_spec.rb
@@ -49,12 +49,14 @@
       # expect(page.first('input')["placeholder"]).to eq t(:"legacy.sessions.start.username_placeholder")
       # expect(page.first('input').text).to be_blank
 
+      # perform_enqueued_jobs
+
       # open_email(email_address)
       # expect(current_email).to have_content('used on more than one')
       # expect(current_email).to have_content('user1 and user2')
       # capture_email!
 
-      # complete_login_username_or_email_screen('user2')
+      # complete_newflow_log_in_screen('user2')
       # expect_authenticate_page
     end
 
@@ -125,6 +127,8 @@
     #   expect(page).to have_content(t(:"login_signup_form.password_reset_email_sent"))
     #   screenshot!
     #
+    #   perform_enqueued_jobs
+    #
     #   open_email('user@example.com')
     #   capture_email!
     #   change_password_link = get_path_from_absolute_link(current_email, 'a')
@@ -151,7 +155,7 @@
       FactoryBot.create :authentication, provider: 'google_oauth2', user: @user
       password_authentication.destroy
 
-      complete_login_username_or_email_screen('user@example.com')
+      complete_newflow_log_in_screen('user@example.com')
       screenshot!
 
       # TODO somehow simulate oauth failure so we see error message
@@ -160,6 +164,8 @@
       expect(page).to have_content(t(:"legacy.identities.send_add.we_sent_email", emails: 'user@example.com'))
       screenshot!
 
+      perform_enqueued_jobs
+
       open_email('user@example.com')
       expect(current_email).to have_content("Click here to add")
       capture_email!
@@ -194,7 +200,7 @@
     #
     # Technically: same user, same provider, different `uid`.
 
-    email_address = Faker::Internet.free_email
+    email_address = Faker::Internet.email
     user = create_newflow_user(email_address)
     authentication = FactoryBot.create :authentication, provider: 'googlenewflow', user: user
 
diff --git a/spec/features/newflow/user_claims_account_spec.rb b/spec/features/newflow/user_claims_account_spec.rb
index f88dfb0e7b..4070f7125b 100644
--- a/spec/features/newflow/user_claims_account_spec.rb
+++ b/spec/features/newflow/user_claims_account_spec.rb
@@ -20,6 +20,7 @@
   }
 
   def visit_invite_url
+    perform_enqueued_jobs
     delivery = ActionMailer::Base.deliveries.last
     match = delivery.body.encoded.match(/(confirm\/unclaimed\?code=\w+)/)
     expect(match).to_not be_nil
diff --git a/spec/features/newflow/user_login_signup_with_social_network_spec.rb b/spec/features/newflow/user_login_signup_with_social_network_spec.rb
index 171d3bff81..521de3b1fd 100644
--- a/spec/features/newflow/user_login_signup_with_social_network_spec.rb
+++ b/spec/features/newflow/user_login_signup_with_social_network_spec.rb
@@ -90,7 +90,9 @@
               fill_in('signup_email',	with: invalid_email)
               submit_signup_form
               screenshot!
-              expect(page).to have_content(t(:".activerecord.errors.models.email_address.attributes.value.invalid", value: invalid_email))
+              expect(page).to have_content(strip_html(
+                t(:".activerecord.errors.models.email_address.attributes.value.invalid", value: invalid_email)
+              ))
             end
           end
         end
@@ -103,7 +105,7 @@
       end
 
       let(:email) do
-        Faker::Internet.free_email
+        Faker::Internet.email
       end
 
       before do
@@ -139,7 +141,7 @@
     end
 
     context 'when user denies us access to their email address, signs up entering their email manually' do
-      let(:email_value) { Faker::Internet.free_email }
+      let(:email_value) { Faker::Internet.email }
       let(:nil_email_value) { nil }
 
       before do
@@ -178,7 +180,7 @@
       end
 
       let(:email_value) do
-        Faker::Internet.free_email
+        Faker::Internet.email
       end
 
       let(:social_uid) { 'uid123' }
diff --git a/spec/features/newflow/user_manages_emails_spec.rb b/spec/features/newflow/user_manages_emails_spec.rb
index be37b224d2..f1b948e1b3 100644
--- a/spec/features/newflow/user_manages_emails_spec.rb
+++ b/spec/features/newflow/user_manages_emails_spec.rb
@@ -35,6 +35,8 @@
     #   wait_for_ajax
     #   find(".unconfirmed-warning").click
     #
+    #   perform_enqueued_jobs
+    #
     #   capture_email!(address: 'user@mysite.com')
     #   expect(page).to have_no_missing_translations
     #   expect(page).to have_button(I18n.t(:"legacy.users.edit.resend_confirmation"))
@@ -48,6 +50,7 @@
         find('.glyphicon-ok').click
       }
       wait_for_ajax
+      perform_enqueued_jobs
       open_email('user@mysite.com')
       original_link_path = get_path_from_absolute_link(current_email, 'a')
 
@@ -105,6 +108,7 @@
         wait_for_ajax
         find(".unconfirmed-warning").click
       }
+      perform_enqueued_jobs
       capture_email!(address: 'anyone@openstax.org')
       expect(page).to have_no_missing_translations
       expect(page).to have_button(I18n.t(:"legacy.users.edit.resend_confirmation"))
diff --git a/spec/features/newflow/user_updates_password_spec.rb b/spec/features/newflow/user_updates_password_spec.rb
index dcb2f9fc6e..5ccee74744 100644
--- a/spec/features/newflow/user_updates_password_spec.rb
+++ b/spec/features/newflow/user_updates_password_spec.rb
@@ -7,7 +7,7 @@
     @user = create_user('user', 'password', terms_agreed: true)
     @user.update!(role: User::STUDENT_ROLE)
     visit '/'
-    newflow_log_in_user('user', 'password')
+    complete_newflow_log_in_screen('user', 'password')
   end
 
   scenario "adds one" do
diff --git a/spec/features/pose_terms_spec.rb b/spec/features/pose_terms_spec.rb
index 7bc324f664..48668c4ab5 100644
--- a/spec/features/pose_terms_spec.rb
+++ b/spec/features/pose_terms_spec.rb
@@ -8,7 +8,7 @@
 
   scenario 'agrees to terms when signatures not present' do
     create_user('user','password', false)
-    log_in('user','password')
+    newflow_log_in_user('user','password')
 
     screenshot!
     expect(page).to have_content("To continue, please review and agree to the following site terms")
@@ -22,7 +22,7 @@
     find(:css, '#agreement_i_agree').click
     click_button (t :"terms.pose.agree")
 
-    expect_profile_page
+    expect_newflow_profile_page
   end
 
 end
diff --git a/spec/features/rate_limit_sign_ins_spec.rb b/spec/features/rate_limit_sign_ins_spec.rb
index 081393a62c..ac319e9023 100644
--- a/spec/features/rate_limit_sign_ins_spec.rb
+++ b/spec/features/rate_limit_sign_ins_spec.rb
@@ -33,7 +33,7 @@
 
         log_in_correctly_with_username(password: '1234abcd')
         # expect(page).to have_content(t :"layouts.application_header.welcome_html", username: 'user')
-        expect_profile_page
+        expect_newflow_profile_page
       end
     end
 
@@ -56,7 +56,7 @@
 
         Timecop.freeze(Time.now + RateLimiting::LOGIN_ATTEMPTS_PERIOD) do
           log_in_correctly_with_username
-          expect_profile_page
+          expect_newflow_profile_page
           # expect(page).to have_content(t :"layouts.application_header.welcome_html", username: 'user')
         end
       end
@@ -87,7 +87,7 @@
         click_link (t :"layouts.application_header.sign_out")
 
         log_in_correctly_with_email(password: '1234abcd')
-        expect_profile_page
+        expect_newflow_profile_page
         # expect(page).to have_content(t :"layouts.application_header.welcome_html", username: 'user')
       end
     end
@@ -112,7 +112,7 @@
 
         Timecop.freeze(Time.now + RateLimiting::LOGIN_ATTEMPTS_PERIOD) do
           log_in_correctly_with_email
-          expect_profile_page
+          expect_newflow_profile_page
           # expect(page).to have_content(t :"layouts.application_header.welcome_html", username: 'user')
         end
       end
@@ -126,47 +126,49 @@
 
         max_attempts_per_ip.times do
           enter_bad_username
-          expect(page).to have_content("We don’t recognize")
+          expect(page).to have_content(t :"login_signup_form.cannot_find_user")
         end
 
+        # Legacy would prevent this message and just return too_many_lookup_attempts at this point,
+        # but Newflow allows it instead
         enter_bad_username
-        expect(page).to have_content(t :"controllers.sessions.too_many_lookup_attempts")
+        expect(page).to have_content(t :"login_signup_form.cannot_find_user")
 
         enter_good_username
-        expect(page).to have_content(t :"controllers.sessions.too_many_lookup_attempts")
+        expect(page).to have_content(t :"login_signup_form.too_many_login_attempts")
 
         Timecop.freeze(Time.now + RateLimiting::LOGIN_ATTEMPTS_PERIOD) do
           log_in_correctly_with_username
-          expect_profile_page
+          expect_newflow_profile_page
         end
       end
     end
   end
 
   def log_in_good_username_bad_password
-    log_in('user', SecureRandom.hex)
+    newflow_log_in_user('user', SecureRandom.hex)
   end
 
   def log_in_good_email_bad_password
-    log_in('user@example.com', SecureRandom.hex)
+    newflow_log_in_user('user@example.com', SecureRandom.hex)
   end
 
   def enter_bad_username
     visit '/'
-    complete_login_username_or_email_screen(SecureRandom.hex)
+    complete_newflow_log_in_screen(SecureRandom.hex)
   end
 
   def enter_good_username
     visit '/'
-    complete_login_username_or_email_screen('user')
+    complete_newflow_log_in_screen('user')
   end
 
   def log_in_correctly_with_username(password: 'password')
-    log_in('user', password)
+    newflow_log_in_user('user', password)
   end
 
   def log_in_correctly_with_email(password: 'password')
-    log_in('user@example.com', password)
+    newflow_log_in_user('user@example.com', password)
   end
 
   def reset_password(password:)
diff --git a/spec/features/remove_accounts_path_prefix_spec.rb b/spec/features/remove_accounts_path_prefix_spec.rb
index c470c3ba2f..873f698872 100644
--- a/spec/features/remove_accounts_path_prefix_spec.rb
+++ b/spec/features/remove_accounts_path_prefix_spec.rb
@@ -1,17 +1,11 @@
 require 'rails_helper'
 
 describe "Remove accounts path prefix" do
-  # Ensure that the config.ru gets loaded before these tests
-  let(:app) {
-    Rack::Builder.new do
-      eval File.read(Rails.root.join('config.ru'))
-    end
-  }
-
+  let(:app) { Rails.application }
   let(:request) { Rack::MockRequest.new(app) }
 
   context "Requests should get routed to the appropriate controllers" do
-    it "should recieve profile info in show page" do
+    it "should receive profile info in show page" do
       expect_any_instance_of(Api::V1::UsersController).to receive(:show)
       request.get("/accounts/api/user")
     end
@@ -21,16 +15,18 @@
       request.get("/accounts")
     end
 
-    it "should be start to sign up" do
-      expect_any_instance_of(Legacy::SignupController).to receive(:start)
-      request.get("/accounts/signup")
+    it "should be welcome to newflow sign up" do
+      expect_any_instance_of(Newflow::SignupController).to receive(:welcome)
+      response = request.get("/accounts/signup")
+      expect(response.get_header('Location')).to end_with('/accounts/i/signup')
+      request.get("/accounts/i/signup")
     end
   end
 
   context "redirects work" do
     it "should redirect home page to login page with prefix" do
       response = request.get("/accounts")
-      expect(URI(response.location).path).to eq "/accounts/login"
+      expect(URI(response.location).path).to eq "/accounts/i/login"
     end
   end
 
diff --git a/spec/features/user_profile_management/README.md b/spec/features/user_profile_management/README.md
deleted file mode 100644
index 933dc2ab5f..0000000000
--- a/spec/features/user_profile_management/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## User profile management (specs)
-
-The specs in this folder are for both the legacy flow and the new flow. The frontend files are shared between the two flows. Whenever a user visits `/profile`, they are simply redirected to `/i/profile` and everything else remains the same.
diff --git a/spec/features/user_profile_management/add_social_auth_spec.rb b/spec/features/user_profile_management/add_social_auth_spec.rb
deleted file mode 100644
index 471ce8fa6e..0000000000
--- a/spec/features/user_profile_management/add_social_auth_spec.rb
+++ /dev/null
@@ -1,67 +0,0 @@
-require 'rails_helper'
-
-feature 'Add social auth', js: true do
-  scenario "email collides with a different existing user's verified email" do
-    create_email_address_for(create_user('other_user'), 'user@example.com')
-
-    user = create_user 'user'
-    log_in('user', 'password')
-
-    expect_profile_page
-
-    click_link (t :"legacy.users.edit.enable_other_sign_in_options")
-    wait_for_animations
-    expect(page).to have_content('Facebook')
-
-    with_omniauth_test_mode(email: 'user@example.com') do
-      find('.authentication[data-provider="facebook"] .add').click
-      wait_for_ajax
-      screenshot!
-      expect_profile_page
-      expect(page).to have_content("already in use")
-    end
-  end
-
-  scenario "email collides with the current user's verified email" do
-    user = create_user 'user'
-    create_email_address_for(user, 'user@example.com')
-
-    log_in('user', 'password')
-
-    expect_profile_page
-
-    click_link (t :"legacy.users.edit.enable_other_sign_in_options")
-    wait_for_animations
-    expect(page).to have_content('Facebook')
-
-    with_omniauth_test_mode(email: 'user@example.com') do
-      find('.authentication[data-provider="facebook"] .add').click
-      wait_for_ajax
-      expect_profile_page
-      expect(page).to have_no_content("already in use")
-      expect(page).to have_content('Facebook')
-    end
-  end
-
-  scenario "email collides with existing user's UNverified email" do
-    create_email_address_for(create_user('other_user'), 'user@example.com', 'token')
-
-    user = create_user 'user'
-    log_in('user', 'password')
-
-    expect_profile_page
-
-    click_link (t :"legacy.users.edit.enable_other_sign_in_options")
-    wait_for_animations
-    expect(page).to have_content('Facebook')
-
-    with_omniauth_test_mode(email: 'user@example.com') do
-      find('.authentication[data-provider="facebook"] .add').click
-      wait_for_ajax
-      screenshot!
-      expect(page).to have_content('already been taken')
-      expect(page).not_to have_content('Facebook')
-    end
-  end
-
-end
diff --git a/spec/features/user_profile_management/require_recent_sign_in_to_change_authentications_spec.rb b/spec/features/user_profile_management/require_recent_sign_in_to_change_authentications_spec.rb
deleted file mode 100644
index af8cd06e54..0000000000
--- a/spec/features/user_profile_management/require_recent_sign_in_to_change_authentications_spec.rb
+++ /dev/null
@@ -1,127 +0,0 @@
-require 'rails_helper'
-
-feature 'Require recent log in to change authentications', js: true do
-
-  scenario 'adding Facebook' do
-    user = create_user 'user'
-
-    log_in('user', 'password')
-
-    expect_profile_page
-
-    Timecop.freeze(Time.now + RequireRecentSignin::REAUTHENTICATE_AFTER) do
-      expect(page).to have_no_content('Facebook')
-      screenshot!
-      click_link (t :"legacy.users.edit.enable_other_sign_in_options")
-      wait_for_animations
-      screenshot!
-      expect(page).to have_no_content(t :"legacy.users.edit.enable_other_sign_in_options")
-      expect(page).to have_content((t :"legacy.users.edit.other_sign_in_options_html")[0..7])
-      expect(page).to have_content('Facebook')
-
-      with_omniauth_test_mode(identity_user: user) do
-        find('.authentication[data-provider="facebook"] .add').click
-        wait_for_ajax
-        expect(page).to have_content(t :"legacy.sessions.reauthenticate.page_heading")
-        screenshot!
-        complete_login_password_screen('password')
-        expect_profile_page
-        expect(page).to have_content('Facebook')
-        screenshot!
-      end
-    end
-  end
-
-  scenario 'changing the password' do
-    with_forgery_protection do
-      create_user 'user'
-
-      log_in('user', 'password')
-
-      expect(page).to have_no_missing_translations
-
-      Timecop.freeze(Time.now + RequireRecentSignin::REAUTHENTICATE_AFTER) do
-        visit '/profile'
-        expect_profile_page
-
-        screenshot!
-        find('.authentication[data-provider="identity"] .edit').click
-
-        expect(page).to have_content(t :"legacy.sessions.reauthenticate.page_heading")
-        complete_login_password_screen('password')
-        screenshot!
-
-        complete_reset_password_screen
-        screenshot!
-        complete_reset_password_success_screen
-
-        screenshot!
-        expect_profile_page
-
-        find('.authentication[data-provider="identity"] .edit').click
-
-        # Don't have to reauthenticate since just did
-        expect(page).to have_no_content(t :"legacy.sessions.reauthenticate.page_heading")
-
-        complete_reset_password_screen
-        complete_reset_password_success_screen
-      end
-    end
-  end
-
-  scenario 'bad password on reauthentication' do
-    create_user 'user'
-    log_in('user', 'password')
-
-    Timecop.freeze(Time.now + RequireRecentSignin::REAUTHENTICATE_AFTER) do
-      visit '/profile'
-      expect_profile_page
-
-      find('.authentication[data-provider="identity"] .edit').click
-
-      expect(page).to have_content(t :"legacy.sessions.reauthenticate.page_heading")
-      complete_login_password_screen('wrongpassword')
-      screenshot!
-
-      expect(page).to have_content(t :"legacy.sessions.reauthenticate.page_heading")
-      complete_login_password_screen('password')
-
-      complete_reset_password_screen
-      complete_reset_password_success_screen
-    end
-  end
-
-  scenario 'removing an authentication' do
-    with_forgery_protection do
-      user = create_user 'user'
-      FactoryBot.create :authentication, user: user, provider: 'twitter'
-
-      log_in('user', 'password')
-
-      expect(page).to have_no_missing_translations
-
-      Timecop.freeze(Time.now + RequireRecentSignin::REAUTHENTICATE_AFTER) do
-        visit '/profile'
-        expect_profile_page
-        expect(page).to have_content('Twitter')
-        screenshot!
-
-        find('.authentication[data-provider="twitter"] .delete').click
-        screenshot!
-        click_button 'OK'
-        expect(page).to have_content(t :"legacy.sessions.reauthenticate.page_heading")
-        screenshot!
-
-        complete_login_password_screen('password')
-        expect_profile_page
-        screenshot!
-
-        find('.authentication[data-provider="twitter"] .delete').click
-        screenshot!
-        click_button 'OK'
-        expect(page).to have_no_content('Twitter')
-      end
-    end
-  end
-
-end
diff --git a/spec/features/user_profile_management/user_updates_password_spec.rb b/spec/features/user_profile_management/user_updates_password_spec.rb
deleted file mode 100644
index 48f415c9bd..0000000000
--- a/spec/features/user_profile_management/user_updates_password_spec.rb
+++ /dev/null
@@ -1,64 +0,0 @@
-require 'rails_helper'
-
-feature 'User updates password on profile screen', js: true do
-  before(:each) do
-    @user = create_user('user')
-    visit '/'
-    complete_login_username_or_email_screen('user')
-    complete_login_password_screen('password')
-    expect_profile_page
-  end
-
-  scenario "adds one" do
-    # Get rid of password (have to add another auth first so things don't freak out)
-    FactoryBot.create :authentication, user: @user, provider: 'facebook'
-    @user.authentications.where(provider: 'identity').destroy_all
-    @user.identity.destroy
-    @user.authentications.reload
-    @user.reload.identity
-    visit '/profile'
-
-    screenshot!
-    find('#enable-other-sign-in').click
-
-    screenshot!
-    wait_for_animations # wait for slide-down effect
-    find('[data-provider=identity] .add').click
-
-    screenshot!
-    complete_add_password_screen
-    screenshot!
-    complete_add_password_success_screen
-    screenshot!
-    expect(page).to have_no_missing_translations
-    expect(page).to have_content(
-      ActionView::Base.full_sanitizer.sanitize 'How you log in'
-    )
-    expect(page).to have_css('[data-provider=facebook]')
-    expect(page).to have_css('[data-provider=identity]')
-  end
-
-  scenario "changes existing" do
-    find('[data-provider=identity] .edit').click
-    complete_reset_password_screen
-    complete_reset_password_success_screen
-    expect(page).to have_no_missing_translations
-    expect(page).to have_content(
-      ActionView::Base.full_sanitizer.sanitize t(:"legacy.users.edit.how_you_sign_in_html")
-    )
-    expect(page).to have_css('[data-provider=identity]')
-  end
-
-  scenario "deletes password" do
-    FactoryBot.create :authentication, user: @user, provider: 'facebook'
-    visit '/profile'
-    expect(@user.reload.identity).to be_present
-    expect(@user.authentications.reload.count).to eq 2
-    expect(page).to have_css('[data-provider=identity]')
-    find('[data-provider=identity] .delete').click
-    find('.confirm-dialog-btn-confirm').click
-    expect(page).to have_no_css('[data-provider=identity]')
-    expect(@user.reload.identity).to be_nil
-    expect(@user.authentications.reload.count).to eq 1
-  end
-end
diff --git a/spec/features/user_profile_management/user_updates_profile_spec.rb b/spec/features/user_profile_management/user_updates_profile_spec.rb
deleted file mode 100644
index 1461b5ef12..0000000000
--- a/spec/features/user_profile_management/user_updates_profile_spec.rb
+++ /dev/null
@@ -1,52 +0,0 @@
-require 'rails_helper'
-
-feature 'User updates profile', js: true do
-  before(:each) do
-    mock_current_user(create_user('user'))
-    visit '/profile'
-  end
-
-  describe 'Updating name' do
-    before(:each) do
-      find('#name').click
-    end
-
-    scenario 'first name' do
-      fill_in 'first_name', with: 'testuser'
-      screenshot!
-      find('.glyphicon-ok').click
-      expect(page).to have_link('testuser')
-      screenshot!
-    end
-
-    scenario 'blank first name' do
-      fill_in 'first_name', with: ''
-      find('.glyphicon-ok').click
-      expect(find('.editable-error-block').text).to include (t :"javascript.name.first_name_blank")
-      screenshot!
-    end
-
-    scenario 'blank last name' do
-      fill_in 'last_name', with: ''
-      find('.glyphicon-ok').click
-      expect(find('.editable-error-block').text).to include (t :"javascript.name.last_name_blank")
-      screenshot!
-    end
-
-    scenario 'blank first and last name' do
-      fill_in 'first_name', with: ''
-      fill_in 'last_name', with: ''
-      find('.glyphicon-ok').click
-      expect(find('.editable-error-block').text).to include (t :"javascript.name.first_last_name_blank")
-      screenshot!
-    end
-
-    scenario 'name with spaces' do
-      fill_in 'last_name', with: '  '
-      find('.glyphicon-ok').click
-      expect(find('.editable-error-block').text).to include (t :"javascript.name.last_name_blank")
-      screenshot!
-    end
-
-  end
-end
diff --git a/spec/handlers/contact_infos_resend_confirmation_spec.rb b/spec/handlers/contact_infos_resend_confirmation_spec.rb
index 0633ccd26a..7ba765ee0f 100644
--- a/spec/handlers/contact_infos_resend_confirmation_spec.rb
+++ b/spec/handlers/contact_infos_resend_confirmation_spec.rb
@@ -1,7 +1,6 @@
 require 'rails_helper'
 
 describe ContactInfosResendConfirmation, type: :handler do
-
   let!(:contact_info) { FactoryBot.create :email_address }
   let!(:user)         { contact_info.user }
 
@@ -14,8 +13,8 @@
         receive(:instructions).with(email_address: contact_info, send_pin: false)
       )
 
-        ContactInfosResendConfirmation.call(caller: user,
-                                          params: { id: contact_info.id })
+      ContactInfosResendConfirmation.call(caller: user, params: { id: contact_info.id })
+      perform_enqueued_jobs
     end
   end
 
diff --git a/spec/handlers/create_external_user_credentials_spec.rb b/spec/handlers/create_external_user_credentials_spec.rb
index 398a114a96..43f82faacf 100644
--- a/spec/handlers/create_external_user_credentials_spec.rb
+++ b/spec/handlers/create_external_user_credentials_spec.rb
@@ -1,13 +1,13 @@
 require 'rails_helper'
 
-RSpec.describe CreateExternalUserCredentials, type: :handler do
+describe CreateExternalUserCredentials, type: :handler do
   let(:user)  do
     FactoryBot.create :user, receive_newsletter: false,
                              role: User::UNKNOWN_ROLE,
                              state: User::EXTERNAL
   end
 
-  let(:email) { Faker::Internet.free_email }
+  let(:email) { Faker::Internet.email }
 
   let(:params) do
     {
@@ -53,6 +53,7 @@
         )
       )
       handler_call
+      perform_enqueued_jobs
     end
 
     it "sets the User's role to student" do
@@ -125,7 +126,8 @@
     it 'returns an error' do
       expect(handler_call.errors).to have_offending_input(:email)
       expect(handler_call.errors.first.message).to eq(
-        I18n.t(:"login_signup_form.invalid_email_provider", email: email)
+        I18n.t(:"activerecord.errors.models.email_address.attributes.value.missing_mx_records",
+               value: email)
       )
     end
   end
diff --git a/spec/handlers/messages_create_spec.rb b/spec/handlers/messages_create_spec.rb
index b89e70e436..8641a2688f 100644
--- a/spec/handlers/messages_create_spec.rb
+++ b/spec/handlers/messages_create_spec.rb
@@ -1,7 +1,6 @@
 require 'rails_helper'
 
 describe MessagesCreate, type: :handler do
-
   let!(:trusted_application)   {
     FactoryBot.create :doorkeeper_application, can_message_users: true,
                        email_from_address: 'app@example.com'
@@ -117,6 +116,8 @@
 
       expect(Message.count).to eq(c + 1)
 
+      perform_enqueued_jobs
+
       expect(Mail::TestMailer.deliveries.length).to eq(1)
     end
   end
diff --git a/spec/handlers/newflow/change_signup_email_spec.rb b/spec/handlers/newflow/change_signup_email_spec.rb
index 7478d5dcb7..b21b7dbce6 100644
--- a/spec/handlers/newflow/change_signup_email_spec.rb
+++ b/spec/handlers/newflow/change_signup_email_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe ChangeSignupEmail, type: :handler do
+  describe ChangeSignupEmail, type: :handler do
     before do
       FactoryBot.create :email_address, value: before_change_email, verified: false, user: user
     end
@@ -13,7 +13,7 @@ module Newflow
     let(:params) {
       {
         change_signup_email: {
-          email: Faker::Internet.free_email
+          email: Faker::Internet.email
         }
       }
     }
@@ -39,6 +39,7 @@ module Newflow
           receive(:signup_email_confirmation).once.and_call_original
         )
         described_class.call(params: params, user: user)
+        perform_enqueued_jobs
       end
     end
 
diff --git a/spec/handlers/newflow/confirm_oauth_info_spec.rb b/spec/handlers/newflow/confirm_oauth_info_spec.rb
index 66b23760b4..d19b4015a3 100644
--- a/spec/handlers/newflow/confirm_oauth_info_spec.rb
+++ b/spec/handlers/newflow/confirm_oauth_info_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe ConfirmOauthInfo, type: :handler do
+  describe ConfirmOauthInfo, type: :handler do
     before do
       disable_sfdc_client
     end
@@ -11,7 +11,7 @@ module Newflow
         signup: {
           first_name: 'Bryan',
           last_name: 'Dimas',
-          email: Faker::Internet.free_email,
+          email: Faker::Internet.email,
           newsletter: '1',
           terms_accepted: '1',
           contract_1_id: FinePrint::Contract.first.id,
diff --git a/spec/handlers/newflow/educator_signup/sheerid_webhook_spec.rb b/spec/handlers/newflow/educator_signup/sheerid_webhook_spec.rb
index 4f077cd5f7..c227459042 100644
--- a/spec/handlers/newflow/educator_signup/sheerid_webhook_spec.rb
+++ b/spec/handlers/newflow/educator_signup/sheerid_webhook_spec.rb
@@ -1,8 +1,8 @@
 require 'rails_helper'
 require 'vcr_helper'
 
-#RSpec.describe Newflow::EducatorSignup::SheeridWebhook, type: :routine, vcr: VCR_OPTS do
-RSpec.describe Newflow::EducatorSignup::SheeridWebhook, type: :routine do
+#describe Newflow::EducatorSignup::SheeridWebhook, type: :routine, vcr: VCR_OPTS do
+describe Newflow::EducatorSignup::SheeridWebhook, type: :routine do
   let(:email_address)           { FactoryBot.create :email_address, :verified }
   let(:user)                    { email_address.user }
   let!(:school)                 {
diff --git a/spec/handlers/newflow/educator_signup/signup_form_spec.rb b/spec/handlers/newflow/educator_signup/signup_form_spec.rb
index 5d322f8de6..13601cc908 100644
--- a/spec/handlers/newflow/educator_signup/signup_form_spec.rb
+++ b/spec/handlers/newflow/educator_signup/signup_form_spec.rb
@@ -26,7 +26,7 @@ module EducatorSignup
         end
 
         let(:email) do
-          Faker::Internet.free_email
+          Faker::Internet.email
         end
 
         it 'creates an (unverified) user with role = instructor' do
@@ -61,6 +61,7 @@ module EducatorSignup
             )
           )
           handler_call
+          perform_enqueued_jobs
         end
 
         it 'outputs a user' do
@@ -110,7 +111,7 @@ module EducatorSignup
         end
 
         let(:email) do
-          Faker::Internet.free_email
+          Faker::Internet.email
         end
 
         let(:params) do
@@ -193,7 +194,8 @@ module EducatorSignup
         example do
           result = described_class.call(params: params)
           expect(result.errors.first.message).to eq(
-            I18n.t(:"login_signup_form.invalid_email_provider", email: 'user@baddomain.com')
+            I18n.t(:"activerecord.errors.models.email_address.attributes.value.missing_mx_records",
+                   value: 'user@baddomain.com')
           )
           expect(result.errors).to have_offending_input(:email)
         end
diff --git a/spec/handlers/newflow/student_signup/signup_form_spec.rb b/spec/handlers/newflow/student_signup/signup_form_spec.rb
index 60fc91f3b5..f18fe379fd 100644
--- a/spec/handlers/newflow/student_signup/signup_form_spec.rb
+++ b/spec/handlers/newflow/student_signup/signup_form_spec.rb
@@ -32,7 +32,7 @@ module StudentSignup
         end
 
         let(:email) do
-          Faker::Internet.free_email
+          Faker::Internet.email
         end
 
         it 'creates an (unverified) user with role = student' do
@@ -74,6 +74,7 @@ module StudentSignup
             )
           )
           handler_call
+          perform_enqueued_jobs
         end
 
         it 'stores selection in User whether to receive newsletter or not' do
@@ -93,7 +94,7 @@ module StudentSignup
         end
 
         let(:email) do
-          Faker::Internet.free_email
+          Faker::Internet.email
         end
 
         let(:params) do
@@ -174,7 +175,8 @@ module StudentSignup
           result = described_class.call(params: params)
           expect(result.errors).to have_offending_input(:email)
           expect(result.errors.first.message).to eq(
-            I18n.t(:"login_signup_form.invalid_email_provider", email: 'user@baddomain.com')
+            I18n.t(:"activerecord.errors.models.email_address.attributes.value.missing_mx_records",
+                   value: 'user@baddomain.com')
           )
         end
       end
diff --git a/spec/handlers/oauth_callback_spec.rb b/spec/handlers/oauth_callback_spec.rb
index 870a0d2242..4057bd17b6 100644
--- a/spec/handlers/oauth_callback_spec.rb
+++ b/spec/handlers/oauth_callback_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe OauthCallback, type: :handler do
+describe OauthCallback, type: :handler do
   let(:email) { Faker::Internet.email }
 
   context 'when existing authentication found' do
diff --git a/spec/handlers/send_reset_password_email_spec.rb b/spec/handlers/send_reset_password_email_spec.rb
index 5458b62cbe..b971a4b5a8 100644
--- a/spec/handlers/send_reset_password_email_spec.rb
+++ b/spec/handlers/send_reset_password_email_spec.rb
@@ -17,6 +17,7 @@
     it 'sends a password reset email' do
       expect_any_instance_of(NewflowMailer).to receive(:reset_password_email).and_call_original
       described_class.call(params: {}, caller: user)
+      perform_enqueued_jobs
     end
   end
 
@@ -25,6 +26,7 @@
       user # create it
       expect_any_instance_of(NewflowMailer).to receive(:reset_password_email).and_call_original
       described_class.call(params: params, caller: AnonymousUser.instance)
+      perform_enqueued_jobs
     end
   end
 
diff --git a/spec/handlers/sessions_create_spec.rb b/spec/handlers/sessions_create_spec.rb
index 6ad5799004..97c2167e41 100644
--- a/spec/handlers/sessions_create_spec.rb
+++ b/spec/handlers/sessions_create_spec.rb
@@ -2,7 +2,7 @@
 require 'rails_helper'
 require_relative 'sessions_create_shared_examples'
 
-RSpec.describe SessionsCreate, type: :handler do
+describe SessionsCreate, type: :handler do
 
   include_examples 'sessions create shared examples'
 
diff --git a/spec/handlers/signup_password_spec.rb b/spec/handlers/signup_password_spec.rb
index df93567be0..d62950f512 100644
--- a/spec/handlers/signup_password_spec.rb
+++ b/spec/handlers/signup_password_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SignupPassword, type: :handler do
+describe SignupPassword, type: :handler do
 
   let(:pre_auth_state) {
     FactoryBot.create(:pre_auth_state, :contact_info_verified, contact_info_value: "bob@armstrong.com")
diff --git a/spec/handlers/signup_profile_instructor_spec.rb b/spec/handlers/signup_profile_instructor_spec.rb
index 0242f343cc..97df16a7d2 100644
--- a/spec/handlers/signup_profile_instructor_spec.rb
+++ b/spec/handlers/signup_profile_instructor_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SignupProfileInstructor, type: :handler do
+describe SignupProfileInstructor, type: :handler do
 
   before(:each) do
     load 'db/seeds.rb'
diff --git a/spec/handlers/signup_profile_other_spec.rb b/spec/handlers/signup_profile_other_spec.rb
index 3c77575056..d9503e7eb3 100644
--- a/spec/handlers/signup_profile_other_spec.rb
+++ b/spec/handlers/signup_profile_other_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SignupProfileOther, type: :handler do
+describe SignupProfileOther, type: :handler do
 
   before(:each) do
     load 'db/seeds.rb'
diff --git a/spec/handlers/signup_profile_student_spec.rb b/spec/handlers/signup_profile_student_spec.rb
index caf5a40b4c..4d36f43e99 100644
--- a/spec/handlers/signup_profile_student_spec.rb
+++ b/spec/handlers/signup_profile_student_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SignupProfileStudent, type: :handler do
+describe SignupProfileStudent, type: :handler do
 
   before(:each) do
     load 'db/seeds.rb'
diff --git a/spec/helpers/newflow/login_signup_helper_spec.rb b/spec/helpers/newflow/login_signup_helper_spec.rb
index 4cd556d28d..8e5c778fae 100644
--- a/spec/helpers/newflow/login_signup_helper_spec.rb
+++ b/spec/helpers/newflow/login_signup_helper_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 module Newflow
-  RSpec.describe LoginSignupHelper, type: :helper do
+  describe LoginSignupHelper, type: :helper do
     describe "#extract_params" do
       context 'happy path' do
         subject { helper.extract_params(url) }
diff --git a/spec/lib/authenticate_methods_spec.rb b/spec/lib/authenticate_methods_spec.rb
index ed24a06bf1..ae78347faa 100644
--- a/spec/lib/authenticate_methods_spec.rb
+++ b/spec/lib/authenticate_methods_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe AuthenticateMethods, type: :lib do
+describe AuthenticateMethods, type: :lib do
   let(:user_1)     { FactoryBot.create(:user) }
 
   let(:controller) { ActionController::Base.new }
diff --git a/spec/lib/domain_mx_validator_spec.rb b/spec/lib/domain_mx_validator_spec.rb
index 363687d002..5994d2492a 100644
--- a/spec/lib/domain_mx_validator_spec.rb
+++ b/spec/lib/domain_mx_validator_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe EmailDomainMxValidator, type: :lib do
+describe EmailDomainMxValidator, type: :lib do
   let(:invalid_provider) { 'invalidjunk123.com' }
 
   it 'delegates responsibility to a strategy object' do
diff --git a/spec/lib/json_and_string_parameter_filter_spec.rb b/spec/lib/json_and_string_parameter_filter_spec.rb
index c38ff9b9cf..66077f5721 100644
--- a/spec/lib/json_and_string_parameter_filter_spec.rb
+++ b/spec/lib/json_and_string_parameter_filter_spec.rb
@@ -2,7 +2,7 @@
 require 'rails_helper'
 require 'json_and_string_parameter_filter'
 
-RSpec.describe JsonAndStringParameterFilter do
+describe JsonAndStringParameterFilter do
   let!(:string_filters) { [:Email, :last_name, :password] }
   let!(:json_key_filters) { [:password] }
   let!(:value_filters) { [Proc.new { |value| value =~ /^[^@]+@[^.]+\..+/ }] }
diff --git a/spec/lib/sheerid_api_spec.rb b/spec/lib/sheerid_api_spec.rb
index 8468d4285f..c1e2358161 100644
--- a/spec/lib/sheerid_api_spec.rb
+++ b/spec/lib/sheerid_api_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 require 'vcr_helper'
 
-RSpec.describe SheeridAPI, type: :lib, vcr: VCR_OPTS do
+describe SheeridAPI, type: :lib, vcr: VCR_OPTS do
   describe '#get_verification_details' do
     context 'when success' do
       subject(:response) { described_class.get_verification_details(verification_id) }
diff --git a/spec/lib/sso_cookie_jar_spec.rb b/spec/lib/sso_cookie_jar_spec.rb
index 65a974675f..e6c8a6483a 100644
--- a/spec/lib/sso_cookie_jar_spec.rb
+++ b/spec/lib/sso_cookie_jar_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SsoCookieJar, type: :lib do
+describe SsoCookieJar, type: :lib do
   let(:secrets)                { Rails.application.secrets.sso }
 
   let(:signature_public_key)   { OpenSSL::PKey::RSA.new secrets[:signature_public_key] }
diff --git a/spec/lib/tasks/doorkeeper/cleanup_rake_spec.rb b/spec/lib/tasks/doorkeeper/cleanup_rake_spec.rb
index 91c85c2ab4..a2036e6c84 100644
--- a/spec/lib/tasks/doorkeeper/cleanup_rake_spec.rb
+++ b/spec/lib/tasks/doorkeeper/cleanup_rake_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 require 'rake'
 
-RSpec.describe 'doorkeeper:cleanup' do
+describe 'doorkeeper:cleanup' do
   include_context 'rake'
 
   before(:all) do
diff --git a/spec/lib/tasks/export_users_info_to_match_with_consent_forms_spec.rb b/spec/lib/tasks/export_users_info_to_match_with_consent_forms_spec.rb
index c861d57822..3955a23498 100644
--- a/spec/lib/tasks/export_users_info_to_match_with_consent_forms_spec.rb
+++ b/spec/lib/tasks/export_users_info_to_match_with_consent_forms_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ExportUsersInfoToMatchWithConsentForms, type: :routine do
+describe ExportUsersInfoToMatchWithConsentForms, type: :routine do
 
   context "as a Lev output with student information" do
     let!(:user_1){ FactoryBot.create :user, username: "TonyStark", first_name: "Tony", last_name: "Stark" }
diff --git a/spec/lib/tasks/export_users_last_login_date_spec.rb b/spec/lib/tasks/export_users_last_login_date_spec.rb
index 8d2a16d83a..bf09467dd8 100644
--- a/spec/lib/tasks/export_users_last_login_date_spec.rb
+++ b/spec/lib/tasks/export_users_last_login_date_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ExportUsersLastLoginDate, type: :routine do
+describe ExportUsersLastLoginDate, type: :routine do
 
   context "as a Lev output with student information" do
     let!(:user_1){ FactoryBot.create :user }
diff --git a/spec/lib/user_session_management_spec.rb b/spec/lib/user_session_management_spec.rb
index f69756a948..5357c743f4 100644
--- a/spec/lib/user_session_management_spec.rb
+++ b/spec/lib/user_session_management_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe UserSessionManagement, type: :lib do
+describe UserSessionManagement, type: :lib do
   let(:user_1)     { FactoryBot.create(:user) }
   let(:user_2)     { FactoryBot.create(:user) }
 
@@ -43,7 +43,7 @@ def login_path(params = {})
 
     it 'set_login_state stores the given info in the session' do
       expect(session).to receive(:[]=).with(
-        :login, 'u' => 'username', 'm' => [1], 'n' => ['User'], 'p' => ['identity']
+        :login, {'u' => 'username', 'm' => [1], 'n' => ['User'], 'p' => ['identity']}
       )
       controller.set_login_state(
         username_or_email: 'username',
@@ -214,7 +214,7 @@ def login_path(params = {})
       session = {}
       allow(controller).to receive(:session).and_return(session)
       expect(session).to receive(:[]=).with(
-        :login, 'u' => 'username', 'm' => [1], 'n' => ['User'], 'p' => ['identity']
+        :login, {'u' => 'username', 'm' => [1], 'n' => ['User'], 'p' => ['identity']}
       )
       controller.set_login_state(
         username_or_email: 'username',
diff --git a/spec/mailers/exception_spec.rb b/spec/mailers/exception_spec.rb
index 01ce5a9b28..7c86637313 100644
--- a/spec/mailers/exception_spec.rb
+++ b/spec/mailers/exception_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe 'ActionMailer::DeliveryJob error recovery' do
+describe 'ActionMailer::DeliveryJob error recovery' do
 
   context 'when get an AWS::SES::ResponseError with Code "InvalidParameterValue"' do
     # Turn on reraising so that we test that we do not reraise these
diff --git a/spec/models/authentication_spec.rb b/spec/models/authentication_spec.rb
index 244c995e3b..0db7f6d42d 100644
--- a/spec/models/authentication_spec.rb
+++ b/spec/models/authentication_spec.rb
@@ -1,44 +1,52 @@
 require 'rails_helper'
 
 describe Authentication do
-
   let!(:authentication) { FactoryBot.create(:authentication) }
 
   context "when an authentication exists" do
-    it "is returned by by_provider_and_uid" do
+    it "is returned by find_by_provider_and_uid" do
       value = Authentication.find_by_provider_and_uid(authentication.provider, authentication.uid)
       expect(value).to eq authentication
     end
 
-    it "is returned by by_provider_and_uid!" do
+    it "is returned by find_or_create_by" do
       value = nil
-      expect{value = Authentication.find_or_create_by(provider: authentication.provider,
-        uid: authentication.uid
-      )}.not_to change{Authentication.count}
+      expect do
+        value = Authentication.find_or_create_by(
+          provider: authentication.provider,
+          uid: authentication.uid
+        ) do |new_auth|
+          new_auth.user = authentication.user
+        end
+      end.not_to change{Authentication.count}
       expect(value).to eq authentication
     end
 
     it "cannot be created again with the same provider and UID" do
       new_authentication = Authentication.create(provider: authentication.provider,
-                                                 uid: authentication.uid)
+                                                 uid: authentication.uid,
+                                                 user: authentication.user)
       expect(new_authentication).not_to be_valid
     end
   end
 
   context "when an authentication doesn't exist" do
-    it "returns nil from by_provider_and_uid" do
+    it "returns nil from find_by_provider_and_uid" do
       expect(Authentication.find_by_provider_and_uid("foo", "bar")).to be_nil
     end
 
-    it "is created by by_provider_and_uid!" do
+    it "is created by find_or_create_by" do
       provider = SecureRandom.hex(4)
       value = nil
-      expect{
-        value = Authentication.find_or_create_by(provider: provider, uid: "42"
-      )}.to change{Authentication.count}.by(1)
+      expect do
+        value = Authentication.find_or_create_by(provider: provider, uid: '42') do |new_auth|
+          new_auth.user = authentication.user
+        end
+      end.to change{Authentication.count}.by(1)
       expect(value.class).to eq Authentication
       expect(value.provider).to eq provider
-      expect(value.uid).to eq "42"
+      expect(value.uid).to eq '42'
+      expect(value.user).to eq authentication.user
     end
   end
 
diff --git a/spec/models/banner_spec.rb b/spec/models/banner_spec.rb
index 41fe3335aa..6696cc2cf2 100644
--- a/spec/models/banner_spec.rb
+++ b/spec/models/banner_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Banner, type: :model do
+describe Banner, type: :model do
   it { should validate_presence_of :message }
   it { should validate_presence_of :expires_at }
 
diff --git a/spec/models/contact_info_spec.rb b/spec/models/contact_info_spec.rb
index db8d1e38a6..7f6e173130 100644
--- a/spec/models/contact_info_spec.rb
+++ b/spec/models/contact_info_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ContactInfo, type: :model do
+describe ContactInfo, type: :model do
   subject(:contact_info) { FactoryBot.create :email_address }
 
   it { is_expected.to validate_presence_of(:value) }
diff --git a/spec/models/doorkeeper/application_spec.rb b/spec/models/doorkeeper/application_spec.rb
index 817e353cbb..2f4670fd13 100644
--- a/spec/models/doorkeeper/application_spec.rb
+++ b/spec/models/doorkeeper/application_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Doorkeeper::Application, type: :model do
+describe Doorkeeper::Application, type: :model do
   subject(:application) { FactoryBot.create :doorkeeper_application }
 
   it { is_expected.to have_many(:application_users).dependent(:destroy) }
diff --git a/spec/models/external_id_spec.rb b/spec/models/external_id_spec.rb
index cc9d21f083..9bdbe03ed2 100644
--- a/spec/models/external_id_spec.rb
+++ b/spec/models/external_id_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ExternalId, type: :model do
+describe ExternalId, type: :model do
   subject { FactoryBot.create :external_id }
 
   it { is_expected.to belong_to(:user) }
diff --git a/spec/models/school_spec.rb b/spec/models/school_spec.rb
index 2ae48c2232..72e803f8de 100644
--- a/spec/models/school_spec.rb
+++ b/spec/models/school_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe School, type: :model do
+describe School, type: :model do
   subject(:school) { FactoryBot.create :school }
 
   it 'can use fuzzy search to find matching cached Schools from SheerID data' do
diff --git a/spec/models/security_log_spec.rb b/spec/models/security_log_spec.rb
index 00203870ec..c235a6b5c7 100644
--- a/spec/models/security_log_spec.rb
+++ b/spec/models/security_log_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SecurityLog, type: :model do
+describe SecurityLog, type: :model do
   subject(:security_log) { FactoryBot.create :security_log }
 
   it { should belong_to :user }
@@ -14,7 +14,7 @@
     expect{security_log.update_attribute :event_type, :admin_created}.to(
       raise_error ActiveRecord::ReadOnlyRecord
     )
-    expect{security_log.update_attributes event_type: :admin_created}.to(
+    expect{security_log.update event_type: :admin_created}.to(
       raise_error ActiveRecord::ReadOnlyRecord
     )
   end
diff --git a/spec/models/sequential_failure_spec.rb b/spec/models/sequential_failure_spec.rb
index d31203c63a..7bbf1114ac 100644
--- a/spec/models/sequential_failure_spec.rb
+++ b/spec/models/sequential_failure_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SequentialFailure, type: :model do
+describe SequentialFailure, type: :model do
   it { should validate_presence_of(:length) }
   it { should validate_presence_of(:reference) }
   subject { SequentialFailure.confirm_by_pin.new }
diff --git a/spec/models/user_external_uuid_spec.rb b/spec/models/user_external_uuid_spec.rb
index 36ed099b35..44dc8764e4 100644
--- a/spec/models/user_external_uuid_spec.rb
+++ b/spec/models/user_external_uuid_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe UserExternalUuid, type: :model do
+describe UserExternalUuid, type: :model do
 
   let(:user) { FactoryBot.create :user }
 
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 008ed10964..b570bd38cd 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1,7 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe User, type: :model do
-
+describe User, type: :model do
   subject(:user) { FactoryBot.create :user }
 
   it { is_expected.to have_many :security_logs }
@@ -30,7 +29,7 @@
 
     context 'when the names start populated' do
       before(:each) {
-        user.update_attributes(first_name: "John", last_name: "Smith")
+        user.update(first_name: "John", last_name: "Smith")
       }
 
       it 'is invalid for the first name to become blank' do
@@ -125,7 +124,7 @@
     it 'cannot be updated' do
       user = FactoryBot.create :user
       old_uuid = user.uuid
-      user.update_attributes(first_name: 'New')
+      user.update(first_name: 'New')
       expect(user.reload.first_name).to eq('New')
       expect(user.uuid).to eq(old_uuid)
 
@@ -146,7 +145,7 @@
     it 'cannot be updated' do
       user = FactoryBot.create :user
       old_identifier = user.support_identifier
-      user.update_attributes(first_name: 'New')
+      user.update(first_name: 'New')
       expect(user.reload.first_name).to eq('New')
       expect(user.support_identifier).to eq(old_identifier)
 
@@ -363,7 +362,9 @@
     context 'with some manually entered emails' do
       before do
         ConfirmContactInfo[@email_a]
+        perform_enqueued_jobs
         ConfirmContactInfo[@email_c]
+        perform_enqueued_jobs
       end
 
       context 'with the user\'s email_addresses and contact_infos not yet loaded' do
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index ff910cb1a4..68e6004dff 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -121,8 +121,10 @@
   config.default_max_wait_time = 15
 end
 
-# Whitelist the capybara host (which can change)
 RSpec.configure do |config|
+  config.include ActiveJob::TestHelper
+
+  # Whitelist the capybara host (which can change)
   config.before(:each) do
     allow(Host).to receive(:trusted_host_regexes).and_wrap_original do |m, *args|
       m.call(*args).tap do |result|
diff --git a/spec/representers/api/v1/external_id_representer_spec.rb b/spec/representers/api/v1/external_id_representer_spec.rb
index cb20d36988..fe9e240732 100644
--- a/spec/representers/api/v1/external_id_representer_spec.rb
+++ b/spec/representers/api/v1/external_id_representer_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::ExternalIdRepresenter, type: :representer do
+describe Api::V1::ExternalIdRepresenter, type: :representer do
   let(:external_id)     { FactoryBot.create :external_id }
   subject(:representer) { described_class.new external_id }
 
diff --git a/spec/representers/api/v1/find_user_representer_spec.rb b/spec/representers/api/v1/find_user_representer_spec.rb
index 9610e90917..9e74130e33 100644
--- a/spec/representers/api/v1/find_user_representer_spec.rb
+++ b/spec/representers/api/v1/find_user_representer_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::FindUserRepresenter, type: :representer do
+describe Api::V1::FindUserRepresenter, type: :representer do
   let(:payload)         { Hashie::Mash.new external_ids: [] }
   subject(:representer) { described_class.new payload }
 
diff --git a/spec/representers/api/v1/user_representer_spec.rb b/spec/representers/api/v1/user_representer_spec.rb
index 7fafc63005..66f3e0f8aa 100644
--- a/spec/representers/api/v1/user_representer_spec.rb
+++ b/spec/representers/api/v1/user_representer_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Api::V1::UserRepresenter, type: :representer do
+describe Api::V1::UserRepresenter, type: :representer do
   let(:user)            { FactoryBot.create :user  }
   let(:school)          { FactoryBot.create :school  }
   subject(:representer) { described_class.new(user) }
diff --git a/spec/requests/api/v1/application_users_requests_spec.rb b/spec/requests/api/v1/application_users_requests_spec.rb
index 00eea32bd1..a1f9b4abe2 100644
--- a/spec/requests/api/v1/application_users_requests_spec.rb
+++ b/spec/requests/api/v1/application_users_requests_spec.rb
@@ -2,7 +2,7 @@
 
 # Moved multiple request specs here from the controller spec
 
-RSpec.describe 'Api::V1::ApplicationUsers multiple requests',
+describe 'Api::V1::ApplicationUsers multiple requests',
                type: :request, api: true, version: :v1 do
 
   let!(:untrusted_application) { FactoryBot.create :doorkeeper_application }
@@ -30,8 +30,8 @@
                        resource_owner_id: nil
   end
 
-  let(:updated_endpoint) { "/api/application_users/updated" }
-  let(:updates_endpoint) { "/api/application_users/updates" }
+  let(:updated_endpoint) { updated_api_application_users_path }
+  let(:updates_endpoint) { updates_api_application_users_path }
 
   context "updates" do
     let(:app_user) { user_2.application_users.first }
diff --git a/spec/requests/api/v1/cache_header_spec.rb b/spec/requests/api/v1/cache_header_spec.rb
index 67fcfce0e2..e2bcd79560 100644
--- a/spec/requests/api/v1/cache_header_spec.rb
+++ b/spec/requests/api/v1/cache_header_spec.rb
@@ -2,7 +2,7 @@
 
 # Moved multiple request specs here from the controller spec
 
-RSpec.describe 'API cache header verification',
+describe 'API cache header verification',
                type: :request, api: true, version: :v1 do
 
   let!(:untrusted_application) { FactoryBot.create :doorkeeper_application }
diff --git a/spec/requests/api/v1/device_id_spec.rb b/spec/requests/api/v1/device_id_spec.rb
index 8cc1c368ae..4f351999e9 100644
--- a/spec/requests/api/v1/device_id_spec.rb
+++ b/spec/requests/api/v1/device_id_spec.rb
@@ -1,7 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe 'device ID tracking',
-               type: :request, api: true, version: :v1 do
+describe 'device ID tracking', type: :request, api: true, version: :v1 do
 
   let!(:user) do
     FactoryBot.create :user_with_emails,
diff --git a/spec/routines/admin/export_users_spec.rb b/spec/routines/admin/export_users_spec.rb
index e3e75168b2..2e5e9e087d 100644
--- a/spec/routines/admin/export_users_spec.rb
+++ b/spec/routines/admin/export_users_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::ExportUsers, type: :routine do
+describe Admin::ExportUsers, type: :routine do
 
   before(:all) do
     @user_1 = FactoryBot.create :user_with_emails
diff --git a/spec/routines/admin/import_users_spec.rb b/spec/routines/admin/import_users_spec.rb
index d576e35c7d..e0aff29814 100644
--- a/spec/routines/admin/import_users_spec.rb
+++ b/spec/routines/admin/import_users_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::ImportUsers, type: :routine do
+describe Admin::ImportUsers, type: :routine do
 
   let(:filename) { 'spec/fixtures/users.json' }
 
diff --git a/spec/routines/admin/search_security_log_spec.rb b/spec/routines/admin/search_security_log_spec.rb
index da5cb741ca..408f64bb9d 100644
--- a/spec/routines/admin/search_security_log_spec.rb
+++ b/spec/routines/admin/search_security_log_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::SearchSecurityLog, type: :routine do
+describe Admin::SearchSecurityLog, type: :routine do
 
   before(:each) do
     @user = FactoryBot.create :user, first_name: 'Test', last_name: 'User', username: 'TestUser'
diff --git a/spec/routines/admin/search_users_spec.rb b/spec/routines/admin/search_users_spec.rb
index da1a8c7c70..0187c38230 100644
--- a/spec/routines/admin/search_users_spec.rb
+++ b/spec/routines/admin/search_users_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Admin::SearchUsers, type: :routine do
+describe Admin::SearchUsers, type: :routine do
 
   let!(:user_1)          do
     FactoryBot.create :user_with_emails, first_name: 'John',
diff --git a/spec/routines/find_or_create_user_spec.rb b/spec/routines/find_or_create_user_spec.rb
index 609c24b447..27b8aff4e5 100644
--- a/spec/routines/find_or_create_user_spec.rb
+++ b/spec/routines/find_or_create_user_spec.rb
@@ -1,7 +1,6 @@
 require 'rails_helper'
 
 describe FindOrCreateUser do
-
   let(:user) { FactoryBot.create :user, state: 'unclaimed' }
 
   context "Given an email" do
@@ -34,6 +33,7 @@
               email:"anunusedemail@example.com",
               first_name: Faker::Name.first_name, last_name: Faker::Name.last_name, already_verified: false
             ).outputs.user
+            perform_enqueued_jobs
             email = ActionMailer::Base.deliveries.last
             expect(email.subject).to match('You have been invited to join OpenStax')
           end.to change { ActionMailer::Base.deliveries.count }.by(1)
diff --git a/spec/routines/mark_contact_info_verified_spec.rb b/spec/routines/mark_contact_info_verified_spec.rb
index 51da18c75b..d15e9ec3ab 100644
--- a/spec/routines/mark_contact_info_verified_spec.rb
+++ b/spec/routines/mark_contact_info_verified_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe MarkContactInfoVerified, type: :routine do
+describe MarkContactInfoVerified, type: :routine do
   [
     [ :email_address, :verified? ]
   ].each do |klass, method|
diff --git a/spec/routines/newflow/create_or_update_salesforce_lead_spec.rb b/spec/routines/newflow/create_or_update_salesforce_lead_spec.rb
index 1952635f7d..c34a2e089d 100644
--- a/spec/routines/newflow/create_or_update_salesforce_lead_spec.rb
+++ b/spec/routines/newflow/create_or_update_salesforce_lead_spec.rb
@@ -2,7 +2,7 @@
 require 'vcr_helper'
 
 module Newflow
-  RSpec.describe CreateOrUpdateSalesforceLead, type: :routine, vcr: VCR_OPTS do
+  describe CreateOrUpdateSalesforceLead, type: :routine, vcr: VCR_OPTS do
 
     before(:all) do
       VCR.use_cassette('Newflow_CreateOrUpdateSalesforceLead/sf_setup', VCR_OPTS) do
diff --git a/spec/routines/search_application_users_spec.rb b/spec/routines/search_application_users_spec.rb
index f3f51ad859..bf005a0370 100644
--- a/spec/routines/search_application_users_spec.rb
+++ b/spec/routines/search_application_users_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SearchApplicationUsers do
+describe SearchApplicationUsers do
   let!(:application) { FactoryBot.create :doorkeeper_application }
 
   let!(:user_1)          do
diff --git a/spec/routines/search_users_spec.rb b/spec/routines/search_users_spec.rb
index 2677aa53be..11b3ffad83 100644
--- a/spec/routines/search_users_spec.rb
+++ b/spec/routines/search_users_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe SearchUsers, type: :routine do
+describe SearchUsers, type: :routine do
 
   let!(:user_1)          do
     FactoryBot.create :user_with_emails, first_name: 'John',
@@ -139,7 +139,7 @@
     outcome = described_class.call("id:#{user_3.id}").outputs.items.to_a
     expect(outcome).to eq [user_3]
   end
-  
+
   it 'should match by external_id' do
     outcome = described_class.call("external_id:#{user_4.external_ids.first.external_id}").outputs.items.to_a
     expect(outcome).to eq [user_4]
diff --git a/spec/routines/send_contact_info_confirmation_spec.rb b/spec/routines/send_contact_info_confirmation_spec.rb
index 7ed58fa7fe..ef7f54af3c 100644
--- a/spec/routines/send_contact_info_confirmation_spec.rb
+++ b/spec/routines/send_contact_info_confirmation_spec.rb
@@ -11,6 +11,9 @@
 
       result = SendContactInfoConfirmation.call(contact_info: email)
       expect(result.errors).not_to be_present
+
+      perform_enqueued_jobs
+
       refetched_email = EmailAddress.find(email.id)
       expect(refetched_email.confirmation_sent_at).to be_nil
     end
@@ -24,6 +27,9 @@
 
       result = SendContactInfoConfirmation.call(contact_info: email)
       expect(result.errors).not_to be_present
+
+      perform_enqueued_jobs
+
       refetched_email = EmailAddress.find(email.id)
 
       expect(refetched_email.confirmation_sent_at.utc).to eq(now.utc)
@@ -33,6 +39,7 @@
     it 'has a confirmation email with url that matches record' do
        expect do
          SendContactInfoConfirmation.call(contact_info: email)
+         perform_enqueued_jobs
        end.to change { ActionMailer::Base.deliveries.count }.by(1)
        delivery = ActionMailer::Base.deliveries.last
        expect(delivery.body.encoded).to include("confirm?code=#{email.confirmation_code}")
diff --git a/spec/routines/transfer_authentications_spec.rb b/spec/routines/transfer_authentications_spec.rb
index f09afb52a7..655a028813 100644
--- a/spec/routines/transfer_authentications_spec.rb
+++ b/spec/routines/transfer_authentications_spec.rb
@@ -3,8 +3,9 @@
 describe TransferAuthentications do
   let(:target_user) { FactoryBot.create :temp_user, username: 'target_user' }
   let(:other_user) { FactoryBot.create :temp_user, username: 'other_user'}
+  let(:other_user2) { FactoryBot.create :temp_user, username: 'other_user2'}
   let(:authentication) { FactoryBot.create :authentication, user: other_user, provider: 'google' }
-  let(:authentication2) { FactoryBot.create :authentication, user: nil, provider: 'facebook' }
+  let(:authentication2) { FactoryBot.create :authentication, user: other_user2, provider: 'facebook' }
 
   it 'transfers an authentication to the target user' do
     TransferAuthentications.call(authentication, target_user)
diff --git a/spec/routines/transfer_omniauth_data_spec.rb b/spec/routines/transfer_omniauth_data_spec.rb
index ce9b8fda8b..552d313b7a 100644
--- a/spec/routines/transfer_omniauth_data_spec.rb
+++ b/spec/routines/transfer_omniauth_data_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe TransferOmniauthData, type: :routine do
+describe TransferOmniauthData, type: :routine do
 
   let(:user)      { FactoryBot.build :user }
   let(:auth_data) { OmniauthData.new auth_hash }
diff --git a/spec/routines/transfer_pre_auth_state_spec.rb b/spec/routines/transfer_pre_auth_state_spec.rb
index 5865a006c9..6c063b4ef9 100644
--- a/spec/routines/transfer_pre_auth_state_spec.rb
+++ b/spec/routines/transfer_pre_auth_state_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe TransferPreAuthState, type: :routine do
+describe TransferPreAuthState, type: :routine do
 
   it 'works on the happy path' do
     user = FactoryBot.create :user
diff --git a/spec/routines/update_salesforce_assignable_fields_spec.rb b/spec/routines/update_salesforce_assignable_fields_spec.rb
index 45783177f4..cc195b0be5 100644
--- a/spec/routines/update_salesforce_assignable_fields_spec.rb
+++ b/spec/routines/update_salesforce_assignable_fields_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe UpdateSalesforceAssignableFields, type: :routine do
+describe UpdateSalesforceAssignableFields, type: :routine do
   let!(:non_assignable_student)    { FactoryBot.create :user }
 
   let!(:non_assignable_instructor) { FactoryBot.create :user, salesforce_contact_id: 'TESTCONTACT1' }
diff --git a/spec/routines/update_school_salesforce_info_spec.rb b/spec/routines/update_school_salesforce_info_spec.rb
index 0e1b6866fa..884930671d 100644
--- a/spec/routines/update_school_salesforce_info_spec.rb
+++ b/spec/routines/update_school_salesforce_info_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe UpdateSchoolSalesforceInfo, type: :routine do
+describe UpdateSchoolSalesforceInfo, type: :routine do
   let!(:school)                    { FactoryBot.build :school }
   let!(:deleted_school)            { FactoryBot.create :school }
   let!(:deleted_school_with_users) do
diff --git a/spec/routines/user_from_pre_auth_state_spec.rb b/spec/routines/user_from_pre_auth_state_spec.rb
index 552bd2fe97..4644956aa4 100644
--- a/spec/routines/user_from_pre_auth_state_spec.rb
+++ b/spec/routines/user_from_pre_auth_state_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe UserFromPreAuthState, type: :routine do
+describe UserFromPreAuthState, type: :routine do
 
   context 'an unsigned state' do
     let(:pre_auth_state) { FactoryBot.create :pre_auth_state }
diff --git a/spec/routing/contact_infos_routing_spec.rb b/spec/routing/contact_infos_routing_spec.rb
index d52471d845..1d639cf2bf 100644
--- a/spec/routing/contact_infos_routing_spec.rb
+++ b/spec/routing/contact_infos_routing_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ContactInfosController, :type => :routing do
+describe ContactInfosController, :type => :routing do
   describe "routing" do
 
     it "routes to #create" do
diff --git a/spec/routing/external_user_credentials_routing_spec.rb b/spec/routing/external_user_credentials_routing_spec.rb
index a2b56fc56d..f9b40760fd 100644
--- a/spec/routing/external_user_credentials_routing_spec.rb
+++ b/spec/routing/external_user_credentials_routing_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe ExternalUserCredentialsController, type: :routing do
+describe ExternalUserCredentialsController, type: :routing do
   it "routes to #new" do
     expect(get('/external_user_credentials/new')).to route_to('external_user_credentials#new')
   end
diff --git a/spec/routing/users_routing_spec.rb b/spec/routing/users_routing_spec.rb
index f5323df81a..025cb98d94 100644
--- a/spec/routing/users_routing_spec.rb
+++ b/spec/routing/users_routing_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe Legacy::UsersController, :type => :routing do
+describe Legacy::UsersController, :type => :routing do
   describe "routing" do
 
     it "routes to #edit" do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 3b1fb18fce..cc3c9d03d8 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -17,9 +17,13 @@
 #
 # See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
 RSpec.configure do |config|
-
   config.include I18nMacros
 
+  def database_cleaner_strategy
+    metadata = self.class.metadata
+    metadata[:js] || metadata[:truncation] ? :truncation : :transaction
+  end
+
   # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures
   config.fixture_path = "#{::Rails.root}/spec/fixtures"
 
@@ -48,11 +52,11 @@
 
   config.prepend_before(:suite) do
     DatabaseCleaner.clean_with(:truncation)
+    load('db/seeds.rb')
   end
 
   config.prepend_before(:all) do
-    metadata = self.class.metadata
-    DatabaseCleaner.strategy = metadata[:js] || metadata[:truncation] ? :truncation : :transaction
+    DatabaseCleaner.strategy = database_cleaner_strategy
     DatabaseCleaner.start
   end
 
@@ -61,10 +65,6 @@
     EmailDomainMxValidator.strategy = EmailDomainMxValidator::FakeStrategy.new
   end
 
-  config.before(:all) do
-    load('db/seeds.rb')
-  end
-
   config.before(:each) do
     # Get rid of possibly-shared config setting cache values between test and dev or any leftover
     # cached values from other test runs. This is 15 seconds faster than `Rails.cache.clear`
@@ -81,10 +81,12 @@
   #    runs after the after-test cleanup capybara/rspec installs."
   config.append_after(:each) do
     DatabaseCleaner.clean
+    load('db/seeds.rb') if database_cleaner_strategy == :truncation
   end
 
   config.append_after(:all) do
     DatabaseCleaner.clean
+    load('db/seeds.rb') if database_cleaner_strategy == :truncation
   end
 
   # These two settings work together to allow you to limit a spec run
@@ -167,6 +169,8 @@
     # `true` in RSpec 4.
     mocks.verify_partial_doubles = true
   end
+
+  config.full_backtrace = !!ENV["BACKTRACE"]
 end
 
 """
@@ -221,7 +225,7 @@
 include RSpec::Matchers::Composable
 
   match do |actual|
-    actual.errors.types.include? field and actual.errors.types[field].include? message
+    actual.errors.filter { |err| err.attribute == field }.any? { |err| err.type == message }
   end
 
   failure_message do |actual|
@@ -294,19 +298,7 @@ def error_msg model, *args
   end
 
   options[:message] = error
-  Lev::BetterActiveModelErrors.generate_message instance, field, :invalid, options
-end
-
-# From: https://github.com/rspec/rspec-rails/issues/925#issuecomment-164094792
-# See also: https://github.com/codeforamerica/ohana-api/blob/master/spec/api/cors_spec.rb
-#
-# Add support for testing `options` requests in RSpec.
-# See: https://github.com/rspec/rspec-rails/issues/925
-def options(*args)
-  reset! unless integration_session
-  integration_session.__send__(:process, :options, *args).tap do
-    copy_session_variables!
-  end
+  ActiveModel::Error.generate_message field, :invalid, instance, options
 end
 
 def in_travis?
diff --git a/spec/support/feature_helpers.rb b/spec/support/feature_helpers.rb
index 4bf0686a2f..bcd3f3d5b4 100644
--- a/spec/support/feature_helpers.rb
+++ b/spec/support/feature_helpers.rb
@@ -29,7 +29,7 @@ def create_user_with_plone_password
 
 def create_admin_user
   user = create_user 'admin'
-  user.update_attributes!(is_administrator: true)
+  user.update!(is_administrator: true)
   user
 end
 
diff --git a/spec/support/i18n.rb b/spec/support/i18n.rb
index ad72680c28..996aab2769 100644
--- a/spec/support/i18n.rb
+++ b/spec/support/i18n.rb
@@ -1,6 +1,6 @@
 module I18nMacros
-  def t key, *args
-      I18n.t key, *args
+  def t key, **options
+      I18n.t key, **options
   end
 end
 
diff --git a/spec/support/newflow_feature_helpers.rb b/spec/support/newflow_feature_helpers.rb
index 23ee8cfcd1..6110977241 100644
--- a/spec/support/newflow_feature_helpers.rb
+++ b/spec/support/newflow_feature_helpers.rb
@@ -17,8 +17,7 @@ def create_newflow_user(email, password='password', terms_agreed=nil, confirmati
   return user
 end
 
-def newflow_log_in_user(username_or_email, password)
-  visit(newflow_login_path) unless page.current_url == newflow_login_url
+def complete_newflow_log_in_screen(username_or_email, password = 'password')
   fill_in('login_form_email', with: username_or_email).native
   expect(page).to have_no_missing_translations
 
@@ -34,6 +33,11 @@ def newflow_log_in_user(username_or_email, password)
   expect(page).to have_no_missing_translations
 end
 
+def newflow_log_in_user(username_or_email, password = 'password')
+  visit(newflow_login_path) unless page.current_url == newflow_login_url
+  complete_newflow_log_in_screen(username_or_email, password)
+end
+
 def newflow_reauthenticate_user(email, password)
   wait_for_animations
   wait_for_ajax
@@ -56,7 +60,7 @@ def complete_student_signup_form(email: nil, password: nil, first_name: nil, las
 
 def newflow_complete_student_signup_with_whatever
   complete_student_signup_form(
-    email: Faker::Internet.free_email,
+    email: Faker::Internet.email,
     password: Faker::Internet.password(min_length: 8),
     first_name: Faker::Name.first_name,
     last_name: Faker::Name.last_name,
diff --git a/spec/whenever_spec.rb b/spec/whenever_spec.rb
index 82d4d40e03..85bcd1315f 100644
--- a/spec/whenever_spec.rb
+++ b/spec/whenever_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe 'whenever schedule' do
+describe 'whenever schedule' do
   let(:schedule) { Whenever::Test::Schedule.new(file: 'config/schedule.rb') }
 
   context 'basics' do