diff --git a/bin/cli-plugins b/bin/cli-plugins
index 942036d29..1de1c97d4 100755
--- a/bin/cli-plugins
+++ b/bin/cli-plugins
@@ -274,7 +274,7 @@ async function reconcilePluginDeps({skipLocal, skipRemote, dryRun, upgradeRemote
 }
 
 async function createSeedPlugin() {
-  const pluginsDir = path.join(__dirname, 'plugins');
+  const pluginsDir = path.resolve(__dirname, '..', 'plugins');
 
   function pluginNameExists(pluginName) {
     const pluginNames = fs.readdirSync(pluginsDir);
@@ -321,7 +321,7 @@ async function createSeedPlugin() {
   // Creating plugin seed
   //==============================================================================
 
-  const seedPlugin = path.join(__dirname, 'bin/templates/plugin');
+  const seedPlugin = path.join(__dirname, 'templates/plugin');
   const newPluginPath = path.join(pluginsDir, answers.pluginName);
 
   if (fs.existsSync(seedPlugin)) {
@@ -355,7 +355,7 @@ async function createSeedPlugin() {
 
     // Let's add this to the plugins.json
     if (answers.addPluginsJson) {
-      const pluginsJson = path.join(dir, 'plugins.json');
+      const pluginsJson = path.resolve(__dirname, '..', 'plugins.json');
 
       fs.readJson(pluginsJson)
         .then((j) => {
diff --git a/config.js b/config.js
index e3dd4578c..703be06be 100644
--- a/config.js
+++ b/config.js
@@ -34,6 +34,9 @@ const CONFIG = {
   // JWT_EXPIRY is the time for which a given token is valid for.
   JWT_EXPIRY: process.env.TALK_JWT_EXPIRY || '1 day',
 
+  // JWT_ALG is the algorithm used for signing jwt tokens.
+  JWT_ALG: process.env.TALK_JWT_ALG || 'HS256',
+
   //------------------------------------------------------------------------------
   // Installation locks
   //------------------------------------------------------------------------------
diff --git a/package.json b/package.json
index e8a9159c2..4ef09cb07 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "talk",
-  "version": "2.5.0",
+  "version": "3.0.0",
   "description": "A better commenting experience from Mozilla, The New York Times, and the Washington Post. https://coralproject.net",
   "main": "app.js",
   "scripts": {
diff --git a/services/passport.js b/services/passport.js
index 8396cc581..7a178039a 100644
--- a/services/passport.js
+++ b/services/passport.js
@@ -21,6 +21,7 @@ const {
   JWT_ISSUER,
   JWT_EXPIRY,
   JWT_AUDIENCE,
+  JWT_ALG,
   RECAPTCHA_SECRET,
   RECAPTCHA_ENABLED
 } = require('../config');
@@ -219,6 +220,7 @@ passport.use(new JwtStrategy({
   // Prepare the extractor from the header.
   jwtFromRequest: ExtractJwt.fromExtractors([
     cookieExtractor,
+    ExtractJwt.fromUrlQueryParameter('access_token'),
     ExtractJwt.fromAuthHeaderWithScheme('Bearer')
   ]),
 
@@ -233,7 +235,7 @@ passport.use(new JwtStrategy({
   audience: JWT_AUDIENCE,
 
   // Enable only the HS256 algorithm.
-  algorithms: ['HS256'],
+  algorithms: [JWT_ALG],
 
   // Pass the request object back to the callback so we can attach the JWT to
   // it.