* fix(server): Allow passwordless users when oauth enabled * fix(web): Use features flags for checking oauth