diff --git a/client/coral-admin/src/actions/auth.js b/client/coral-admin/src/actions/auth.js
index 332d756c0..6892080cd 100644
--- a/client/coral-admin/src/actions/auth.js
+++ b/client/coral-admin/src/actions/auth.js
@@ -33,6 +33,7 @@ export const handleLogin = (email, password, recaptchaResponse) => (
       if (!user) {
         if (!bowser.safari && !bowser.ios && storage) {
           storage.removeItem('token');
+          storage.removeItem('exp');
         }
         return dispatch(checkLoginFailure('not logged in'));
       }
@@ -128,6 +129,7 @@ export const checkLogin = () => (dispatch, _, { rest, client, storage }) => {
       if (!user) {
         if (!bowser.safari && !bowser.ios && storage) {
           storage.removeItem('token');
+          storage.removeItem('exp');
         }
         return dispatch(checkLoginFailure('not logged in'));
       }
@@ -152,6 +154,7 @@ export const logout = () => (dispatch, _, { rest, client, storage }) => {
   return rest('/auth', { method: 'DELETE' }).then(() => {
     if (storage) {
       storage.removeItem('token');
+      storage.removeItem('exp');
     }
 
     // Reset the websocket.
diff --git a/client/coral-admin/src/components/Drawer.js b/client/coral-admin/src/components/Drawer.js
index 60973e8c2..0d59d3bbe 100644
--- a/client/coral-admin/src/components/Drawer.js
+++ b/client/coral-admin/src/components/Drawer.js
@@ -44,7 +44,7 @@ const CoralDrawer = ({ handleLogout, auth = {} }) => (
               {t('configure.configure')}
             </Link>
           )}
-          <a onClick={handleLogout}>Sign Out</a>
+          <a onClick={handleLogout}>{t('configure.sign_out')}</a>
           <span>{`v${process.env.VERSION}`}</span>
         </Navigation>
       </div>
diff --git a/client/coral-admin/src/routes/Moderation/components/ModerationQueue.js b/client/coral-admin/src/routes/Moderation/components/ModerationQueue.js
index ce957b82d..0e7cbe347 100644
--- a/client/coral-admin/src/routes/Moderation/components/ModerationQueue.js
+++ b/client/coral-admin/src/routes/Moderation/components/ModerationQueue.js
@@ -397,6 +397,13 @@ class ModerationQueue extends React.Component {
       const index = comments.findIndex(
         comment => comment.id === selectedCommentId
       );
+
+      // This can happen temporarily when we call redux to change the selected comment
+      // but it didn't fully take effect yet.
+      if (index === -1) {
+        return null;
+      }
+
       const comment = comments[index];
       return (
         <div className={styles.root}>
@@ -414,7 +421,7 @@ class ModerationQueue extends React.Component {
             dangling={
               !this.props.commentBelongToQueue(this.props.activeTab, comment)
             }
-          />;
+          />
         </div>
       );
     }
diff --git a/client/coral-admin/src/routes/Stories/components/Stories.css b/client/coral-admin/src/routes/Stories/components/Stories.css
index e8e2b8474..63a05ab6a 100644
--- a/client/coral-admin/src/routes/Stories/components/Stories.css
+++ b/client/coral-admin/src/routes/Stories/components/Stories.css
@@ -56,6 +56,7 @@
   width: 100%;
   border-left: none;
   border-right: none;
+  white-space: pre-wrap;
 
   a {
     color: rgb(44, 44, 44);
diff --git a/client/coral-embed-stream/src/actions/auth.js b/client/coral-embed-stream/src/actions/auth.js
index e74265026..4406c744c 100644
--- a/client/coral-embed-stream/src/actions/auth.js
+++ b/client/coral-embed-stream/src/actions/auth.js
@@ -266,6 +266,7 @@ export const logout = () => async (
 
   if (storage) {
     storage.removeItem('token');
+    storage.removeItem('exp');
   }
 
   // Reset the websocket.
@@ -304,6 +305,7 @@ export const checkLogin = () => (
       if (!result.user) {
         if (storage) {
           storage.removeItem('token');
+          storage.removeItem('exp');
         }
         throw ErrNotLoggedIn;
       }
@@ -329,6 +331,7 @@ export const checkLogin = () => (
       if (error.status && error.status === 401 && storage) {
         // Unauthorized.
         storage.removeItem('token');
+        storage.removeItem('exp');
       }
       const errorMessage = error.translation_key
         ? t(`error.${error.translation_key}`)
diff --git a/client/coral-embed-stream/src/components/Embed.js b/client/coral-embed-stream/src/components/Embed.js
index 980e5745e..0fd257ef2 100644
--- a/client/coral-embed-stream/src/components/Embed.js
+++ b/client/coral-embed-stream/src/components/Embed.js
@@ -43,7 +43,7 @@ export default class Embed extends React.Component {
         {t('framework.my_profile')}
       </Tab>,
     ];
-    if (can(user, 'UPDATE_CONFIG')) {
+    if (can(user, 'UPDATE_ASSET_CONFIG')) {
       tabs.push(
         <Tab
           key="config"
diff --git a/client/coral-embed-stream/src/tabs/stream/components/FlagButton.js b/client/coral-embed-stream/src/tabs/stream/components/FlagButton.js
index bc673ba28..002297415 100644
--- a/client/coral-embed-stream/src/tabs/stream/components/FlagButton.js
+++ b/client/coral-embed-stream/src/tabs/stream/components/FlagButton.js
@@ -8,6 +8,7 @@ import ClickOutside from 'coral-framework/components/ClickOutside';
 import cn from 'classnames';
 import styles from './FlagButton.css';
 import * as REASONS from 'coral-framework/graphql/flagReasons';
+import PropTypes from 'prop-types';
 
 import { getErrorMessages, forEachError } from 'coral-framework/utils';
 
@@ -77,9 +78,10 @@ export default class FlagButton extends Component {
           return;
         }
         break;
-      case this.props.getPopupMenu.length:
-        this.closeMenu();
-        return;
+      case 2:
+        return this.closeMenu();
+      default:
+        throw new Error(`Unexpected step ${step}`);
     }
 
     // If itemType and reason are both set, post the action
@@ -92,6 +94,8 @@ export default class FlagButton extends Component {
         case 'USERS':
           item_id = author_id;
           break;
+        default:
+          throw new Error(`Unexpected itemType ${itemType}`);
       }
 
       let action = {
@@ -272,3 +276,12 @@ export default class FlagButton extends Component {
     );
   }
 }
+
+FlagButton.propTypes = {
+  currentUser: PropTypes.object,
+  showSignInDialog: PropTypes.func,
+  notify: PropTypes.func,
+  getPopupMenu: PropTypes.array,
+  flaggedByCurrentUser: PropTypes.bool,
+  banned: PropTypes.bool,
+};
diff --git a/client/coral-framework/services/perms.js b/client/coral-framework/services/perms.js
index 9d588c5e2..3250d40a2 100644
--- a/client/coral-framework/services/perms.js
+++ b/client/coral-framework/services/perms.js
@@ -33,6 +33,7 @@ const basicRoles = {
 };
 
 const queryRoles = {
+  UPDATE_ASSET_CONFIG: [ADMIN, MODERATOR],
   UPDATE_CONFIG: [ADMIN],
   ACCESS_ADMIN: [ADMIN, MODERATOR],
   VIEW_USER_EMAILS: [ADMIN],
diff --git a/package.json b/package.json
index 6a3b1b447..1c801db93 100644
--- a/package.json
+++ b/package.json
@@ -218,7 +218,7 @@
     "yaml-lint": "^1.0.0"
   },
   "engines": {
-    "node": "^8"
+    "node": ">=8"
   },
   "pre-commit": {
     "silent": false,
diff --git a/plugins/talk-plugin-auth/client/components/SignInContainer.js b/plugins/talk-plugin-auth/client/components/SignInContainer.js
index a4dec87e5..6f99f9ce6 100644
--- a/plugins/talk-plugin-auth/client/components/SignInContainer.js
+++ b/plugins/talk-plugin-auth/client/components/SignInContainer.js
@@ -38,8 +38,7 @@ class SignInContainer extends React.Component {
   }
 
   componentDidMount() {
-    window.addEventListener('storage', this.handleAuth);
-
+    this.listenToStorageChanges();
     const { formData } = this.state;
     const errors = Object.keys(formData).reduce((map, prop) => {
       map[prop] = t('sign_in.required_field');
@@ -49,6 +48,14 @@ class SignInContainer extends React.Component {
   }
 
   componentWillUnmount() {
+    this.unlisten();
+  }
+
+  listenToStorageChanges() {
+    window.addEventListener('storage', this.handleAuth);
+  }
+
+  unlisten() {
     window.removeEventListener('storage', this.handleAuth);
   }
 
@@ -60,6 +67,8 @@ class SignInContainer extends React.Component {
     if (e.key === 'auth') {
       const { err, data } = JSON.parse(e.newValue);
       authCallback(err, data);
+      this.unlisten();
+      localStorage.removeItem('auth');
     }
   };
 
diff --git a/services/users.js b/services/users.js
index cfbbaf822..3b7d3b180 100644
--- a/services/users.js
+++ b/services/users.js
@@ -13,7 +13,7 @@ const debug = require('debug')('talk:services:users');
 const UserModel = require('../models/user');
 
 const RECAPTCHA_WINDOW = '10m'; // 10 minutes.
-const RECAPTCHA_INCORRECT_TRIGGER = 5; // after 3 incorrect attempts, recaptcha will be required.
+const RECAPTCHA_INCORRECT_TRIGGER = 5; // after 5 incorrect attempts, recaptcha will be required.
 
 const ActionsService = require('./actions');
 const mailer = require('./mailer');
diff --git a/views/admin/confirm-email.ejs b/views/admin/confirm-email.ejs
index f8f6c62f2..8c0d85e01 100644
--- a/views/admin/confirm-email.ejs
+++ b/views/admin/confirm-email.ejs
@@ -6,7 +6,7 @@
     <title>Email Verification</title>
     <link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
     <link rel="stylesheet" href="https://code.getmdl.io/1.2.1/material.indigo-pink.min.css">
-    <link rel="stylesheet" href="/public/css/admin.css">
+    <link rel="stylesheet" href="<%= BASE_PATH %>public/css/admin.css">
     <%_ if (locals.customCssUrl) { _%>
     <link href="<%= customCssUrl %>" rel="stylesheet" type="text/css">
     <%_ } _%>
diff --git a/views/admin/password-reset.ejs b/views/admin/password-reset.ejs
index c5bb4ef90..ae06b5179 100644
--- a/views/admin/password-reset.ejs
+++ b/views/admin/password-reset.ejs
@@ -6,7 +6,7 @@
     <title>Password Reset</title>
     <link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
     <link rel="stylesheet" href="https://code.getmdl.io/1.2.1/material.indigo-pink.min.css">
-    <link rel="stylesheet" href="/public/css/admin.css">
+    <link rel="stylesheet" href="<%= BASE_PATH %>public/css/admin.css">
     <%_ if (locals.customCssUrl) { _%>
     <link href="<%= customCssUrl %>" rel="stylesheet" type="text/css">
     <%_ } _%>