diff --git a/Gemfile.lock b/Gemfile.lock
index 585e60a0701..2f12dc1957e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -43,7 +43,7 @@ GIT
 
 GIT
   remote: https://github.com/18F/saml_idp.git
-  revision: 95366bbb24088660eadc54ba49f56399cf8b17b4
+  revision: 8d0bedcd71b025617c0ab094bbc6a7982d9df1cd
   branch: master
   specs:
     saml_idp (0.9.0.pre.18f)
diff --git a/README.md b/README.md
index 96578b51b31..b4d183cf543 100644
--- a/README.md
+++ b/README.md
@@ -281,40 +281,6 @@ $ RAILS_ASSET_HOST=localhost:3000 FEDERALIST_PATH=/site/user/repository rake spe
 
 This will output your site to `public/site/user/repository` for quick publishing to [Federalist](https://federalist-docs.18f.gov/pages/using-federalist/). To test compatibility, run `simplehttpserver` from the app's `public` folder and visit `http://localhost:8000/<FEDERALIST PATH>/user_flows` in your browser.
 
-### Load testing
-
-We provide some [Locust.io] Python scripts you can run to test how the
-app responds to load. You'll need to have Python and `pyenv-virtualenvwrapper`
-installed on your machine. If you're on a Mac, the easiest way to set up Python
-and `pyenv-virtualenvwrapper` is to run the [laptop script].
-
-Next, you'll need to set the following values in your local `application.yml`:
-
-```
-disable_email_sending: 'true'
-enable_load_testing_mode: 'true'
-telephony_adapter: 'test'
-```
-
-Then, run the app with `make run`, and in a new Terminal tab or window, run:
-```
-make load_test type=create_account
-```
-This will simulate 3 concurrent users going through the entire account creation
-flow and then signing out. To change the number of concurrent users, number of
-requests, and the rate at which users are created, modify the `-c`,
-`-n`, and `-r` Locust parameters in `bin/load_test`. Run `locust --help` for
-more details.
-
-By default, the test will target the host running at `http://localhost:3000`.
-To change the target host, set the `TARGET_HOST` environment variable.
-For example:
-
-```
-TARGET_HOST=https://awesome.loadtesting.com make load_test type=create_account
-```
-
-[Locust.io]: http://locust.io/
 [laptop script]: https://github.com/18F/laptop
 
 ### Proofing vendors
diff --git a/app/assets/images/icon-dot-gov.svg b/app/assets/images/icon-dot-gov.svg
new file mode 100644
index 00000000000..3bf0478940c
--- /dev/null
+++ b/app/assets/images/icon-dot-gov.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64"><title>icon-dot-gov</title><path fill="#2378C3" fill-rule="evenodd" d="M32 0c17.673 0 32 14.327 32 32 0 17.673-14.327 32-32 32C14.327 64 0 49.673 0 32 0 14.327 14.327 0 32 0zm0 1.208C14.994 1.208 1.208 14.994 1.208 32S14.994 62.792 32 62.792 62.792 49.006 62.792 32 49.006 1.208 32 1.208zm10.59 38.858a.857.857 0 0 1 .882.822v1.642H18.886v-1.642a.857.857 0 0 1 .882-.822H42.59zM25.443 27.774v9.829h1.642v-9.83h3.273v9.83H32v-9.83h3.272v9.83h1.643v-9.83h3.272v9.83h.76a.857.857 0 0 1 .882.821v.821h-21.3v-.809a.857.857 0 0 1 .88-.82h.762v-9.842h3.272zm5.736-8.188l12.293 4.915v1.642h-1.63a.857.857 0 0 1-.882.822H21.41a.857.857 0 0 1-.882-.822h-1.642v-1.642l12.293-4.915z"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/icon-https.svg b/app/assets/images/icon-https.svg
new file mode 100644
index 00000000000..5c3285ef250
--- /dev/null
+++ b/app/assets/images/icon-https.svg
@@ -0,0 +1 @@
+<svg data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 54 54"><path d="M34.72 34.84a1.29 1.29 0 01-1.29 1.29H20.57a1.29 1.29 0 01-1.29-1.29v-7.72a1.29 1.29 0 011.29-1.29H21v-2.57a6 6 0 0112 0v2.57h.43a1.29 1.29 0 011.29 1.29v7.72zm-4.29-9v-2.58a3.43 3.43 0 00-6.86 0v2.57h6.86z" fill="#719f2a"/><circle cx="27" cy="27.12" r="26" fill="none" stroke="#538200" stroke-miterlimit="10"/></svg>
\ No newline at end of file
diff --git a/app/assets/stylesheets/components/_banner.scss b/app/assets/stylesheets/components/_banner.scss
new file mode 100644
index 00000000000..8b0b2f788bf
--- /dev/null
+++ b/app/assets/stylesheets/components/_banner.scss
@@ -0,0 +1,4 @@
+.site .site-wrap .usa-banner {
+  background-color: #fff;
+  box-shadow: inset 0 -1px 0 0 #ccc;
+}
diff --git a/app/assets/stylesheets/components/_util.scss b/app/assets/stylesheets/components/_util.scss
index 91de110b9d5..40e95b730eb 100644
--- a/app/assets/stylesheets/components/_util.scss
+++ b/app/assets/stylesheets/components/_util.scss
@@ -89,3 +89,7 @@
 .flex-center {
   justify-content: center;
 }
+
+.flex-no-shrink {
+  flex-shrink: 0;
+}
diff --git a/app/assets/stylesheets/components/all.scss b/app/assets/stylesheets/components/all.scss
index d0b9c2d20a2..b48cc811857 100644
--- a/app/assets/stylesheets/components/all.scss
+++ b/app/assets/stylesheets/components/all.scss
@@ -2,6 +2,7 @@
 @import 'abbr';
 @import 'alert';
 @import 'background';
+@import 'banner';
 @import 'border';
 @import 'btn';
 @import 'card';
diff --git a/app/controllers/acuant_sdk_controller.rb b/app/controllers/acuant_sdk_controller.rb
index 45df1aac64f..2ec373451cb 100644
--- a/app/controllers/acuant_sdk_controller.rb
+++ b/app/controllers/acuant_sdk_controller.rb
@@ -10,7 +10,7 @@ class AcuantSdkController < ApplicationController
 
   def show
     # Only render files on an allowlist to prevent path traversal issues
-    render plain: 'Not found', status: :not_found unless requested_asset_permitted?
+    return render(plain: 'Not found', status: :not_found) unless requested_asset_permitted?
 
     SecureHeaders.append_content_security_policy_directives(
       request,
diff --git a/app/controllers/idv/doc_auth_controller.rb b/app/controllers/idv/doc_auth_controller.rb
index 1d1cec938cc..58a20d05133 100644
--- a/app/controllers/idv/doc_auth_controller.rb
+++ b/app/controllers/idv/doc_auth_controller.rb
@@ -53,7 +53,7 @@ def flow_session
     end
 
     def add_unsafe_eval_to_capture_steps
-      capture_steps = %w[front_image back_image mobile_front_image mobile_back_image]
+      capture_steps = %w[front_image back_image mobile_front_image mobile_back_image selfie]
       return unless capture_steps.include?(params[:step])
 
       # required to run wasm until wasm-eval is available
diff --git a/app/controllers/idv/scan_id_acuant_controller.rb b/app/controllers/idv/scan_id_acuant_controller.rb
index a5791ee7741..3f5526c3eff 100644
--- a/app/controllers/idv/scan_id_acuant_controller.rb
+++ b/app/controllers/idv/scan_id_acuant_controller.rb
@@ -40,7 +40,7 @@ def field_image
     end
 
     def liveness
-      is_live, is_face_match = ::Acuant::Liveness.
+      is_live, is_face_match = ::Acuant::LivenessPassThrough.
                                new(scan_id_session[:instance_id]).call(request.body.read)
       scan_id_session[:liveness_pass] = is_live
       scan_id_session[:facematch_pass] = is_face_match
diff --git a/app/controllers/users/delete_controller.rb b/app/controllers/users/delete_controller.rb
index 5559dfbf982..5daaabe5042 100644
--- a/app/controllers/users/delete_controller.rb
+++ b/app/controllers/users/delete_controller.rb
@@ -1,19 +1,39 @@
 module Users
-  class DeleteController < ReauthnRequiredController
+  class DeleteController < ApplicationController
     before_action :confirm_two_factor_authenticated
+    before_action :confirm_current_password, only: [:delete]
 
-    def show; end
+    def show
+      analytics.track_event(Analytics::ACCOUNT_DELETE_VISITED)
+    end
 
     def delete
       send_push_notifications
       current_user.destroy!
       sign_out
       flash[:success] = t('devise.registrations.destroyed')
+      analytics.track_event(Analytics::ACCOUNT_DELETE_SUBMITTED, success: true)
       redirect_to root_url
     end
 
     private
 
+    def confirm_current_password
+      return if valid_password?
+
+      flash[:error] = t('idv.errors.incorrect_password')
+      analytics.track_event(Analytics::ACCOUNT_DELETE_SUBMITTED, success: false)
+      render :show
+    end
+
+    def valid_password?
+      current_user.valid_password?(password)
+    end
+
+    def password
+      params.fetch(:user, {})[:password].presence
+    end
+
     def send_push_notifications
       return if Figaro.env.push_notifications_enabled != 'true'
       PushNotification::AccountDelete.new.call(current_user.id)
diff --git a/app/controllers/users/two_factor_authentication_controller.rb b/app/controllers/users/two_factor_authentication_controller.rb
index 0f0425916a5..51c4b91efb7 100644
--- a/app/controllers/users/two_factor_authentication_controller.rb
+++ b/app/controllers/users/two_factor_authentication_controller.rb
@@ -191,7 +191,9 @@ def phone_to_deliver_to
     end
 
     def otp_rate_limiter
-      @_otp_rate_limited ||= OtpRateLimiter.new(phone: phone_to_deliver_to, user: current_user)
+      @_otp_rate_limited ||= OtpRateLimiter.new(phone: phone_to_deliver_to,
+                                                user: current_user,
+                                                phone_confirmed: authentication_context?)
     end
 
     def redirect_on_nothing_enabled
diff --git a/app/javascript/app/acuant/document_capture_dom.js b/app/javascript/app/acuant/document_capture_dom.js
index 876b823d91b..db34f0791fd 100644
--- a/app/javascript/app/acuant/document_capture_dom.js
+++ b/app/javascript/app/acuant/document_capture_dom.js
@@ -33,7 +33,7 @@ const showFallbackForm = () => {
   fallbackImageForm().classList.remove('hidden');
 };
 
-const showAcuantSdkContainer = (container) => {
+export const showAcuantSdkContainer = (container) => {
   if (documentCaptureFallbackModeEnabled()) return;
 
   hideAcuantSdkContainers();
diff --git a/app/javascript/app/acuant/selfie_capture.js b/app/javascript/app/acuant/selfie_capture.js
new file mode 100644
index 00000000000..814e8249bb6
--- /dev/null
+++ b/app/javascript/app/acuant/selfie_capture.js
@@ -0,0 +1,50 @@
+import { acuantSdkPreviewImage, imageDataUrlInput, imageFileInput, showAcuantSdkContainer }
+  from './document_capture_dom';
+
+const {
+  fetchSdkInitializationCredentials,
+  fetchSdkInitializationEndpoint,
+  acuantSdkInitializationStarted,
+  acuantSdkInitializeSuccess,
+  acuantSdkInitializeFailed,
+  addClickEventListenerToAcuantCaptureButton,
+} = require('./document_capture_dom');
+
+export const onCaptured = (image) => {
+  acuantSdkPreviewImage().src = `data:image/jpeg;base64,${image}`;
+  imageDataUrlInput().value = `data:image/jpeg;base64,${image}`;
+  imageFileInput().required = false;
+  showAcuantSdkContainer('continue-form');
+};
+
+export const imageCaptureButtonClicked = (event) => {
+  event.preventDefault();
+  window.AcuantPassiveLiveness.startSelfieCapture(onCaptured.bind(this));
+};
+
+export const initializeAcuantSdk = (credentials = null, endpoint = null) => {
+  credentials = credentials || fetchSdkInitializationCredentials();
+  endpoint = endpoint || fetchSdkInitializationEndpoint();
+  window.AcuantJavascriptWebSdk.initialize(
+    credentials,
+    endpoint,
+    {
+      onSuccess: () => {
+        addClickEventListenerToAcuantCaptureButton(imageCaptureButtonClicked);
+        acuantSdkInitializeSuccess();
+      },
+      onFail: acuantSdkInitializeFailed,
+    },
+  );
+};
+
+export const loadAndInitializeAcuantSdk = () => {
+  acuantSdkInitializationStarted();
+  window.onAcuantSdkLoaded = initializeAcuantSdk;
+
+  const sdk = document.createElement('script');
+  sdk.src = 'AcuantJavascriptWebSdk.min.js';
+  sdk.async = true;
+
+  document.body.appendChild(sdk);
+};
diff --git a/app/javascript/app/utils/index.js b/app/javascript/app/utils/index.js
index 3eaf9f7dc9c..fad383b6ae9 100644
--- a/app/javascript/app/utils/index.js
+++ b/app/javascript/app/utils/index.js
@@ -1,6 +1,7 @@
 import autoLogout from './auto-logout';
 import countdownTimer from './countdown-timer';
 import msFormatter from './ms-formatter';
+import enableBannerToggling from './toggle-banner';
 
 window.LoginGov = (window.LoginGov || {});
 const LoginGov = window.LoginGov;
@@ -11,3 +12,5 @@ documentElement.className = documentElement.className.replace(/no-js/, '');
 LoginGov.autoLogout = autoLogout;
 LoginGov.countdownTimer = countdownTimer;
 LoginGov.msFormatter = msFormatter;
+
+enableBannerToggling();
diff --git a/app/javascript/app/utils/toggle-banner.js b/app/javascript/app/utils/toggle-banner.js
new file mode 100644
index 00000000000..4443243ddbb
--- /dev/null
+++ b/app/javascript/app/utils/toggle-banner.js
@@ -0,0 +1,18 @@
+export default function toggleBanner() {
+  const enableBannerToggling = () => {
+    const bannerButton = document.querySelector('.usa-banner__button');
+
+    const toggleBannerSection = (evt) => {
+      evt.currentTarget.setAttribute(
+        'aria-expanded',
+        evt.currentTarget.getAttribute('aria-expanded') === 'true' ? 'false' : 'true',
+      );
+      const howYouKnowSection = document.querySelector('#gov-banner');
+      if (howYouKnowSection) howYouKnowSection.classList.toggle('hide');
+    };
+
+    if (bannerButton) bannerButton.addEventListener('click', toggleBannerSection);
+  };
+
+  window.onload = enableBannerToggling;
+}
diff --git a/app/javascript/packs/acuant_selfie_capture.js b/app/javascript/packs/acuant_selfie_capture.js
new file mode 100644
index 00000000000..e2754042381
--- /dev/null
+++ b/app/javascript/packs/acuant_selfie_capture.js
@@ -0,0 +1,7 @@
+import { loadAndInitializeAcuantSdk } from '../app/acuant/selfie_capture';
+import { setDocumentCaptureFallbackTimeout } from '../app/acuant/document_capture_fallback';
+
+document.addEventListener('DOMContentLoaded', () => {
+  loadAndInitializeAcuantSdk();
+  setDocumentCaptureFallbackTimeout();
+});
diff --git a/app/javascript/packs/email-validation.js b/app/javascript/packs/email-validation.js
index 531d433974d..2423f6fac88 100644
--- a/app/javascript/packs/email-validation.js
+++ b/app/javascript/packs/email-validation.js
@@ -5,6 +5,16 @@ function emailValidation() {
   const email = document.querySelector('input[type="email"]');
   let blurTimer;
 
+  function hideElem(elem) {
+    elem.classList.add('hide');
+    elem.hidden = true;
+  }
+
+  function showElem(elem) {
+    elem.classList.remove('hide');
+    elem.hidden = false;
+  }
+
   // remove focus from the email input after error is displayed
   function blurEmailInput(input) {
     blurTimer = setTimeout(function () {
@@ -14,15 +24,15 @@ function emailValidation() {
 
   function resetEmailInvalid(input) {
     input.classList.remove('usa-input--error');
-    alert.classList.add('hide');
-    alertInline.classList.add('hide');
+    hideElem(alert);
+    hideElem(alertInline);
     clearTimeout(blurTimer);
   }
 
   function displayEmailInvalid(input) {
     input.classList.add('usa-input--error');
-    alert.classList.remove('hide');
-    alertInline.classList.remove('hide');
+    showElem(alert);
+    showElem(alertInline);
     blurEmailInput(input);
   }
 
diff --git a/app/javascript/packs/webauthn-unhide-signup.js b/app/javascript/packs/webauthn-unhide-signup.js
index c542d3e2288..af6f41db952 100644
--- a/app/javascript/packs/webauthn-unhide-signup.js
+++ b/app/javascript/packs/webauthn-unhide-signup.js
@@ -4,6 +4,7 @@ function unhideWebauthn() {
   if (WebAuthn.isWebAuthnEnabled()) {
     const elem = document.querySelector('label[for=two_factor_options_form_selection_webauthn]');
     if (elem) {
+      elem.hidden = false;
       elem.classList.remove('hide');
     }
   }
diff --git a/app/models/otp_requests_tracker.rb b/app/models/otp_requests_tracker.rb
index 166f67c5304..98f68709184 100644
--- a/app/models/otp_requests_tracker.rb
+++ b/app/models/otp_requests_tracker.rb
@@ -1,10 +1,9 @@
 class OtpRequestsTracker < ApplicationRecord
-  def self.find_or_create_with_phone(phone)
-    tries ||= 1
-    phone ||= phone.strip
-    phone_fingerprint ||= Pii::Fingerprinter.fingerprint(phone)
+  def self.find_or_create_with_phone_and_confirmed(phone, phone_confirmed)
+    tries = 1
+    phone_fingerprint = Pii::Fingerprinter.fingerprint(phone.strip)
 
-    where(phone_fingerprint: phone_fingerprint).
+    where(phone_fingerprint: phone_fingerprint, phone_confirmed: phone_confirmed).
       first_or_create(otp_send_count: 0, otp_last_sent_at: Time.zone.now)
   rescue ActiveRecord::RecordNotUnique
     retry unless (tries -= 1).zero?
diff --git a/app/services/acuant/liveness.rb b/app/services/acuant/liveness.rb
index 40626cdd338..eb09cb9848c 100644
--- a/app/services/acuant/liveness.rb
+++ b/app/services/acuant/liveness.rb
@@ -1,22 +1,31 @@
 module Acuant
   class Liveness < AcuantBase
-    def call(liveness_body)
-      live_face_image = process_selfie(liveness_body)
-      return unless live_face_image
+    # @return [Array(Boolean, Hash)] a tuple of (overall success, error hash)
+    def call(selfie)
+      base64_selfie = Base64.strict_encode64(selfie)
+      return failure unless selfie_live?(base64_selfie)
 
       face_image_from_document = fetch_face_from_document
-      return [true, false] unless face_image_from_document
+      return failure unless face_image_from_document
 
-      [true, check_face_match(face_image_from_document, live_face_image)]
+      selfie_face_matches_document?(face_image_from_document, base64_selfie) ? success : failure
     end
 
     private
 
-    def process_selfie(liveness_body)
-      liveness_data = wrap_network_errors { liveness_service.liveness(liveness_body) }
-      return unless liveness_data
-      return unless selfie_live?(liveness_data)
-      JSON.parse(liveness_body)['Image']
+    attr_accessor :results
+
+    def failure
+      [false, results]
+    end
+
+    def success
+      [true, {}]
+    end
+
+    def selfie_live?(image)
+      @results = wrap_network_errors { liveness_service.liveness(image) }
+      liveness_result_returns_live?
     end
 
     def fetch_face_from_document
@@ -25,18 +34,17 @@ def fetch_face_from_document
       Base64.strict_encode64(data)
     end
 
-    def check_face_match(image1, image2)
-      data = wrap_network_errors { facematch_service.facematch(facematch_body(image1, image2)) }
-      return unless data
-      facematch_pass?(data)
+    def selfie_face_matches_document?(img1, img2)
+      @results = wrap_network_errors { facematch_service.facematch(facematch_body(img1, img2)) }
+      facematch_pass?
     end
 
-    def facematch_pass?(data)
-      data['IsMatch']
+    def facematch_pass?
+      results&.dig('IsMatch')
     end
 
-    def selfie_live?(data)
-      data['LivenessResult']['LivenessAssessment'] == 'Live'
+    def liveness_result_returns_live?
+      results&.dig('LivenessResult', 'LivenessAssessment') == 'Live'
     end
 
     def facematch_body(image1, image2)
@@ -48,11 +56,15 @@ def facematch_body(image1, image2)
     end
 
     def liveness_service
-      (Rails.env.test? ? Idv::Acuant::FakeAssureId : Idv::Acuant::Liveness).new
+      (simulator_or_env_test? ? Idv::Acuant::FakeLiveness : Idv::Acuant::Liveness).new
     end
 
     def facematch_service
-      (Rails.env.test? ? Idv::Acuant::FakeAssureId : Idv::Acuant::FacialMatch).new
+      (simulator_or_env_test? ? Idv::Acuant::FakeAssureId : Idv::Acuant::FacialMatch).new
+    end
+
+    def simulator_or_env_test?
+      Rails.env.test? || Figaro.env.acuant_simulator == 'true'
     end
   end
 end
diff --git a/app/services/acuant/liveness_pass_through.rb b/app/services/acuant/liveness_pass_through.rb
new file mode 100644
index 00000000000..e5ceb4c64be
--- /dev/null
+++ b/app/services/acuant/liveness_pass_through.rb
@@ -0,0 +1,62 @@
+module Acuant
+  class LivenessPassThrough < AcuantBase
+    def call(liveness_body)
+      live_face_image = process_selfie(liveness_body)
+      return unless live_face_image
+
+      face_image_from_document = fetch_face_from_document
+      return [true, false] unless face_image_from_document
+
+      [true, check_face_match(face_image_from_document, live_face_image)]
+    end
+
+    private
+
+    def process_selfie(liveness_body)
+      liveness_data = wrap_network_errors { liveness_service.liveness(liveness_body) }
+      return unless liveness_data
+      return unless selfie_live?(liveness_data)
+      JSON.parse(liveness_body)['Image']
+    end
+
+    def fetch_face_from_document
+      data = wrap_network_errors { assure_id.face_image }
+      return if data.nil?
+      Base64.strict_encode64(data)
+    end
+
+    def check_face_match(image1, image2)
+      data = wrap_network_errors { facematch_service.facematch(facematch_body(image1, image2)) }
+      return unless data
+      facematch_pass?(data)
+    end
+
+    def facematch_pass?(data)
+      data['IsMatch']
+    end
+
+    def selfie_live?(data)
+      data['LivenessResult']['LivenessAssessment'] == 'Live'
+    end
+
+    def facematch_body(image1, image2)
+      { 'Data':
+            { 'ImageOne': image1,
+              'ImageTwo': image2 },
+        'Settings':
+            { 'SubscriptionId': Figaro.env.acuant_assure_id_subscription_id } }.to_json
+    end
+
+    def liveness_service
+      (simulator_or_env_test? ? Idv::Acuant::FakeAssureId : Idv::Acuant::Liveness).new
+    end
+
+    def facematch_service
+      (simulator_or_env_test? ? Idv::Acuant::FakeAssureId : Idv::Acuant::FacialMatch).new
+    end
+
+    def simulator_or_env_test?
+      Rails.env.test? || Figaro.env.acuant_simulator == 'true'
+    end
+  end
+end
diff --git a/app/services/analytics.rb b/app/services/analytics.rb
index cf9e4697cf1..5f473bf9d53 100644
--- a/app/services/analytics.rb
+++ b/app/services/analytics.rb
@@ -65,6 +65,8 @@ def browser_attributes
 
   # rubocop:disable Metrics/LineLength
   ACCOUNT_RESET = 'Account Reset'.freeze
+  ACCOUNT_DELETE_SUBMITTED = 'Account Delete submitted'.freeze
+  ACCOUNT_DELETE_VISITED = 'Account Delete visited'.freeze
   ACCOUNT_DELETION = 'Account Deletion Requested'.freeze
   ACCOUNT_RESET_VISIT = 'Account deletion and reset visited'.freeze
   ACCOUNT_VISIT = 'Account Page Visited'.freeze
diff --git a/app/services/idv/acuant/fake_liveness.rb b/app/services/idv/acuant/fake_liveness.rb
new file mode 100644
index 00000000000..ed11de308d3
--- /dev/null
+++ b/app/services/idv/acuant/fake_liveness.rb
@@ -0,0 +1,16 @@
+module Idv
+  module Acuant
+    class FakeLiveness
+      GOOD_LIVENESS_DATA = {
+        'LivenessResult': { 'Score': 99, 'LivenessAssessment': 'Live' },
+        'Error': nil,
+        'ErrorCode': nil,
+        'TransactionId': '4a11ceed-7a54-45fa-9528-3945b51a1e23',
+      }.freeze
+
+      def liveness(_body)
+        [true, GOOD_LIVENESS_DATA.to_json]
+      end
+    end
+  end
+end
diff --git a/app/services/idv/acuant/liveness.rb b/app/services/idv/acuant/liveness.rb
index ff591a64ef3..885fb713bca 100644
--- a/app/services/idv/acuant/liveness.rb
+++ b/app/services/idv/acuant/liveness.rb
@@ -12,12 +12,11 @@ def initialize(cfg = default_cfg)
         @authentication_params = cfg.slice(:username, :password)
       end
 
-      def liveness(body)
+      def liveness(base64_image)
         url = '/api/v1/liveness'
-
         options = default_options.merge(
           headers: content_type_json.merge(accept_json),
-          body: body,
+          body: liveness_body(base64_image),
         )
         post(url, options)
       end
@@ -35,6 +34,16 @@ def default_cfg
       def default_options
         { basic_auth: @authentication_params }
       end
+
+      def liveness_body(base64_image)
+        {
+          'Settings' => {
+            'SubscriptionId' => @subscription_id,
+            'AdditionalSettings' => { 'OS' => 'UNKNOWN' },
+          },
+          'Image' => base64_image,
+        }.to_json
+      end
     end
   end
 end
diff --git a/app/services/idv/acuant/liveness_pass_through.rb b/app/services/idv/acuant/liveness_pass_through.rb
new file mode 100644
index 00000000000..67e79d92d27
--- /dev/null
+++ b/app/services/idv/acuant/liveness_pass_through.rb
@@ -0,0 +1,40 @@
+module Idv
+  module Acuant
+    class LivenessPassThrough
+      include Idv::Acuant::Http
+
+      base_uri Figaro.env.acuant_passlive_url
+
+      attr_accessor :instance_id
+
+      def initialize(cfg = default_cfg)
+        @subscription_id = cfg.fetch(:subscription_id)
+        @authentication_params = cfg.slice(:username, :password)
+      end
+
+      def liveness(body)
+        url = '/api/v1/liveness'
+
+        options = default_options.merge(
+          headers: content_type_json.merge(accept_json),
+          body: body,
+        )
+        post(url, options)
+      end
+
+      private
+
+      def default_cfg
+        {
+          subscription_id: env.acuant_assure_id_subscription_id,
+          username: env.acuant_assure_id_username,
+          password: env.acuant_assure_id_password,
+        }
+      end
+
+      def default_options
+        { basic_auth: @authentication_params }
+      end
+    end
+  end
+end
diff --git a/app/services/idv/flows/capture_doc_flow.rb b/app/services/idv/flows/capture_doc_flow.rb
index 5cbff7ca052..221a43c8676 100644
--- a/app/services/idv/flows/capture_doc_flow.rb
+++ b/app/services/idv/flows/capture_doc_flow.rb
@@ -4,6 +4,7 @@ class CaptureDocFlow < Flow::BaseFlow
       STEPS = {
         mobile_front_image: Idv::Steps::MobileFrontImageStep,
         capture_mobile_back_image: Idv::Steps::CaptureMobileBackImageStep,
+        selfie: Idv::Steps::SelfieStep,
         capture_complete: Idv::Steps::CaptureCompleteStep,
       }.freeze
 
diff --git a/app/services/idv/flows/doc_auth_flow.rb b/app/services/idv/flows/doc_auth_flow.rb
index 3d5edcc8f96..ea5ebc9533b 100644
--- a/app/services/idv/flows/doc_auth_flow.rb
+++ b/app/services/idv/flows/doc_auth_flow.rb
@@ -11,6 +11,7 @@ class DocAuthFlow < Flow::BaseFlow
         back_image: Idv::Steps::BackImageStep,
         mobile_front_image: Idv::Steps::MobileFrontImageStep,
         mobile_back_image: Idv::Steps::MobileBackImageStep,
+        selfie: Idv::Steps::SelfieStep,
         ssn: Idv::Steps::SsnStep,
         verify: Idv::Steps::VerifyStep,
         doc_success: Idv::Steps::DocSuccessStep,
diff --git a/app/services/idv/send_phone_confirmation_otp.rb b/app/services/idv/send_phone_confirmation_otp.rb
index 732c8ada94e..ba1ac071291 100644
--- a/app/services/idv/send_phone_confirmation_otp.rb
+++ b/app/services/idv/send_phone_confirmation_otp.rb
@@ -48,6 +48,7 @@ def otp_rate_limiter
       @otp_rate_limiter ||= OtpRateLimiter.new(
         user: user,
         phone: phone,
+        phone_confirmed: true,
       )
     end
 
diff --git a/app/services/idv/steps/back_image_step.rb b/app/services/idv/steps/back_image_step.rb
index 6df70d55fb8..0bcd2c04a28 100644
--- a/app/services/idv/steps/back_image_step.rb
+++ b/app/services/idv/steps/back_image_step.rb
@@ -8,6 +8,8 @@ def call
         failure_data, data = verify_back_image(reset_step: :front_image)
         return failure_data if failure_data
 
+        mark_selfie_step_complete_unless_liveness_checking_is_enabled
+
         extract_pii_from_doc(data)
       end
 
diff --git a/app/services/idv/steps/capture_mobile_back_image_step.rb b/app/services/idv/steps/capture_mobile_back_image_step.rb
index 3511c261b49..cb79b93b2c8 100644
--- a/app/services/idv/steps/capture_mobile_back_image_step.rb
+++ b/app/services/idv/steps/capture_mobile_back_image_step.rb
@@ -8,6 +8,8 @@ def call
         failure_data, _data = verify_back_image(reset_step: :mobile_front_image)
         return failure_data if failure_data
 
+        mark_selfie_step_complete_unless_liveness_checking_is_enabled
+
         CaptureDoc::UpdateAcuantToken.call(user_id_from_token, flow_session[:instance_id])
       end
 
diff --git a/app/services/idv/steps/doc_auth_base_step.rb b/app/services/idv/steps/doc_auth_base_step.rb
index fd42d647d14..71775145c12 100644
--- a/app/services/idv/steps/doc_auth_base_step.rb
+++ b/app/services/idv/steps/doc_auth_base_step.rb
@@ -77,6 +77,8 @@ def process_good_result(data)
       def save_proofing_components
         Db::ProofingComponent::Add.call(user_id, :document_check, 'acuant')
         Db::ProofingComponent::Add.call(user_id, :document_type, 'state_id')
+        return unless liveness_checking_enabled?
+        Db::ProofingComponent::Add.call(user_id, :liveness_check, 'acuant')
       end
 
       def extract_pii_from_doc(data)
@@ -209,6 +211,27 @@ def sp_session
         session.fetch(:sp, {})
       end
 
+      def mark_selfie_step_complete_unless_liveness_checking_is_enabled
+        mark_step_complete(:selfie) unless liveness_checking_enabled?
+      end
+
+      def liveness_checking_enabled?
+        FeatureManagement.liveness_checking_enabled? && (no_sp? || sp_liveness_checking_required?)
+      end
+
+      def sp_liveness_checking_required?
+        ServiceProvider.from_issuer(sp_session[:issuer].to_s)&.liveness_checking_required
+      end
+
+      def no_sp?
+        sp_session[:issuer].blank?
+      end
+
+      def mobile?
+        client = DeviceDetector.new(request.user_agent)
+        client.device_type != 'desktop'
+      end
+
       delegate :idv_session, :session, to: :@flow
     end
   end
diff --git a/app/services/idv/steps/link_sent_step.rb b/app/services/idv/steps/link_sent_step.rb
index 603e14eddca..cc367db950b 100644
--- a/app/services/idv/steps/link_sent_step.rb
+++ b/app/services/idv/steps/link_sent_step.rb
@@ -31,6 +31,7 @@ def mark_steps_complete
            back_image scan_id].each do |step|
           mark_step_complete(step)
         end
+        mark_step_complete(:selfie) unless liveness_checking_enabled?
       end
     end
   end
diff --git a/app/services/idv/steps/mobile_back_image_step.rb b/app/services/idv/steps/mobile_back_image_step.rb
index 9de2d4eb0d6..c24e8f392f5 100644
--- a/app/services/idv/steps/mobile_back_image_step.rb
+++ b/app/services/idv/steps/mobile_back_image_step.rb
@@ -8,6 +8,8 @@ def call
         failure_data, data = verify_back_image(reset_step: :mobile_front_image)
         return failure_data if failure_data
 
+        mark_selfie_step_complete_unless_liveness_checking_is_enabled
+
         extract_pii_from_doc(data)
       end
 
diff --git a/app/services/idv/steps/selfie_step.rb b/app/services/idv/steps/selfie_step.rb
new file mode 100644
index 00000000000..94bee44c4aa
--- /dev/null
+++ b/app/services/idv/steps/selfie_step.rb
@@ -0,0 +1,32 @@
+module Idv
+  module Steps
+    class SelfieStep < DocAuthBaseStep
+      def call
+        success, error_results = ::Acuant::Liveness.new(instance_id).call(image.read)
+        return selfie_failure(error_results) unless success
+      end
+
+      private
+
+      def form_submit
+        Idv::ImageUploadForm.new.submit(permit(:image, :image_data_url))
+      end
+
+      def instance_id
+        flow_session[:instance_id]
+      end
+
+      def selfie_failure(error_results)
+        if mobile?
+          mark_step_incomplete(:mobile_front_image)
+          mark_step_incomplete(:mobile_back_image)
+          mark_step_incomplete(:capture_mobile_back_image)
+        else
+          mark_step_incomplete(:front_image)
+          mark_step_incomplete(:back_image)
+        end
+        failure(I18n.t('errors.doc_auth.selfie'), error_results)
+      end
+    end
+  end
+end
diff --git a/app/services/idv/steps/upload_step.rb b/app/services/idv/steps/upload_step.rb
index 9b6115fa60a..1f325216670 100644
--- a/app/services/idv/steps/upload_step.rb
+++ b/app/services/idv/steps/upload_step.rb
@@ -12,11 +12,6 @@ def call
 
       private
 
-      def mobile?
-        client = DeviceDetector.new(request.user_agent)
-        client.device_type != 'desktop'
-      end
-
       def identity
         current_user&.identities&.order('created_at DESC')&.first&.decorate
       end
diff --git a/app/services/otp_rate_limiter.rb b/app/services/otp_rate_limiter.rb
index 26e9b2dd9ae..cadf7829c0f 100644
--- a/app/services/otp_rate_limiter.rb
+++ b/app/services/otp_rate_limiter.rb
@@ -1,7 +1,8 @@
 class OtpRateLimiter
-  def initialize(phone:, user:)
+  def initialize(phone:, user:, phone_confirmed:)
     @phone = phone
     @user = user
+    @phone_confirmed = phone_confirmed
   end
 
   def exceeded_otp_send_limit?
@@ -38,10 +39,10 @@ def increment
 
   private
 
-  attr_reader :phone, :user
+  attr_reader :phone, :user, :phone_confirmed
 
   def entry_for_current_phone
-    @entry ||= OtpRequestsTracker.find_or_create_with_phone(phone)
+    @entry ||= OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone, phone_confirmed)
   end
 
   def otp_last_sent_at
diff --git a/app/services/user_event_creator.rb b/app/services/user_event_creator.rb
index 9ff42e3be28..6f691c7ce75 100644
--- a/app/services/user_event_creator.rb
+++ b/app/services/user_event_creator.rb
@@ -37,7 +37,7 @@ def create_event_for_new_device(event_type:, user:)
 
     return event unless user_has_multiple_devices
 
-    send_new_device_notificaiton(user: user, event: event, device: device)
+    send_new_device_notification(user: user, event: event, device: device)
     event
   end
 
@@ -53,7 +53,7 @@ def assign_device_cookie(device_cookie)
     cookies.permanent[:device] = device_cookie unless device_cookie == cookies[:device]
   end
 
-  def send_new_device_notificaiton(user:, device:, event:)
+  def send_new_device_notification(user:, device:, event:)
     disavowal_token = EventDisavowal::GenerateDisavowalToken.new(event).call
     UserAlerts::AlertUserAboutNewDevice.call(user, device, disavowal_token)
   end
diff --git a/app/views/devise/sessions/_return_to_service_provider.html.erb b/app/views/devise/sessions/_return_to_service_provider.html.erb
new file mode 100644
index 00000000000..a59de096e80
--- /dev/null
+++ b/app/views/devise/sessions/_return_to_service_provider.html.erb
@@ -0,0 +1,8 @@
+<div class='sm-col py1 sm-p0'>
+  <%= link_to(
+    "‹ #{t('links.back_to_sp',
+    sp: decorated_session.sp_name)}",
+    decorated_session.sp_return_url,
+    class: 'inline-block align-bottom',
+  ) %>
+</div>
diff --git a/app/views/devise/sessions/_return_to_service_provider.html.slim b/app/views/devise/sessions/_return_to_service_provider.html.slim
deleted file mode 100644
index 7e2e00d9a5b..00000000000
--- a/app/views/devise/sessions/_return_to_service_provider.html.slim
+++ /dev/null
@@ -1,4 +0,0 @@
-.sm-col.py1.sm-p0
-  = link_to "‹ #{t('links.back_to_sp', sp: decorated_session.sp_name)}",
-    decorated_session.sp_return_url,
-    class: 'inline-block truncate align-bottom sm-maxw-250p'
diff --git a/app/views/idv/_acuant_sdk_selfie_capture_form.html.erb b/app/views/idv/_acuant_sdk_selfie_capture_form.html.erb
new file mode 100644
index 00000000000..33e02c7238a
--- /dev/null
+++ b/app/views/idv/_acuant_sdk_selfie_capture_form.html.erb
@@ -0,0 +1,52 @@
+<% if Figaro.env.acuant_sdk_document_capture_enabled == 'true' %>
+  <% content_for :meta_tags do %>
+    <%= tag :meta, name: 'acuant-sdk-initialization-endpoint', content: Figaro.env.acuant_sdk_initialization_endpoint %>
+    <%= tag :meta, name: 'acuant-sdk-initialization-creds', content: Figaro.env.acuant_sdk_initialization_creds %>
+  <% end %>
+
+  <div id='acuant-sdk-upload-form' class='hidden'>
+    <button id='acuant-sdk-capture' class='btn btn-primary'>
+      <%= capture_button_label %>
+    </button>
+  </div>
+
+  <div id='acuant-sdk-spinner' class='hidden'>
+    <%= image_tag(
+      asset_url('wait.gif'),
+      srcset: asset_url('wait.gif'),
+      height: 50,
+      width: 50,
+      alt: t('image_description.spinner')
+    ) %>
+  </div>
+
+  <!-- This view is never displayed, but it needs to be present in the DOM for
+  the SDK to capture the feed from the camer -->
+  <video id="acuant-player" controls autoPlay playsInline class='hidden'></video>
+  <div id='acuant-sdk-capture-view' class='hidden'>
+    <canvas id="acuant-video-canvas" style='width: 100%;'></canvas>
+  </div>
+
+  <div id='acuant-sdk-continue-form' class='hidden'>
+    <img id='acuant-sdk-preview' class='mb2'>
+    <%= submit_tag t('forms.buttons.continue'), class: 'block btn btn-primary btn-wide' %>
+    <%= link_to(
+      retry_capture_button_label,
+      url_for,
+      class: 'center btn btn-secondary btn-wide mt2',
+    ) %>
+  </div>
+
+  <p id='acuant-fallback-text' class='my3 hidden'>
+    <%= t(
+      'doc_auth.instructions.document_capture_fallback_html',
+      link: link_to(
+        t('doc_auth.instructions.document_capture_fallback_link'),
+        '#',
+        id: 'acuant-fallback-link'
+      )
+    ) %>
+  </p>
+
+  <%= javascript_pack_tag 'acuant_selfie_capture' %>
+<% end %>
diff --git a/app/views/idv/doc_auth/back_image.html.erb b/app/views/idv/doc_auth/back_image.html.erb
index 004b036c848..6d8a0291be9 100644
--- a/app/views/idv/doc_auth/back_image.html.erb
+++ b/app/views/idv/doc_auth/back_image.html.erb
@@ -20,19 +20,10 @@
     html: { autocomplete: 'off', role: 'form', class: 'mt2' }) do |f| %>
   <%= f.input :image_data_url, as: :hidden %>
   <%= render 'idv/doc_auth/notices', flow_session: flow_session %>
-  <div id='acuant-fallback-image-form'>
-    <%= f.input :image, label: false, as: :file, required: true, wrapper_class: 'mt3 sm-col-8' %>
-    <div class='my2' id='target'></div>
-    <div class='mt3'>
-      <%= render 'idv/doc_auth/submit_with_spinner' %>
-    </div>
-  </div>
-  <div class='my3'>
-    <%= render(
-      'idv/acuant_sdk_document_capture_form',
-      capture_button_label: t('doc_auth.buttons.upload_picture'),
-      retry_capture_button_label: t('doc_auth.buttons.upload_picture_retry'),
-    ) %>
+  <%= f.input :image, label: false, as: :file, required: true, wrapper_class: 'mt3 sm-col-8' %>
+  <div class='my2' id='target'></div>
+  <div class='mt3'>
+    <%= render 'idv/doc_auth/submit_with_spinner' %>
   </div>
 <% end %>
 
diff --git a/app/views/idv/doc_auth/front_image.html.erb b/app/views/idv/doc_auth/front_image.html.erb
index cea4c6745b2..1aed7846afe 100644
--- a/app/views/idv/doc_auth/front_image.html.erb
+++ b/app/views/idv/doc_auth/front_image.html.erb
@@ -24,19 +24,10 @@
 ) do |f| %>
   <%= f.input :image_data_url, as: :hidden %>
   <%= render 'idv/doc_auth/notices', flow_session: flow_session %>
-  <div id='acuant-fallback-image-form'>
-    <%= f.input :image, label: false, as: :file, required: true, wrapper_class: 'mt3 sm-col-8' %>
-    <div class='my2' id='target'></div>
-    <div class='mt3'>
-      <%= render 'idv/doc_auth/submit_with_spinner' %>
-    </div>
-  </div>
-  <div class='my3'>
-    <%= render(
-      'idv/acuant_sdk_document_capture_form',
-      capture_button_label: t('doc_auth.buttons.upload_picture'),
-      retry_capture_button_label: t('doc_auth.buttons.upload_picture_retry'),
-    ) %>
+  <%= f.input :image, label: false, as: :file, required: true, wrapper_class: 'mt3 sm-col-8' %>
+  <div class='my2' id='target'></div>
+  <div class='mt3'>
+    <%= render 'idv/doc_auth/submit_with_spinner' %>
   </div>
 <% end %>
 
diff --git a/app/views/idv/doc_auth/selfie.html.erb b/app/views/idv/doc_auth/selfie.html.erb
new file mode 100644
index 00000000000..396fbc0523b
--- /dev/null
+++ b/app/views/idv/doc_auth/selfie.html.erb
@@ -0,0 +1,30 @@
+<% title t('doc_auth.titles.doc_auth') %>
+
+<%= render 'idv/doc_auth/error_messages', flow_session: flow_session %>
+
+<h1 class='h3 my0'>
+  <%= t('doc_auth.headings.selfie') %>
+</h1>
+
+<%= simple_form_for(:doc_auth, url: url_for, method: 'PUT',
+    html: { autocomplete: 'off', role: 'form', class: 'mt2' }) do |f| %>
+  <%= f.input :image_data_url, as: :hidden %>
+  <%= render 'idv/doc_auth/notices', flow_session: flow_session %>
+  <div id='acuant-fallback-image-form'>
+    <%= f.input :image, label: false, as: :file, required: true, wrapper_class: 'mt3 sm-col-8' %>
+    <div class='my2' id='target'></div>
+    <div class='mt3'>
+      <%= render 'idv/doc_auth/submit_with_spinner' %>
+    </div>
+  </div>
+  <div class='my3'>
+    <%= render(
+      'idv/acuant_sdk_selfie_capture_form',
+      capture_button_label: t('doc_auth.buttons.upload_picture'),
+      retry_capture_button_label: t('doc_auth.buttons.upload_picture_retry'),
+    ) %>
+  </div>
+<% end %>
+
+<%= render 'idv/doc_auth/start_over_or_cancel' %>
+<%= javascript_pack_tag 'image-preview' %>
diff --git a/app/views/layouts/base.html.erb b/app/views/layouts/base.html.erb
new file mode 100644
index 00000000000..4ec84dd6068
--- /dev/null
+++ b/app/views/layouts/base.html.erb
@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<html class="no-js" lang="<%= I18n.locale %>">
+
+<head>
+  <meta charset="utf-8" />
+  <meta content="<%= content_for?(:description) ? yield(:description) : APP_NAME %>" name="description" />
+  <meta content="IE=edge" http-equiv="X-UA-Compatible" />
+  <meta content="none" name="msapplication-config" />
+  <meta content="width=device-width, initial-scale=1.0" name="viewport" />
+  <meta content="telephone=no" name="format-detection" />
+
+  <% if content_for?(:meta_refresh) %>
+  <meta content="<%= yield(:meta_refresh) %>" http-equiv="refresh" />
+  <% end %>
+
+  <% if session_with_trust? || FeatureManagement.disallow_all_web_crawlers? %>
+  <meta content="noindex,nofollow" name="robots" />
+  <% end %>
+
+  <%= yield(:meta_tags) if content_for?(:meta_tags) %>
+
+  <title>
+    <%= APP_NAME %><%= raw(" - #{yield(:title)}") if content_for?(:title) %>
+  </title>
+
+  <%= stylesheet_link_tag 'application', media: 'all' %>
+  <!--[if IE 8]>
+  <%= javascript_include_tag 'es5-shim.min' %>
+  <![endif]-->
+  <%= javascript_include_tag 'application' %>
+  <%= javascript_pack_tag 'application' %>
+  <%= csrf_meta_tags %>
+
+  <link href="/apple-touch-icon.png" rel="apple-touch-icon" sizes="180x180" />
+  <link href="/favicon-32x32.png" rel="icon" sizes="32x32" type="image/png" />
+  <link href="/favicon-16x16.png" rel="icon" sizes="16x16" type="image/png" />
+  <link href="/manifest.json" rel="manifest" />
+  <link color="#e21c3d" href="/safari-pinned-tab.svg" rel="mask-icon" />
+  <meta content="#ffffff" name="theme-color" />
+
+  <!--[if lt IE 9]>
+  <%= javascript_include_tag 'html5shiv' %>
+  <%= javascript_include_tag 'respond.min' %>
+  <![endif]-->
+
+  <% if Figaro.env.google_analytics_key.present? && !page_with_trust? %>
+  <%= render 'shared/google_analytics/page_tracking' %>
+  <% end %>
+
+  <% if Figaro.env.newrelic_browser_key.present? && Figaro.env.newrelic_browser_app_id.present? %>
+  <%= render 'shared/newrelic/browser_instrumentation' %>
+  <% end %>
+</head>
+
+<body class="<%= Rails.env %>-env site <%= yield(:background_cls) %>">
+  <div class="site-wrap bg-light-blue">
+    <%= render 'shared/banner' %>
+    <div aria-label="main-navigation" role="navigation">
+      <% if content_for?(:nav) %>
+      <%=   yield(:nav) %>
+      <% else %>
+      <%=   render decorated_session.nav_partial %>
+      <% end %>
+    </div>
+    <div class="container">
+      <div class="px2 py2 sm-py5 sm-px6 mx-auto sm-mb5 border-box card <%= yield(:card_cls) %>" role="main">
+        <%= render 'shared/flashes' %>
+        <%= yield %>
+      </div>
+    </div>
+  </div>
+
+  <%= render 'shared/footer_lite' %>
+
+  <div id="session-timeout-cntnr"></div>
+
+  <% if current_user # Render the JS snipped that collects platform authenticator analytics %>
+  <div data-platform-authenticator-enabled="true"></div>
+  <%= auto_session_timeout_js %>
+  <% else %>
+  <%= auto_session_expired_js %>
+  <% end %>
+
+  <%= render 'shared/dap_analytics' if Figaro.env.participate_in_dap == 'true' && !session_with_trust? %>
+</body>
+
+</html>
diff --git a/app/views/layouts/base.html.slim b/app/views/layouts/base.html.slim
deleted file mode 100644
index 417462f347e..00000000000
--- a/app/views/layouts/base.html.slim
+++ /dev/null
@@ -1,78 +0,0 @@
-doctype html
-html lang="#{I18n.locale}" class='no-js'
-
-  head
-    meta charset='utf-8'
-    meta name='description' content="#{content_for?(:description) ? yield(:description) : APP_NAME}"
-    meta http-equiv='X-UA-Compatible' content='IE=edge'
-    meta name='msapplication-config' content='none'
-    meta[name='viewport' content='width=device-width, initial-scale=1.0']
-    meta name="format-detection" content="telephone=no"
-    - if content_for?(:meta_refresh)
-      meta http-equiv="refresh" content="#{yield(:meta_refresh)}"
-    - if session_with_trust? || FeatureManagement.disallow_all_web_crawlers?
-      meta name='robots' content='noindex,nofollow'
-    - if content_for?(:meta_tags)
-      = yield(:meta_tags)
-
-    title
-      = APP_NAME
-      - if content_for?(:title)
-        = ' - '
-        = yield(:title)
-
-    == stylesheet_link_tag 'application', media: 'all'
-    <!--[if IE 8]>
-      = javascript_include_tag 'es5-shim.min'
-    <![endif]-->
-    == javascript_include_tag 'application'
-    == javascript_pack_tag 'application'
-    == csrf_meta_tags
-
-    link rel='apple-touch-icon' sizes='180x180' href='/apple-touch-icon.png'
-    link rel='icon' type='image/png' href='/favicon-32x32.png' sizes='32x32'
-    link rel='icon' type='image/png' href='/favicon-16x16.png' sizes='16x16'
-    link rel='manifest' href='/manifest.json'
-    link rel='mask-icon' href='/safari-pinned-tab.svg' color='#e21c3d'
-    meta name='theme-color' content='#ffffff'
-
-    <!--[if lt IE 9]>
-      = javascript_include_tag 'html5shiv'
-      = javascript_include_tag 'respond.min'
-    <![endif]-->
-
-    - if Figaro.env.google_analytics_key.present? && !page_with_trust?
-      = render 'shared/google_analytics/page_tracking'
-    - if Figaro.env.newrelic_browser_key.present? && Figaro.env.newrelic_browser_app_id.present?
-      = render 'shared/newrelic/browser_instrumentation'
-
-  body class="#{Rails.env}-env site #{yield(:background_cls)}"
-    .site-wrap.bg-light-blue
-      div role="banner"
-        - if FeatureManagement.fake_banner_mode?
-          = render 'shared/fake_banner'
-        - else
-          = render 'shared/usa_banner'
-      div role="navigation" aria-label="main-navigation"
-        - if content_for?(:nav)
-          = yield(:nav)
-        - else
-          = render decorated_session.nav_partial
-      .container
-        div[class="px2 py2 sm-py5 sm-px6 mx-auto sm-mb5 border-box card #{yield(:card_cls)}"
-            role="main"]
-          = render 'shared/flashes'
-          == yield
-    = render 'shared/footer_lite'
-
-    #session-timeout-cntnr
-    - if current_user
-      / Render the JS snipped that collects platform authenticator analytics
-      div [data-platform-authenticator-enabled="true"]
-
-      = auto_session_timeout_js
-    - else
-      = auto_session_expired_js
-
-    - if Figaro.env.participate_in_dap == 'true' && !session_with_trust?
-      = render 'shared/dap_analytics'
diff --git a/app/views/shared/_accordion.html.slim b/app/views/shared/_accordion.html.slim
index f5ed96d5944..e0f8f4685be 100644
--- a/app/views/shared/_accordion.html.slim
+++ b/app/views/shared/_accordion.html.slim
@@ -3,9 +3,8 @@
 )
   .accordion-header(
     class=('display-none' if options[:hide_header])
-    role="heading"
+    role="button"
     aria-labelledby=target_id
-    aria-level=options.fetch(:aria_level, 1)
   )
     .accordion-header-controls.py1.px2.mt-tiny.mb-tiny(
       aria-controls="#{target_id}"
diff --git a/app/views/shared/_banner.html.erb b/app/views/shared/_banner.html.erb
new file mode 100644
index 00000000000..83662d9558e
--- /dev/null
+++ b/app/views/shared/_banner.html.erb
@@ -0,0 +1,56 @@
+<div aria-label="banner" role="banner">
+  <%= render 'shared/no_pii_banner' if FeatureManagement.fake_banner_mode? %>
+  <section class="usa-banner" aria-label="Official government website">
+    <div class="usa-accordion">
+      <header class="usa-banner__header">
+        <div class="usa-banner__inner">
+          <%= image_tag(
+            asset_url('us-flag.png'),
+            alt: t('image_description.us_flag'),
+            size: '18x12',
+            class: 'mr1'
+          ) %>
+          <div class="grid-col-fill tablet:grid-col-auto">
+            <p class="usa-banner__header-text"><%= FeatureManagement.fake_banner_mode? ?
+              t('shared.banner.fake_site') : t('shared.banner.official_site')
+            %></p>
+            <p class="usa-banner__header-action" aria-hidden="true"><%= t('shared.banner.how') %></p>
+          </div>
+          <button class="usa-accordion__button usa-banner__button" aria-expanded="false" aria-controls="gov-banner">
+            <span class="usa-banner__button-text"><%= t('shared.banner.how') %></span>
+          </button>
+        </div>
+      </header>
+      <div class="usa-banner__content usa-accordion__content hide" id="gov-banner">
+        <div class="grid-row grid-gap-lg">
+          <div class="usa-banner__guidance tablet:grid-col-6">
+            <%= image_tag(
+              asset_url('icon-dot-gov.svg'),
+              alt: 'Dot gov',
+              class: 'usa-banner__icon usa-media-block__img'
+            ) %>
+            <div class="usa-media-block__body">
+              <p>
+                <strong><%= t('shared.banner.gov_heading') %></strong>
+                <br> <%= t('shared.banner.gov_description') %>
+              </p>
+            </div>
+          </div>
+          <div class="usa-banner__guidance tablet:grid-col-6">
+            <%= image_tag(
+              asset_url('icon-https.svg'),
+              alt: 'Https',
+              class: 'usa-banner__icon usa-media-block__img'
+            ) %>
+            <div class="usa-media-block__body">
+              <p>
+                <strong><%= t('shared.banner.secure_heading') %></strong>
+                <br> <%= t('shared.banner.secure_description') %>
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </section>
+</div>
diff --git a/app/views/shared/_fake_banner.html.slim b/app/views/shared/_fake_banner.html.slim
deleted file mode 100644
index 87e3afb3373..00000000000
--- a/app/views/shared/_fake_banner.html.slim
+++ /dev/null
@@ -1,6 +0,0 @@
-.py1.bg-maroon.white.fs-12p.line-height-1.center
-  = t('idv.messages.sessions.no_pii')
-.py1.bg-navy.white.fs-12p.line-height-1.center
-  = image_tag(asset_url('us-flag.png'), size: '18x12',
-          alt: t('image_description.us_flag'), class: 'mr1 align-bottom')
-  = t('.fake_site')
diff --git a/app/views/shared/_footer_lite.html.slim b/app/views/shared/_footer_lite.html.slim
index 9fbbf41e9e0..4a41b92d5d6 100644
--- a/app/views/shared/_footer_lite.html.slim
+++ b/app/views/shared/_footer_lite.html.slim
@@ -23,6 +23,16 @@ footer.footer.bg-light-blue.sm-bg-navy
 
   .container.py1.px2.lg-px0(class="#{'sm-py0' if show_language_dropdown}")
     .flex.flex-center
+      .flex.flex-auto.flex-first
+        = link_to('https://gsa.gov',
+          class: 'flex flex-center text-decoration-none white h6',
+          target: '_blank') do
+          = image_tag asset_url('sp-logos/square-gsa.svg'),
+            width: 20, class: 'mr1 sm-show', alt: ''
+          = image_tag asset_url('sp-logos/square-gsa-dark.svg'),
+            width: 20, class: 'mr1 sm-hide', alt: ''
+          span.sm-show
+           = t('shared.footer_lite.gsa')
       .flex.flex-center
         - if show_language_dropdown
           ul.list-reset.sm-show.mb0
@@ -47,13 +57,3 @@ footer.footer.bg-light-blue.sm-bg-navy
           class: 'caps h6 blue sm-white text-decoration-none mr3', target: '_blank'
         = link_to t('links.privacy_policy'), MarketingSite.privacy_url,
           class: 'caps h6 blue sm-white text-decoration-none', target: '_blank'
-      .flex.flex-auto.flex-first
-        = link_to('https://gsa.gov',
-          class: 'flex flex-center text-decoration-none white h6',
-          target: '_blank') do
-          = image_tag asset_url('sp-logos/square-gsa.svg'),
-            width: 20, class: 'mr1 sm-show', alt: 'GSA homepage'
-          = image_tag asset_url('sp-logos/square-gsa-dark.svg'),
-            width: 20, class: 'mr1 sm-hide', alt: 'GSA homepage'
-          span.sm-show
-           = t('shared.footer_lite.gsa')
diff --git a/app/views/shared/_usa_banner.html.slim b/app/views/shared/_usa_banner.html.slim
deleted file mode 100644
index de62a6444a0..00000000000
--- a/app/views/shared/_usa_banner.html.slim
+++ /dev/null
@@ -1,5 +0,0 @@
-.py1.bg-navy.white.fs-12p.line-height-1.center
-  = image_tag(asset_url('us-flag.png'), alt: t('image_description.us_flag'),
-    size: '18x12', class: 'mr1 align-bottom')
-  span
-    = t('.official_site')
diff --git a/app/views/sign_up/registrations/new.html.erb b/app/views/sign_up/registrations/new.html.erb
index 9d8ea5af5f4..df83fc1be21 100644
--- a/app/views/sign_up/registrations/new.html.erb
+++ b/app/views/sign_up/registrations/new.html.erb
@@ -2,7 +2,7 @@
 
 <%= render 'shared/sp_alert' %>
 
-<div class='email-invalid-alert usa-alert margin-bottom-2 usa-alert--error hide'>
+<div class='email-invalid-alert usa-alert margin-bottom-2 usa-alert--error hide' hidden='true'>
   <div class='usa-alert__body'>
     <p class='usa-alert__text'>
       <%= t('sign_up.email.invalid_email_alert_head') %>
@@ -17,7 +17,7 @@
       html: { autocomplete: 'off', role: 'form' },
       url: sign_up_register_path) do |f| %>
     <%= f.input :email, label: t('forms.registration.labels.email'), required: true %>
-    <span class='email-invalid-alert-inline usa-error-message margin-top-neg-3 margin-bottom-3 hide' role='alert'>
+    <span class='email-invalid-alert-inline usa-error-message margin-top-neg-3 margin-bottom-3 hide' role='alert' hidden='true'>
       <%= t('sign_up.email.invalid_email_alert_inline') %>
     </span>
     <%= f.input :request_id, as: :hidden, input_html: { value: params[:request_id] || request_id } %>
diff --git a/app/views/two_factor_authentication/otp_verification/show.html.erb b/app/views/two_factor_authentication/otp_verification/show.html.erb
index 02a7854f462..677e1e7ac58 100644
--- a/app/views/two_factor_authentication/otp_verification/show.html.erb
+++ b/app/views/two_factor_authentication/otp_verification/show.html.erb
@@ -10,30 +10,46 @@
 
 <%= form_tag(:login_otp, method: :post, role: 'form', class: 'mt3') do %>
   <%= render @presenter.reauthn_hidden_field_partial %>
-  <%= label_tag 'code', t('simple_form.required.html') + t('forms.two_factor.code'), class: 'block bold' %>
+  <%= label_tag 'code',
+                t('simple_form.required.html') + t('forms.two_factor.code'),
+                class: 'block bold' %>
   <div class="col-12 sm-col-5 mb2 sm-mb0 sm-mr-20p inline-block">
-    <%= text_field_tag(:code, '', value: @presenter.code_value, required: true, autofocus: true,
-                       pattern: '[0-9]*', class: 'col-12 field monospace mfa',
-                       'aria-describedby': 'code-instructs', maxlength: Devise.direct_otp_length,
+    <%= text_field_tag(:code, '',
+                       value: @presenter.code_value,
+                       required: true,
+                       autofocus: true,
+                       pattern: '[0-9]*',
+                       class: 'col-12 field monospace mfa',
+                       'aria-describedby': 'code-instructs',
+                       maxlength: Devise.direct_otp_length,
                        type: 'tel') %>
   </div>
-  <%= hidden_field_tag 'otp_make_default_number', @presenter.otp_make_default_number %>
-  <%= submit_tag t('forms.buttons.submit.default'), class: 'btn btn-primary align-top sm-col-6 col-12' %>
+  <%= hidden_field_tag 'otp_make_default_number',
+                       @presenter.otp_make_default_number %>
+  <%= submit_tag t('forms.buttons.submit.default'),
+                 class: 'btn btn-primary align-top sm-col-6 col-12' %>
 
   <br/><br/>
-  <%= link_to(t('links.two_factor_authentication.get_another_code'),
-              otp_send_path(otp_delivery_selection_form:
-                { otp_delivery_preference: @presenter.otp_delivery_preference, resend: true }),
-              class: 'btn btn-link btn-border ico ico-refresh text-decoration-none',
-              form_class: 'inline-block') %>
+  <div class="flex flex-row flex-align-center flex-wrap">
+    <%= link_to(t('links.two_factor_authentication.get_another_code'),
+                otp_send_path(otp_delivery_selection_form: {
+                  otp_delivery_preference: @presenter.otp_delivery_preference,
+                  resend: true
+                }),
+                class: 'btn btn-link btn-border ico ico-refresh text-decoration-none flex-no-shrink margin-right-205',
+                form_class: 'inline-block') %>
 
-  <inline-block class="span" style="white-space:nowrap">
-    <%= hidden_field_tag 'remember_device', false, id: 'remember_device_preference' %>
-    <%= check_box_tag 'remember_device', true, @presenter.remember_device_box_checked?, class: 'my2 ml2 mr1' %>
-    <%= label_tag 'remember_device',
-                t('forms.messages.remember_device'),
-                class: 'blue' %>
-  </inline-block>
+    <span class="text-no-wrap flex-no-shrink flex flex-row flex-align-center">
+      <%= hidden_field_tag 'remember_device', false,
+                           id: 'remember_device_preference' %>
+      <%= check_box_tag 'remember_device', true,
+                        @presenter.remember_device_box_checked?,
+                        class: 'my2 ml2 mr1 margin-left-0' %>
+      <%= label_tag 'remember_device',
+                    t('forms.messages.remember_device'),
+                    class: 'blue margin-bottom-0' %>
+    </span>
+  </div>
 <% end %>
 
 <% if @presenter.update_phone_link.present? %>
diff --git a/app/views/users/delete/show.html.erb b/app/views/users/delete/show.html.erb
new file mode 100644
index 00000000000..06070167938
--- /dev/null
+++ b/app/views/users/delete/show.html.erb
@@ -0,0 +1,30 @@
+<div class="p0 cntnr-xxskinny border-box bg-white rounded-xxl modal-warning">
+  <h2 class="my2 fs-20p sans-serif regular center">
+    <%= t('users.delete.heading') %>
+  </h2>
+  <hr class="mb3 bw4 rounded" />
+  <div class="mb1 bold">
+    <%= t('users.delete.subheading') %>
+  </div>
+  <ul class="px2">
+    <li class="mb1"><%= t('users.delete.bullet_1', app: APP_NAME) %></li>
+    <li class="mb1"><%= current_user.decorate.delete_account_bullet_key %></li>
+    <li class="mb1"><%= t('users.delete.bullet_3', app: APP_NAME) %></li>
+  </ul>
+  <div>
+    <%= simple_form_for(current_user, url: account_delete_path,
+                        html: { autocomplete: 'off', method: :post, role: 'form' }) do |f| %>
+      <div class="mb3">
+        <%= t('users.delete.instructions') %>
+      </div>
+      <%= f.input :password, label: t('idv.form.password'), required: true %>
+      <%= f.button :submit,
+                   t('users.delete.actions.delete'),
+                   class: 'btn btn-primary col-12 mb2 p2 rounded-lg' %>
+    <% end %>
+
+    <%= link_to t('users.delete.actions.cancel'), account_path,
+                role: 'button',
+                class: 'center btn col-12 p2 rounded-lg border border-blue blue border-box' %>
+  </div>
+</div>
diff --git a/app/views/users/delete/show.html.slim b/app/views/users/delete/show.html.slim
deleted file mode 100644
index 4abfdcb90c5..00000000000
--- a/app/views/users/delete/show.html.slim
+++ /dev/null
@@ -1,17 +0,0 @@
-.p0.cntnr-xxskinny.border-box.bg-white.rounded-xxl.modal-warning
-  h2.my2.fs-20p.sans-serif.regular.center
-    = t('users.delete.heading')
-  hr.mb3.bw4.rounded
-  .mb1.bold
-    = t('users.delete.subheading')
-
-  ul.px2.yellow-dots
-    li.mb1 = t('users.delete.bullet_1', app: APP_NAME)
-    li.mb1 = current_user.decorate.delete_account_bullet_key
-    li.mb1 = t('users.delete.bullet_3', app: APP_NAME)
-  .center
-    = button_to t('users.delete.actions.delete'), account_delete_path,
-            class: 'btn btn-primary col-12 mb2 p2 rounded-lg', method: 'delete'
-
-    = link_to t('users.delete.actions.cancel'), account_path,
-            class: 'btn col-12 p2 rounded-lg border border-blue blue border-box'
diff --git a/app/views/users/totp_setup/new.html.erb b/app/views/users/totp_setup/new.html.erb
index a509145e0bf..27ca256193b 100644
--- a/app/views/users/totp_setup/new.html.erb
+++ b/app/views/users/totp_setup/new.html.erb
@@ -6,14 +6,14 @@
     <li class="py2 border-top">
       <div class="mb2">
         <div class="mr1 inline-block circle circle-number bg-blue white">1</div>
-        <div class="inline-block bold"><%= t('forms.totp_setup.totp_step_1') %></div>
+        <div class="inline-block bold" id="totp-nickname"><%= t('forms.totp_setup.totp_step_1') %></div>
         <div class="inline-block ml3"><%= t('forms.totp_setup.totp_step_1a') %></div>
       </div>
       <div class="sm-col-9 sm-ml-28p">
         <div class="clearfix mxn1">
           <div class="col col-6 sm-col-7 px1">
             <%= text_field_tag :name, '', required: true, class: 'block col-12 field monospace',
-                                maxlength: 20, 'aria-labelledby': 'totp-label' %>
+                                maxlength: 20, 'aria-labelledby': 'totp-nickname' %>
           </div>
         </div>
       </div>
@@ -30,10 +30,10 @@
       <div class="sm-col-9 sm-ml-28p">
         <div class="px2 py1 border border-dashed border-navy">
           <div class="inline fs-20p caps monospace" id="qr-code"><%= @code %></div>
-          <div class="clipboard ml2 right mt-tiny btn btn-primary p0 w-60p bg-light-blue blue h6 regular border-box center"
-               data-clipboard-text="<%= @code.upcase %>">
+          <button class="clipboard ml2 right mt-tiny btn btn-primary p0 w-60p bg-light-blue blue h6 regular border-box center"
+                  data-clipboard-text="<%= @code.upcase %>">
             <%= t('links.copy') %>
-          </div>
+          </button>
         </div>
         <div class="py2 center bold"><%= t('instructions.mfa.authenticator.or') %></div>
         <%= accordion('totp-info', t('instructions.mfa.authenticator.accordion_header'),
diff --git a/app/views/users/two_factor_authentication_setup/index.html.erb b/app/views/users/two_factor_authentication_setup/index.html.erb
index a47e0e07708..0a7b57a42a9 100644
--- a/app/views/users/two_factor_authentication_setup/index.html.erb
+++ b/app/views/users/two_factor_authentication_setup/index.html.erb
@@ -12,7 +12,9 @@
     <fieldset class="m0 p0 border-none">
       <legend class="mb2 serif bold"><%= t('forms.two_factor_choice.legend') %>:</legend>
       <% @presenter.options.each do |option| %>
-        <label class="btn-border col-12 mb2 <%= option.html_class %>" for="two_factor_options_form_selection_<%= option.type %>">
+        <%= label_tag "two_factor_options_form_selection_#{option.type}",
+                      class: "btn-border col-12 mb2 #{option.html_class}",
+                      hidden: option.html_class == 'hide' do %>
           <div class="radio">
             <%= radio_button_tag('two_factor_options_form[selection]', option.type) %>
             <span class="indicator mt-tiny"></span>
@@ -22,7 +24,7 @@
           <% if option.security_level %>
             <span class="usa-tag float-right bg-info-dark"><%= option.security_level %></span>
           <% end %>
-        </label>
+        <% end %>
     <% end %>
     </fieldset>
   </div>
diff --git a/bin/load_test b/bin/load_test
deleted file mode 100755
index 240405cf677..00000000000
--- a/bin/load_test
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/sh
-
-set -e
-
-fancy_echo() {
-  local fmt="$1"; shift
-
-  # shellcheck disable=SC2059
-  printf "\n$fmt\n" "$@"
-}
-
-brew_install_or_upgrade() {
-  if brew_is_installed "$1"; then
-    if brew_is_upgradable "$1"; then
-      fancy_echo "Upgrading %s ..." "$1"
-      brew upgrade "$@"
-    else
-      fancy_echo "Already using the latest version of %s. Skipping ..." "$1"
-    fi
-  else
-    fancy_echo "Installing %s ..." "$1"
-    brew install "$@"
-  fi
-}
-
-brew_is_installed() {
-  brew list -1 | grep -Fqx "$1"
-}
-
-brew_is_upgradable() {
-  ! brew outdated --quiet "$1" >/dev/null
-}
-
-if [ $1 ]
-then
-  test_to_run="$1"
-  target="${TARGET_HOST:-http://localhost:3000}"
-  num_clients=${NUM_CLIENTS:-3}
-  run_time=${RUN_TIME:-'180s'}
-  hatch_rate=${HATCH_RATE:-1}
-
-  brew_install_or_upgrade 'libevent'
-  source /usr/local/bin/virtualenvwrapper.sh
-  mkvirtualenv locust && \
-    workon locust &&  \
-    pip install -r scripts/load_testing/requirements.txt && \
-    echo "running locust with concurrency of $num_clients, new user hatch rate"\
-    "of $hatch_rate, and a run time of $run_time" && \
-    locust -f scripts/load_testing/$test_to_run.py -H "$target" --no-web \
-    -c $num_clients -t $run_time -r $hatch_rate
-  deactivate
-else
-  echo "Usage: NUM_CLIENTS=3 NUM_REQUESTS=100 HATCH_RATE=1 load_test [name_of_file]"
-  echo "Usage:"
-  echo "load_test [name_of_file]"
-  echo "or, if you'd like to set the arguments"
-  echo "NUM_CLIENTS=3 RUN_TIME=180s HATCH_RATE=1 load_test [name_of_file]"
-fi
diff --git a/config/application.yml.default b/config/application.yml.default
index ace803ed59f..1e1f680319a 100644
--- a/config/application.yml.default
+++ b/config/application.yml.default
@@ -390,7 +390,7 @@ test:
   hmac_fingerprinter_key: a2c813d4dca919340866ba58063e4072adc459b767a74cf2666d5c1eef3861db26708e7437abde1755eb24f4034386b0fea1850a1cb7e56bff8fae3cc6ade96c
   hmac_fingerprinter_key_queue: '["old-key-one", "old-key-two"]'
   issuers_with_email_nameid_format: https://rp1.serviceprovider.com/auth/saml/metadata
-  liveness_checking_enabled: 'true'
+  liveness_checking_enabled: 'false'
   lockout_period_in_minutes: '5'
   login_with_piv_cac: 'true'
   logins_per_email_and_ip_limit: '2'
diff --git a/config/locales/doc_auth/en.yml b/config/locales/doc_auth/en.yml
index 7391c00f1f2..ce6f9b7068c 100644
--- a/config/locales/doc_auth/en.yml
+++ b/config/locales/doc_auth/en.yml
@@ -24,6 +24,7 @@ en:
     headings:
       address: Mailing Address
       capture_complete: We have verified your state issued ID
+      selfie: Take a selfie.
       ssn: Please enter your social security number.
       take_pic_back: Take a photo of the back of your ID
       take_pic_front: Take a photo of the front of your ID
diff --git a/config/locales/doc_auth/es.yml b/config/locales/doc_auth/es.yml
index 1ca0e7bb740..4797ea2a45c 100644
--- a/config/locales/doc_auth/es.yml
+++ b/config/locales/doc_auth/es.yml
@@ -25,6 +25,7 @@ es:
     headings:
       address: Dirección de envio
       capture_complete: Hemos verificado la identificación emitida por su estado
+      selfie: Toma una selfie.
       ssn: Por favor ingrese su número de seguro social.
       take_pic_back: Toma una foto de la parte posterior de tu identificación
       take_pic_front: Toma una foto del frente de tu identificación
diff --git a/config/locales/doc_auth/fr.yml b/config/locales/doc_auth/fr.yml
index 9ea32e328f1..9bacb3b1c09 100644
--- a/config/locales/doc_auth/fr.yml
+++ b/config/locales/doc_auth/fr.yml
@@ -25,6 +25,7 @@ fr:
     headings:
       address: Adresse mail
       capture_complete: Nous avons vérifié votre ID émis par l'état
+      selfie: Prendre un selfie.
       ssn: S'il vous plaît entrez votre numéro de sécurité sociale.
       take_pic_back: Prenez une photo au verso de votre identifiant
       take_pic_front: Prenez une photo du recto de votre identifiant
diff --git a/config/locales/errors/en.yml b/config/locales/errors/en.yml
index d3e5b0ee9de..7a8dbea23fc 100644
--- a/config/locales/errors/en.yml
+++ b/config/locales/errors/en.yml
@@ -43,6 +43,7 @@ en:
         before continuing. We sent you a link with instructions.
       quota_reached: Sorry your service provider has reached its identity verification
         limit.  Please contact your service provider for more information.
+      selfie: Sorry, your photo was not accepted. Please try again.
       send_link_throttle: You tried too many times, please try again in 10 minutes.
         You can also click on Start Over and choose to use your computer instead.
     invalid_authenticity_token: Oops, something went wrong. Please try again.
diff --git a/config/locales/errors/es.yml b/config/locales/errors/es.yml
index bbf16241a82..9d972e3de6b 100644
--- a/config/locales/errors/es.yml
+++ b/config/locales/errors/es.yml
@@ -44,6 +44,7 @@ es:
       quota_reached: Lo sentimos, su proveedor de servicios ha alcanzado su límite
         de verificación de identidad. Póngase en contacto con su proveedor de servicios
         para obtener más información.
+      selfie: Lo sentimos, tu foto no fue aceptada. Inténtalo de nuevo.
       send_link_throttle: Lo intentaste muchas veces, vuelve a intentarlo en 10 minutos.
         También puedes hacer clic en comenzar de nuevo y elegir usar tu computadora.
     invalid_authenticity_token: "¡Oops! Algo salió mal. Inténtelo de nuevo."
diff --git a/config/locales/errors/fr.yml b/config/locales/errors/fr.yml
index d5aac661f47..6d84b17fa8d 100644
--- a/config/locales/errors/fr.yml
+++ b/config/locales/errors/fr.yml
@@ -44,6 +44,7 @@ fr:
       quota_reached: Désolé, votre fournisseur de services a atteint sa limite de
         vérification d'identité. Veuillez contacter votre fournisseur de services
         pour plus d'informations.
+      selfie: Désolé, votre photo n'a pas été acceptée. Veuillez réessayer.
       send_link_throttle: Vous avez essayé plusieurs fois, essayez à nouveau dans
         10 minutes. Vous pouvez également cliquer sur recommencer et choisir d'utiliser
         votre ordinateur.
diff --git a/config/locales/openid_connect/en.yml b/config/locales/openid_connect/en.yml
index 200cc5de858..702d0f2e0a0 100644
--- a/config/locales/openid_connect/en.yml
+++ b/config/locales/openid_connect/en.yml
@@ -4,6 +4,10 @@ en:
     authorization:
       errors:
         bad_client_id: Bad client_id
+        invalid_verified_within_duration:
+          one: value must be at least %{count} day or older
+          other: value must be at least %{count} days or older
+        invalid_verified_within_format: Unrecognized format for verified_within
         no_auth: The acr_values are not authorized
         no_valid_acr_values: No acceptable acr_values found
         no_valid_scope: No valid scope values found
@@ -11,10 +15,6 @@ en:
         redirect_uri_invalid: redirect_uri is invalid
         redirect_uri_no_match: redirect_uri does not match registered redirect_uri
         unauthorized_scope: Unauthorized scope
-        invalid_verified_within_duration:
-          one: value must be at least %{count} day or older
-          other: value must be at least %{count} days or older
-        invalid_verified_within_format: Unrecognized format for verified_within
     logout:
       errors:
         id_token_hint: id_token_hint was not recognized
diff --git a/config/locales/shared/en.yml b/config/locales/shared/en.yml
index 5574596da34..d846ba8cbe8 100644
--- a/config/locales/shared/en.yml
+++ b/config/locales/shared/en.yml
@@ -1,9 +1,16 @@
 ---
 en:
   shared:
-    fake_banner:
-      fake_site: A DEMO website of the United States government
+    banner:
+      fake_site: A DEMO website of the United States government.
+      gov_description: Federal government websites often end in .gov or .mil. Before
+        sharing sensitive information, make sure you’re on a federal government site.
+      gov_heading: The .gov means it’s official.
+      how: Here’s how you know
+      official_site: An official website of the United States government.
+      secure_description: The <strong>https://</strong> ensures that you are connecting
+        to the official website and that any information you provide is encrypted
+        and transmitted securely.
+      secure_heading: The site is secure.
     footer_lite:
-      gsa: U.S. General Services Administration
-    usa_banner:
-      official_site: An official website of the United States government
+      gsa: US General Services Administration
diff --git a/config/locales/shared/es.yml b/config/locales/shared/es.yml
index 1438c6e7b99..2441499db48 100644
--- a/config/locales/shared/es.yml
+++ b/config/locales/shared/es.yml
@@ -1,9 +1,17 @@
 ---
 es:
   shared:
-    fake_banner:
-      fake_site: Un sitio web de DEMO del gobierno de Estados Unidos
+    banner:
+      fake_site: Un sitio web de DEMO del gobierno de Estados Unidos.
+      gov_description: Los sitios web del gobierno federal a menudo terminan en .gov
+        o .mil. Antes de compartir información confidencial, asegúrese de estar en
+        un sitio del gobierno federal.
+      gov_heading: La .gov significa que es oficial.
+      how: Así es como sabes
+      official_site: Un sitio oficial del Gobierno de Estados Unidos.
+      secure_description: El <strong>https://</strong> garantiza que se está conectando
+        al sitio web oficial y que toda la información que proporciona está encriptada
+        y transmitida de forma segura.
+      secure_heading: El sitio es seguro.
     footer_lite:
       gsa: Administración General de Servicios de EE. UU.
-    usa_banner:
-      official_site: Un sitio oficial del Gobierno de Estados Unidos
diff --git a/config/locales/shared/fr.yml b/config/locales/shared/fr.yml
index 17879a01e0a..ecb6298a57e 100644
--- a/config/locales/shared/fr.yml
+++ b/config/locales/shared/fr.yml
@@ -1,9 +1,17 @@
 ---
 fr:
   shared:
-    fake_banner:
-      fake_site: Un site de DEMO du gouvernement des États-Unis
+    banner:
+      fake_site: Un site de DEMO du gouvernement des États-Unis.
+      gov_description: Les sites Web du gouvernement fédéral se terminent souvent
+        par .gov ou .mil. Avant de partager des informations sensibles, assurez-vous
+        que vous êtes sur un site du gouvernement fédéral.
+      gov_heading: Le .gov signifie que c'est officiel.
+      how: Voici comment vous savez
+      official_site: Un site web officiel du gouvernement des États-Unis.
+      secure_description: Le <strong>https://</strong> garantit que vous vous connectez
+        au site officiel et que toutes les informations que vous fournissez sont cryptées
+        et transmises en toute sécurité.
+      secure_heading: Le site est sécurisé.
     footer_lite:
       gsa: Administration des services généraux des États-Unis
-    usa_banner:
-      official_site: Un site web officiel du gouvernement des États-Unis
diff --git a/config/locales/users/en.yml b/config/locales/users/en.yml
index 47f05ae286a..95640baeb6a 100644
--- a/config/locales/users/en.yml
+++ b/config/locales/users/en.yml
@@ -13,6 +13,7 @@ en:
         name, address, date of birth and Social Security number from our system."
       bullet_3: You won't be able to securely access your information using %{app}.
       heading: Are you sure you want to delete your account?
+      instructions: Enter your password to confirm that you want to delete your account.
       subheading: If you delete your account
     personal_key:
       close: Close
diff --git a/config/locales/users/es.yml b/config/locales/users/es.yml
index 680a520e8df..6a1674cfefc 100644
--- a/config/locales/users/es.yml
+++ b/config/locales/users/es.yml
@@ -14,6 +14,7 @@ es:
         dirección, fecha de nacimiento y número de Seguro Social de nuestro sistema."
       bullet_3: Usted no podrá tener acceso seguro a su información usando %{app}
       heading: "¿Está seguro que desea eliminar su cuenta?"
+      instructions: Ingrese su contraseña para confirmar que desea eliminar su cuenta.
       subheading: Si elimina su cuenta
     personal_key:
       close: Cerrar
diff --git a/config/locales/users/fr.yml b/config/locales/users/fr.yml
index 42dc3968c74..53dbcd73a58 100644
--- a/config/locales/users/fr.yml
+++ b/config/locales/users/fr.yml
@@ -16,6 +16,8 @@ fr:
       bullet_3: Vous ne pourrez pas accéder en toute sécurité à vos informations en
         utilisant %{app}.
       heading: Êtes-vous sûr de vouloir supprimer votre compte?
+      instructions: Saisissez votre mot de passe pour confirmer que vous souhaitez
+        supprimer votre compte.
       subheading: Si vous supprimez votre compte
     personal_key:
       close: Fermer
diff --git a/config/routes.rb b/config/routes.rb
index 9620716cd2f..ba200a6f61e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -146,7 +146,7 @@
     get '/account' => 'accounts#show'
     get '/account/devices/:id/events' => 'events#show', as: :account_events
     get '/account/delete' => 'users/delete#show', as: :account_delete
-    delete '/account/delete' => 'users/delete#delete'
+    post '/account/delete' => 'users/delete#delete'
     get '/account/reactivate/start' => 'reactivate_account#index', as: :reactivate_account
     put '/account/reactivate/start' => 'reactivate_account#update'
     get '/account/reactivate/verify_password' => 'users/verify_password#new', as: :verify_password
diff --git a/config/service_providers.localdev.yml b/config/service_providers.localdev.yml
index 3c6709d5164..ee0d968a79b 100644
--- a/config/service_providers.localdev.yml
+++ b/config/service_providers.localdev.yml
@@ -95,6 +95,11 @@ test:
     sp_initiated_login_url: 'http://test.host/test/saml'
     friendly_name: 'Test SP'
     allow_prompt_login: true
+    deal_id: 'ABC123'
+    launch_date: '2020-03-01'
+    iaa: 'ABC123-2020'
+    iaa_start_date: '2020-01-01'
+    iaa_end_date: '2020-12-31'
 
   'urn:gov:gsa:openidconnect:test':
     redirect_uris:
diff --git a/db/migrate/20180723091143_add_phone_confirmed_to_otp_requests_tracker.rb b/db/migrate/20180723091143_add_phone_confirmed_to_otp_requests_tracker.rb
new file mode 100644
index 00000000000..bf2f675ece7
--- /dev/null
+++ b/db/migrate/20180723091143_add_phone_confirmed_to_otp_requests_tracker.rb
@@ -0,0 +1,16 @@
+class AddPhoneConfirmedToOtpRequestsTracker < ActiveRecord::Migration[5.1]
+  disable_ddl_transaction!
+
+  def up
+    add_column :otp_requests_trackers, :phone_confirmed, :boolean
+    change_column_default :otp_requests_trackers, :phone_confirmed, false
+    add_index :otp_requests_trackers, ["phone_fingerprint","phone_confirmed"], name: "index_on_phone_and_confirmed", unique: true, algorithm: :concurrently
+    remove_index :otp_requests_trackers, ["phone_fingerprint"]
+  end
+
+  def down
+    remove_index :otp_requests_trackers, ["phone_fingerprint","phone_confirmed"]
+    remove_column :otp_requests_trackers, :phone_confirmed
+    add_index :otp_requests_trackers, ["phone_fingerprint"], unique: true
+  end
+end
diff --git a/db/migrate/20200508192702_add_deal_data_to_service_providers.rb b/db/migrate/20200508192702_add_deal_data_to_service_providers.rb
new file mode 100644
index 00000000000..2b62bb0a6f0
--- /dev/null
+++ b/db/migrate/20200508192702_add_deal_data_to_service_providers.rb
@@ -0,0 +1,9 @@
+class AddDealDataToServiceProviders < ActiveRecord::Migration[5.2]
+  def change
+    add_column :service_providers, :deal_id, :string
+    add_column :service_providers, :launch_date, :date
+    add_column :service_providers, :iaa, :string
+    add_column :service_providers, :iaa_start_date, :date
+    add_column :service_providers, :iaa_end_date, :date
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 783aeacc9ae..0bec6e60691 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2020_04_21_124317) do
+ActiveRecord::Schema.define(version: 2020_05_08_192702) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -281,7 +281,8 @@
     t.string "phone_fingerprint", default: "", null: false
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.index ["phone_fingerprint"], name: "index_otp_requests_trackers_on_phone_fingerprint", unique: true
+    t.boolean "phone_confirmed", default: false
+    t.index ["phone_fingerprint", "phone_confirmed"], name: "index_on_phone_and_confirmed", unique: true
     t.index ["updated_at"], name: "index_otp_requests_trackers_on_updated_at"
   end
 
@@ -432,6 +433,11 @@
     t.integer "ial2_quota"
     t.boolean "liveness_checking_required"
     t.string "remote_logo_key"
+    t.string "deal_id"
+    t.date "launch_date"
+    t.string "iaa"
+    t.date "iaa_start_date"
+    t.date "iaa_end_date"
     t.index ["issuer"], name: "index_service_providers_on_issuer", unique: true
   end
 
diff --git a/package.json b/package.json
index ff2a96eb47d..18e5c5cc729 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "libphonenumber-js": "^1.7.26",
     "normalize.css": "^4.2.0",
     "sinon": "^1.17.7",
-    "webpack-dev-server": "^3.10.3",
+    "webpack-dev-server": "^3.11.0",
     "zxcvbn": "^4.4.2"
   },
   "devDependencies": {
diff --git a/production.Dockerfile b/production.Dockerfile
index 62dbea3656f..a6ac762088a 100644
--- a/production.Dockerfile
+++ b/production.Dockerfile
@@ -22,6 +22,8 @@ COPY --chown=appuser:appuser --from=build /upaya .
 
 # Copy in whole source (minus items matched in .dockerignore)
 COPY --chown=appuser:appuser . .
+COPY --chown=appuser:appuser --from=build /usr/local/bundle/config /usr/local/bundle
+
 
 # Up to this point we've been root, change to a lower priv. user
 USER appuser
diff --git a/scripts/load_testing/foney.py b/scripts/load_testing/foney.py
deleted file mode 100644
index b45f93054da..00000000000
--- a/scripts/load_testing/foney.py
+++ /dev/null
@@ -1,64 +0,0 @@
-# thanks to https://gist.github.com/ifnull/a32fcc90cd60f6e85b57
-
-
-def area_codes(count_start=200, count=1000):
-    """
-    NPA (Area Code) Rules:
-    http://www.nanpa.com/area_codes/index.html
-    * Starts with [2-9].
-    * Does not end in 11 (N11).
-    * Does not end in 9* (N9X).
-    * Does not start with 37 (37X).
-    * Does not start with 96 (96X).
-    * Does not contain ERC (Easily Recognizable
-      Codes) AKA last two digits aren't the same.
-    """
-    npa = []
-
-    for x in range(count_start, count):
-        s = str(x)
-        # N11
-        if s[1:] == '11':
-            continue
-        # N9X
-        if s[1:-1] == '9':
-            continue
-        # 37X/96X
-        if s[:2] == '37' or s[:2] == '96':
-            continue
-        # ERC
-        if s[1:2] == s[2:3]:
-            continue
-        npa.append(x)
-
-    return npa
-
-
-def prefixes(count_start=200, count=1000):
-    """
-    CO (Prefix) Rules:
-    * Starts with [2-9].
-    * Does not end with 11 (N11).
-    """
-    co = []
-
-    for x in range(count_start, count):
-        s = str(x)
-        # N11
-        if s[1:] == '11':
-            continue
-        co.append(x)
-
-    return co
-
-
-def phone_numbers(npa=206, count_start=1, count=1000):
-    pns = []
-
-    for co in prefixes():
-        for sub in range(count_start, count):
-            sub = "%04d" % sub
-            pn = '{0}{1}{2}'.format(npa, co, sub)
-            pns.append(pn)
-
-    return pns
diff --git a/scripts/load_testing/locustfile.py b/scripts/load_testing/locustfile.py
deleted file mode 100644
index 1ad221df885..00000000000
--- a/scripts/load_testing/locustfile.py
+++ /dev/null
@@ -1,609 +0,0 @@
-import os
-import pdb
-from random import randint
-
-from faker import Factory
-import locust
-import pyquery
-
-import foney
-
-import datetime
-
-fake = Factory.create()
-phone_numbers = foney.phone_numbers()
-
-username, password = os.getenv('AUTH_USER'), os.getenv('AUTH_PASS')
-auth = (username, password) if username and password else ()
-
-# This should match however many users were created
-# for the DB by the rake task.
-NUM_USERS = 1000
-
-
-def random_cred():
-    """
-    Given the rake task:
-    rake dev:random_users NUM_USERS=1000 SCRYPT_COST='800$8$1$'
-
-    We should have 1000 existing users with credentials matching:
-    * email address testuser1@example.com through testuser1000@example.com
-    * the password "salty pickles"
-    * a phone number between +1 (415) 555-0001 and +1 (415) 555-1000.
-
-    This will generate a set of credentials to match one of those entries.
-    Note that YOU MUST run the rake task to put these users in the DB first.
-
-    """
-    return {
-        'email': 'testuser{}@example.com'.format(randint(1, NUM_USERS-1)),
-        'password': "salty pickles"
-    }
-
-
-def authenticity_token(dom, id=None):
-    """
-    Retrieves the CSRF auth token from the DOM for submission.
-    If you need to differentiate between multiple CSRF tokens on one page,
-    pass the optional ID of the parent form (with hash)
-    """
-    selector = 'input[name="authenticity_token"]:first'
-
-    if id:
-        selector = '{} {}'.format(id, selector)
-    return dom.find(selector).attr('value')
-
-
-def resp_to_dom(resp):
-    """
-    Little helper to check response status is 200
-    and return the DOM, cause we do that a lot.
-    """
-    resp.raise_for_status()
-    return pyquery.PyQuery(resp.content)
-
-
-def login(t, credentials):
-    """
-    Takes a locustTask object and signs you in.
-    """
-    with t.client.get('/', catch_response=True) as resp:
-        # If you're already logged in, it'll redirect to /account.
-        # We need to handle this or you'll get all sorts of
-        # downstream failures.
-        if '/account' in resp.url:
-            print("You're already logged in. We're going to quit login().")
-            return resp
-
-        dom = resp_to_dom(resp)
-        token = authenticity_token(dom)
-
-        if not token:
-            resp.failure(
-                "Not a sign-in page. Current URL is {}.".format(resp.url)
-            )
-
-    resp = t.client.post(
-        resp.url,
-        data={
-            'user[email]': credentials['email'],
-            'user[password]': credentials['password'],
-            'authenticity_token': authenticity_token(dom),
-            'commit': 'Submit',
-        }
-    )
-    dom = resp_to_dom(resp)
-    code = dom.find("#code").attr('value')
-
-    if not code:
-        # if we didn't see the code, then it's probably a failed login
-        # due to un-reset credentials.
-        # So let's try to rescue with the alternate pass.
-        repost_resp = t.client.post(
-            resp.url,
-            data={
-                'user[email]': credentials['email'],
-                'user[password]': 'thisisanewpass',
-                'authenticity_token': authenticity_token(dom),
-                'commit': 'Submit',
-            },
-            catch_response=True
-        )
-        with repost_resp as resp:
-            dom = resp_to_dom(resp)
-            code = dom.find("#code").attr('value')
-
-            # If we still don't have code, we have a bigger problem.
-            if not code:
-                resp.failure(
-                    """
-                    No 2FA code found after two tries.
-                    Make sure {} is in the DB.
-                    """.format(credentials)
-                )
-                return
-
-    code_form = dom.find("form[action='/login/two_factor/sms']")
-    resp = t.client.post(
-        code_form.attr('action'),
-        data={
-            'code': code,
-            'authenticity_token': authenticity_token(dom),
-            'commit': 'Submit'
-        }
-    )
-    # We're not checking for post-login state here,
-    # as it will vary depending on the SP.
-    resp.raise_for_status()
-    return resp
-
-
-def logout(t, page="/"):
-    """
-    Takes a locustTask object and signs you out.
-    Naively assumes the user is actually logged in already.
-    """
-    with t.client.get(page, catch_response=True) as resp:
-        dom = resp_to_dom(resp)
-        sign_out_link = dom.find('a[href="/api/saml/logout"]').attr('href')
-        if not sign_out_link:
-            resp.failure("No signout link at {}.".format(resp.url))
-            return
-    # Authentication is now complete.
-    # We've confirmed by the presence of the sign-out link.
-    # We can now have the person sign out.
-    resp = t.client.get(sign_out_link)
-    resp.raise_for_status()
-
-
-def change_pass(t, password):
-    """
-    Takes a locustTask and naively expects an already logged in person,
-    this navigates to the account (which they should already be on, post-login)
-    """
-    resp = t.client.get('/account')
-    dom = resp_to_dom(resp)
-    edit_link = dom.find('a[href="/manage/password"]')
-
-    try:
-        resp = t.client.get(edit_link[0].attrib['href'])
-    except Exception as error:
-        resp.failure(
-            """
-            There was a problem finding the edit pass link: {}
-            You may be hitting an OTP cap with this user,
-            or did not run the rake task to generate users.
-            Since we can't change the password, we'll exit.
-            Here is the content we're seeing at {}: {}
-            """.format(error, resp.url, dom('.container').eq(0).text())
-        )
-        return
-
-    dom = resp_to_dom(resp)
-    # To keep it simple for now we're skipping reauthn
-    if '/manage/password' in resp.url:
-        resp = t.client.post(
-            resp.url,
-            data={
-                'update_user_password_form[password]': password,
-                'authenticity_token': authenticity_token(dom),
-                '_method': 'patch',
-                'commit': 'update'
-            }
-        )
-        resp.raise_for_status()
-    else:
-        # To-do: handle reauthn case
-        resp.failure("Wrong redirect. Currently at {}".format(resp.url))
-
-
-def signup(t, signup_url=None):
-    """
-    Creates a new account, starting at the home page,
-    then navigating to create account page and submit email
-
-    We're checking for signup_url to pass name and group results
-    """
-    new_email = 'test+{}@test.com'.format(fake.md5())
-    default_password = "salty pickles"
-
-    if signup_url:
-        t.client.get(
-            signup_url,
-            auth=auth,
-            name="/sign_up/start?request_id"
-        )
-    else:
-        t.client.get('/sign_up/start', auth=auth)
-    resp = t.client.get('/sign_up/enter_email', auth=auth)
-    dom = resp_to_dom(resp)
-
-    email_resp = t.client.post(
-        '/sign_up/enter_email',
-        data={
-            'user[email]': new_email,
-            'authenticity_token': authenticity_token(dom),
-            'commit': 'Submit',
-        },
-        auth=auth,
-        catch_response=True
-    )
-    with email_resp as resp:
-        dom = resp_to_dom(resp)
-
-        try:
-            link = dom.find("a[href*='confirmation_token']")[0].attrib['href']
-        except IndexError:
-            if '/account' in resp.url:
-                resp.failure(
-                    """
-                    Account appears to already be signed up and logged in.
-                    Current URL: {}.
-                    """.format(resp.url)
-                )
-            else:
-                resp.failure(
-                    """
-                    Failed to get confirmation token.
-                    Consult https://github.com/18F/identity-idp#load-testing
-                    and check your application config. Current URL:
-                    """.format(resp.url)
-                )
-            return
-
-    # Follow email confirmation link and submit password
-    resp = t.client.get(
-        link,
-        auth=auth,
-        name='/sign_up/email/confirm?confirmation_token='
-    )
-    dom = resp_to_dom(resp)
-    token = dom.find('[name="confirmation_token"]:first').attr('value')
-
-    # Got to password page and submit
-    resp = t.client.post(
-        '/sign_up/create_password',
-        data={
-            'password_form[password]': default_password,
-            'authenticity_token': authenticity_token(dom),
-            'confirmation_token': token,
-            'commit': 'Submit',
-        },
-        auth=auth
-    )
-
-    # After password creation, resp.url should be  /phone_setup
-    # Now we have to get this page, then extract the correct auth token
-    # so we can then turn around and post the confirmation token back.
-    resp = t.client.get(resp.url)
-    dom = resp_to_dom(resp)
-    auth_token = authenticity_token(dom, '#new_new_phone_form')
-
-    # Now post with the correct tokens
-    phone_post = t.client.post(
-        resp.url,
-        data={
-            '_method': 'patch',
-            'new_phone_form[international_code]': 'US',
-            'new_phone_form[phone]': phone_numbers[randint(1, 1000)],
-            'new_phone_form[otp_delivery_preference]': 'sms',
-            'authenticity_token': auth_token,
-            'commit': 'Send security code',
-        },
-        auth=auth,
-        catch_response=True
-    )
-
-    with phone_post as resp:
-        dom = resp_to_dom(resp)
-        try:
-            otp_code = dom.find('input[name="code"]')[0].attrib['value']
-        except Exception as error:
-            resp.failure(
-                "There was a problem with the OTP code: {}.".format(error))
-            return
-
-    # visit security code page and submit pre-filled OTP
-    resp = t.client.post(
-        '/login/two_factor/sms',
-        data={
-            'code': otp_code,
-            'authenticity_token': authenticity_token(dom),
-            'commit': 'Submit',
-        },
-        auth=auth
-    )
-    dom = resp_to_dom(resp)
-    key = dom.find('.my4.border-box.separator-text').text()
-
-    # Clicking "Continue" on key page triggers a modal, to which we post:
-    resp = t.client.post(
-        '/sign_up/personal_key',
-        data={
-            'authenticity_token': authenticity_token(dom, '#confirm-key'),
-            'personal_key': key,
-            'commit': 'Continue'
-        },
-        auth=auth
-    )
-    # We should now be fully signed in and will return
-    # credentials + final page in case we with to log in again.
-    return {
-        'email': new_email,
-        'password': default_password,
-        'final_resp': resp
-    }
-
-
-class UserBehavior(locust.TaskSet):
-
-    def on_start(self):
-        pass
-
-    @locust.task(1)
-    def idp_change_pass(self):
-        """
-        Login, change pass, change it back and logout from IDP.
-
-        This is given a very low weight, since we do not expect
-        it to be a common pattern in the real world.
-        """
-        credentials = random_cred()
-        login(self, credentials)
-        change_pass(self, "thisisanewpass")
-        # now change it back.
-        change_pass(self, credentials['password'])
-        logout(self)
-
-    @locust.task(50)
-    def idp_login_logout(self):
-        """
-        Login and logout from IDP. Very simple, but very common.
-        """
-        credentials = random_cred()
-        login(self, credentials)
-        logout(self)
-
-    @locust.task(10)
-    def idp_create_account(self):
-        """
-        Create an account from within the IDP.
-
-        This has a low weight because it's uncommon in the real world.
-        """
-        new_account = signup(self)
-        logout(self, new_account['final_resp'].url)
-
-    @locust.task(2)
-    def sp_rails_change_pass(self):
-        """
-        Login, change pass, change it back and logout from
-        sp-rails sample app.
-
-        This is given a very low weight, since we do not expect
-        it to be a common pattern in the real world.
-        """
-        resp = self.client.get('http://localhost:3003')
-        dom = resp_to_dom(resp)
-
-        """
-        # TO-DO: submit the LOA1/LOA3 form
-        # We can't do this from form action yet, because there's a mismatch
-        # in handling the trailing slash on host in locust and elsewhere:
-        # in requests/models.py", line 371, in prepare_url
-        #     scheme, auth, host, port, path, query, fragment = parse_url(url)
-        # results in localhost:3000auth rather than localhost:3000/auth/saml/
-        # Until we get that sorted out, this will need to be commented out
-        # and we'll manually go to the IPD url.
-
-        resp = self.client.post(
-            dom.find("form").eq(0).attr('action'),
-            data = {
-                'loa': 1,
-                'authenticity_token': authenticity_token(dom)
-            }
-        )
-        # For now, we're taking advantage of login() going to host + /sign_in
-        """
-        credentials = random_cred()
-        login(self, credentials)
-        change_pass(self, "thisisanewpass")
-        # now change it back.
-        change_pass(self, credentials['password'])
-        logout(self)
-
-    #@locust.task(10)
-    def usajobs_change_pass(self):
-        """
-        Login, change pass, change it back and logout from USAjobs.
-        """
-        root_url = 'https://www.test.usajobs.gov'
-        with self.client.get(root_url, catch_response=True) as resp:
-            dom = resp_to_dom(resp)
-            signin_link = dom.find(
-                'a.user-logged-out[href="/Applicant/ProfileDashboard/Home"]'
-            ).eq(0)
-
-            if not signin_link:
-                resp.failure(
-                    "We could not find a signin link at {}".format(resp.url))
-
-        transition_resp = self.client.get(
-            root_url + signin_link[0].attrib['href'],
-            catch_response=True
-        )
-        with transition_resp as resp:
-            if resp.status_code is not 200:
-                resp.failure(
-                    "Bad {} response at {} with headers {}. Response:".format(
-                        resp.status_code, resp.url, resp.headers, resp.content
-                    )
-                )
-            # we should have been redirected to
-            # https://login.test.usajobs.gov/Access/Transition.
-            # Let's do a quick check.
-            if "login.test.usajobs.gov/Access/Transition" not in resp.url:
-                resp.failure(
-                    """"
-                    We do not appear to have been redirected to
-                    https://login.test.usajobs.gov/Access/Transition.
-                    Our current URL is {}, with content {}.
-                    """.format(resp.url, resp.content)
-                )
-                return
-        # Now that we've confirmed we're at the right URL
-        # we need to POST to it, per USAjobs.
-        handshake_post = self.client.post(
-            resp.url,
-            data={},
-            name="/Access/Transition",
-            catch_response=True
-        )
-        with handshake_post as resp:
-            # Check to make sure we redirected to our target host,
-            # with a request_id in resp.url
-            if resp.url is not os.getenv('TARGET_HOST'):
-                resp.failure(
-                    """"
-                    We do not appear to have been redirected to the IDP host.
-                    Instead, we are at {}.
-                    """.format(resp.url)
-                )
-                return
-        credentials = random_cred()
-        login(self, credentials)
-        change_pass(self, "thisisanewpass")
-        change_pass(self, credentials['password'])
-        logout(self)
-
-    #@locust.task(70)
-    def usajobs_login_logout(self):
-        """
-        Login andlogout from USAjobs.
-
-        This is a very common task and is heavily weighted.
-         """
-        root_url = 'https://www.test.usajobs.gov'
-        with self.client.get(root_url, catch_response=True) as resp:
-            dom = resp_to_dom(resp)
-            signin_link = dom.find(
-                'a.user-logged-out[href="/Applicant/ProfileDashboard/Home"]'
-            ).eq(0)
-
-            if not signin_link:
-                resp.failure(
-                    "We could not find a signin link at {}".format(resp.url)
-                )
-
-        sign_in_resp = self.client.get(
-            root_url + signin_link[0].attrib['href'],
-            catch_response=True
-        )
-        with sign_in_resp as resp:
-            if resp.status_code is not 200:
-                resp.failure(
-                    "Bad {} response at {} with headers {}. Response:".format(
-                        resp.status_code, resp.url, resp.headers, resp.content
-                    )
-                )
-            # we should have been redirected to
-            # https://login.test.usajobs.gov/Access/Transition.
-            # Let's do a quick check.
-            if "login.test.usajobs.gov/Access/Transition" not in resp.url:
-                resp.failure(
-                    """"
-                    We do not appear to have been redirected to
-                    https://login.test.usajobs.gov/Access/Transition.
-                    Our current URL is {}, with content {}.
-                    """.format(resp.url, resp.content)
-                )
-                return
-        # Now that we've confirmed we're at the right URL
-        # we need to POST to it, per USAjobs.
-        handshake_post = self.client.post(
-            resp.url,
-            data={},
-            name="/Access/Transition",
-            catch_response=True
-        )
-        with handshake_post as resp:
-            # Check to make sure we redirected to our target host,
-            # with a request_id in resp.url
-            if resp.url is not os.getenv('TARGET_HOST'):
-                resp.failure(
-                    """"
-                    We do not appear to have been redirected to the IDP host.
-                    Instead, we are at {}.
-                    """.format(resp.url)
-                )
-                return
-        credentials = random_cred()
-        login(self, credentials)
-        logout(self)
-
-    #@locust.task(25)
-    def usajobs_create_account(self):
-        """
-        Create an account from within USAjobs test domain.
-
-        This is given a relatively low weight.
-        It's much more common than account creation from within IDP
-        but much lower than a simple login/logout.
-
-        If the os env var "NO_LOGOUT" has been set, this will skip
-        the logout step to help show the load of many open sessions.
-
-        We have disabled method linting because:
-        1. It counts arguments as separate lines
-        2. This is how many steps it takes for the flow.
-        """
-        resp = self.client.get('https://www.test.usajobs.gov/')
-        resp.raise_for_status()
-        dash_response = self.client.get(
-            'https://www.test.usajobs.gov/Applicant/ProfileDashboard/Home',
-            catch_response=True
-        )
-        with dash_response as resp:
-            if resp.status_code is not 200:
-                resp.failure(
-                    "Bad {} response at {} with the headers {}: {}".format(
-                        resp.status_code, resp.url, resp.headers, resp.content
-                    )
-                )
-                resp.raise_for_status()
-        # A quick post is required to setup for the SP handshake.
-        # We'll pass the response url to signup()
-        # Note that you *must* cast to the "with" syntax or
-        # catch_response will do bad, bad things.
-        handshake_post = self.client.post(
-            resp.url,
-            data={},
-            name="/Access/Transition (create)",
-            catch_response=True
-        )
-        with handshake_post as resp:
-            if resp.status_code is not 200:
-                resp.failure(
-                    "Bad {} response at {} with the headers {}".format(
-                        resp.status_code, resp.url, resp.headers
-                    )
-                )
-                resp.raise_for_status()
-            signup(self, resp.url)
-
-        # Unless we said not to, sign out now.
-        if "NO_LOGOUT" in os.environ:
-            print("Found 'NO_LOGOUT' in env vars. Skipping logout.")
-        else:
-            logout(self)
-
-
-class WebsiteUser(locust.HttpLocust):
-    task_set = UserBehavior
-    min_wait = 50
-    max_wait = 100
-    host = os.getenv('TARGET_HOST') or 'http://localhost:3000'
-
-
-if __name__ == '__main__':
-    WebsiteUser().run()
diff --git a/scripts/load_testing/requirements.txt b/scripts/load_testing/requirements.txt
deleted file mode 100644
index 20bfef0bb13..00000000000
--- a/scripts/load_testing/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Faker==0.7.9
-locustio==0.8a2
-pyquery==1.2.17
diff --git a/spec/controllers/idv/scan_id_acuant_controller_spec.rb b/spec/controllers/idv/scan_id_acuant_controller_spec.rb
index 302a03bff11..388739ecbbf 100644
--- a/spec/controllers/idv/scan_id_acuant_controller_spec.rb
+++ b/spec/controllers/idv/scan_id_acuant_controller_spec.rb
@@ -6,6 +6,7 @@
   before do |test|
     stub_sign_in unless test.metadata[:skip_sign_in]
     allow(Figaro.env).to receive(:enable_mobile_capture).and_return('true')
+    allow(Figaro.env).to receive(:liveness_checking_enabled).and_return('true')
   end
 
   describe '#field_image' do
diff --git a/spec/controllers/users/delete_controller_spec.rb b/spec/controllers/users/delete_controller_spec.rb
index 5cfa25fbd1e..3f64933108d 100644
--- a/spec/controllers/users/delete_controller_spec.rb
+++ b/spec/controllers/users/delete_controller_spec.rb
@@ -4,8 +4,13 @@
   include Features::MailerHelper
 
   describe '#show' do
-    it 'shows' do
+    it 'shows and logs a visit' do
+      stub_analytics
       stub_signed_in_user
+
+      expect(@analytics).to receive(:track_event).
+        with(Analytics::ACCOUNT_DELETE_VISITED)
+
       get :show
 
       expect(response).to render_template(:show)
@@ -13,19 +18,58 @@
   end
 
   describe '#delete' do
+    let(:password) { ControllerHelper::VALID_PASSWORD }
+    subject(:delete) { post :delete, params: { user: { password: password } } }
+
+    context 'with an incorrect password' do
+      let(:password) { 'wrong' }
+
+      it 'flashes a banner and renders the form' do
+        stub_signed_in_user
+        delete
+        expect(response).to render_template(:show)
+        expect(flash[:error]).to eq(t('idv.errors.incorrect_password'))
+      end
+
+      it 'does not delete the user' do
+        stub_signed_in_user
+        expect { delete }.to_not change(User, :count)
+      end
+
+      it 'logs a failed submit' do
+        stub_analytics
+        stub_signed_in_user
+
+        expect(@analytics).to receive(:track_event).
+          with(Analytics::ACCOUNT_DELETE_SUBMITTED, success: false)
+
+        delete
+      end
+    end
+
     it 'redirects to the root path' do
       stub_signed_in_user
-      post :delete
+      delete
       expect(response).to redirect_to root_url
     end
 
     it 'deletes user' do
       user = stub_signed_in_user
       expect(User.where(id: user.id).length).to eq(1)
-      post :delete
+      delete
       expect(User.where(id: user.id).length).to eq(0)
     end
 
+    it 'logs a succesful submit' do
+      stub_analytics
+      stub_signed_in_user
+
+      expect(@analytics).to receive(:track_event).
+        with(Analytics::ACCOUNT_DELETE_SUBMITTED, success: true)
+
+      delete
+    end
+
     it 'does not delete identities to prevent uuid reuse' do
       user = stub_signed_in_user
       user.identities << Identity.create(
@@ -33,21 +77,24 @@
         last_authenticated_at: Time.zone.now,
       )
       expect(Identity.where(user_id: user.id).length).to eq(1)
-      post :delete
+      delete
       expect(Identity.where(user_id: user.id).length).to eq(1)
     end
 
     it 'deletes profile information for ial2' do
-      profile = create(:profile, :active, :verified, pii: { ssn: '1234', dob: '1920-01-01' })
-      stub_sign_in(profile.user)
+      user = stub_sign_in
+      create(:profile, :active, :verified, user: user, pii: { ssn: '1234', dob: '1920-01-01' })
       expect(Profile.count).to eq(1)
-      post :delete
+      delete
       expect(Profile.count).to eq(0)
     end
   end
 
   def stub_signed_in_user
-    user = create(:user, :signed_up, email: 'old_email@example.com')
+    user = create(:user,
+                  :signed_up,
+                  email: 'old_email@example.com',
+                  password: ControllerHelper::VALID_PASSWORD)
     stub_sign_in(user)
   end
 end
diff --git a/spec/controllers/users/two_factor_authentication_controller_spec.rb b/spec/controllers/users/two_factor_authentication_controller_spec.rb
index 6f28fbb9174..a8e246d69e2 100644
--- a/spec/controllers/users/two_factor_authentication_controller_spec.rb
+++ b/spec/controllers/users/two_factor_authentication_controller_spec.rb
@@ -191,10 +191,10 @@ def index
 
       it 'calls OtpRateLimiter#exceeded_otp_send_limit? and #increment' do
         otp_rate_limiter = instance_double(OtpRateLimiter)
-        allow(OtpRateLimiter).to receive(:new).with(
-          phone: MfaContext.new(@user).phone_configurations.first.phone,
-          user: @user,
-        ).and_return(otp_rate_limiter)
+        allow(OtpRateLimiter).to receive(:new).
+          with(phone: MfaContext.new(@user).phone_configurations.first.phone,
+               user: @user, phone_confirmed: true).
+          and_return(otp_rate_limiter)
 
         expect(otp_rate_limiter).to receive(:exceeded_otp_send_limit?).twice
         expect(otp_rate_limiter).to receive(:increment)
diff --git a/spec/features/idv/doc_auth/selfie_step_spec.rb b/spec/features/idv/doc_auth/selfie_step_spec.rb
new file mode 100644
index 00000000000..742f54c151d
--- /dev/null
+++ b/spec/features/idv/doc_auth/selfie_step_spec.rb
@@ -0,0 +1,32 @@
+require 'rails_helper'
+
+feature 'doc auth self image step' do
+  include IdvStepHelper
+  include DocAuthHelper
+
+  before do
+    allow(Figaro.env).to receive(:liveness_checking_enabled).and_return('true')
+    sign_in_and_2fa_user
+    complete_doc_auth_steps_before_ssn_step
+  end
+
+  it 'is on the correct page' do
+    expect(page).to have_current_path(idv_doc_auth_selfie_step)
+  end
+
+  it 'proceeds to the next page with valid info' do
+    attach_image
+    click_idv_continue
+
+    expect(page).to have_current_path(idv_doc_auth_ssn_step)
+  end
+
+  it 'restarts doc auth upon failure' do
+    allow_any_instance_of(Acuant::Liveness).to receive(:call).and_return(nil)
+    attach_image
+    click_idv_continue
+
+    expect(page).to have_current_path(idv_doc_auth_front_image_step)
+    expect(page).to have_content(t('errors.doc_auth.selfie'))
+  end
+end
diff --git a/spec/features/phone/rate_limitting_spec.rb b/spec/features/phone/rate_limitting_spec.rb
index d49c7a1e092..fe850428f07 100644
--- a/spec/features/phone/rate_limitting_spec.rb
+++ b/spec/features/phone/rate_limitting_spec.rb
@@ -17,21 +17,6 @@ def visit_otp_confirmation(delivery_method)
     end
   end
 
-  context 'on sign in' do
-    let(:user) { create(:user, :signed_up) }
-
-    it_behaves_like 'phone rate limitting', :sms
-    it_behaves_like 'phone rate limitting', :voice
-
-    def visit_otp_confirmation(delivery_method)
-      user.phone_configurations.first.update!(
-        phone: PhoneFormatter.format(phone),
-        delivery_preference: delivery_method,
-      )
-      sign_in_user(user)
-    end
-  end
-
   context 'on add phone' do
     let(:user) { create(:user, :signed_up) }
 
diff --git a/spec/features/remember_device/user_opted_preference.rb b/spec/features/remember_device/user_opted_preference.rb
index 412637a86b1..a5d0610498d 100644
--- a/spec/features/remember_device/user_opted_preference.rb
+++ b/spec/features/remember_device/user_opted_preference.rb
@@ -34,7 +34,7 @@
       before do
         user = sign_in_user
         mock_webauthn_setup_challenge
-        select_2fa_option('webauthn')
+        select_2fa_option('webauthn', visible: :all)
 
         allow(WebauthnSetupForm).to receive(:domain_name).and_return('localhost:3000')
 
diff --git a/spec/features/remember_device/webauthn_spec.rb b/spec/features/remember_device/webauthn_spec.rb
index 79c762a79e5..d986388f041 100644
--- a/spec/features/remember_device/webauthn_spec.rb
+++ b/spec/features/remember_device/webauthn_spec.rb
@@ -39,7 +39,8 @@ def remember_device_and_sign_out_user
       user = sign_up_and_set_password
       user.password = Features::SessionHelper::VALID_PASSWORD
 
-      select_2fa_option('webauthn')
+      # webauthn option is hidden in browsers that don't support it
+      select_2fa_option('webauthn', visible: :all)
       fill_in_nickname_and_click_continue
       check :remember_device
       mock_press_button_on_hardware_key_on_setup
diff --git a/spec/features/saml/multiple_endpoints_spec.rb b/spec/features/saml/multiple_endpoints_spec.rb
index a7ead4b3e77..830440c2648 100644
--- a/spec/features/saml/multiple_endpoints_spec.rb
+++ b/spec/features/saml/multiple_endpoints_spec.rb
@@ -81,7 +81,7 @@
       expect(cert_base64).to eq(Base64.strict_encode64(endpoint_cert.to_der))
     end
 
-    it 'includes the correct auth and logout urls' do
+    it 'includes the correct auth url, and no SingleLogoutService urls' do
       visit endpoint_metadata_path
       document = REXML::Document.new(page.html)
       auth_node = REXML::XPath.first(document, '//SingleSignOnService')
@@ -90,9 +90,8 @@
       expect(auth_node.attributes['Location']).to include(
         ['/api/saml/auth', endpoint_suffix].join(''),
       )
-      expect(logout_node.attributes['Location']).to include(
-        ['/api/saml/logout', endpoint_suffix].join(''),
-      )
+
+      expect(logout_node).to be_nil
     end
   end
 end
diff --git a/spec/features/sp_cost_tracking_spec.rb b/spec/features/sp_cost_tracking_spec.rb
index ef73a9bc958..d1ac8733475 100644
--- a/spec/features/sp_cost_tracking_spec.rb
+++ b/spec/features/sp_cost_tracking_spec.rb
@@ -32,6 +32,42 @@
     expect_sp_cost_type(6, 2, 'authentication')
   end
 
+  it 'logs the cost to the SP for reproofing' do
+    create_ial2_user_from_sp(email)
+
+    # track costs without dealing with 'remember device'
+    Capybara.reset_session!
+
+    user = User.find_with_email(email)
+    user.active_profile.update!(verified_at: 60.days.ago)
+
+    visit_idp_from_sp_with_ial2(:oidc, verified_within: '45d')
+    fill_in_credentials_and_submit(user.email, password)
+    fill_in_code_with_last_phone_otp
+    click_submit_default
+    complete_all_doc_auth_steps
+    click_continue
+    fill_in 'Password', with: password
+    click_continue
+    click_acknowledge_personal_key
+    click_agree_and_continue
+
+    %w[
+      acuant_front_image
+      acuant_back_image
+      lexis_nexis_resolution
+      lexis_nexis_address
+    ].each do |cost_type|
+      sp_costs = SpCost.where(cost_type: cost_type)
+      expect(sp_costs.count).to eq(2)
+      sp_costs.each do |sp_cost|
+        expect(sp_cost.ial).to eq(2)
+        expect(sp_cost.issuer).to eq(issuer)
+        expect(sp_cost.agency_id).to eq(agency_id)
+      end
+    end
+  end
+
   it 'logs the correct costs for an ial1 authentication' do
     create_ial1_user_from_sp(email)
     SpCost.delete_all
diff --git a/spec/features/two_factor_authentication/change_factor_spec.rb b/spec/features/two_factor_authentication/change_factor_spec.rb
index 73bee409704..fd35eb55fc6 100644
--- a/spec/features/two_factor_authentication/change_factor_spec.rb
+++ b/spec/features/two_factor_authentication/change_factor_spec.rb
@@ -49,15 +49,6 @@
         end
       end
     end
-
-    scenario 'deleting account' do
-      visit account_delete_path
-
-      expect(page).to have_content t('help_text.no_factor.delete_account')
-      complete_2fa_confirmation
-
-      expect(current_path).to eq account_delete_path
-    end
   end
 
   def complete_2fa_confirmation
diff --git a/spec/features/two_factor_authentication/sign_in_spec.rb b/spec/features/two_factor_authentication/sign_in_spec.rb
index d212a7f476c..5386ffb0ecf 100644
--- a/spec/features/two_factor_authentication/sign_in_spec.rb
+++ b/spec/features/two_factor_authentication/sign_in_spec.rb
@@ -263,7 +263,9 @@ def attempt_to_bypass_2fa
                otp_delivery_preference: 'voice',
                with: { phone: '+12255551000', delivery_preference: 'voice' })
       end
-      let(:otp_rate_limiter) { OtpRateLimiter.new(user: user, phone: '+12255551000') }
+      let(:otp_rate_limiter) do
+        OtpRateLimiter.new(user: user, phone_confirmed: true, phone: '+12255551000')
+      end
 
       it 'does not change their OTP delivery preference' do
         allow(OtpRateLimiter).to receive(:new).and_return(otp_rate_limiter)
diff --git a/spec/features/users/regenerate_personal_key_spec.rb b/spec/features/users/regenerate_personal_key_spec.rb
index 38b35f29385..ab682eb876c 100644
--- a/spec/features/users/regenerate_personal_key_spec.rb
+++ b/spec/features/users/regenerate_personal_key_spec.rb
@@ -79,8 +79,7 @@
 
       expect_confirmation_modal_to_appear_with_first_code_field_in_focus
 
-      expected_button_order = %w[Back Continue]
-      expect(all(:button).map(&:text).reject(&:empty?)).to eq expected_button_order
+      expect(page).to have_selector(:link_or_button, 'Back')
 
       click_back_button
 
@@ -106,8 +105,8 @@
       click_acknowledge_personal_key
 
       expect_confirmation_modal_to_appear_with_first_code_field_in_focus
-      expected_button_order = %w[Continue Back]
-      expect(all(:button).map(&:text).reject(&:empty?)).to eq expected_button_order
+
+      expect(page).to have_selector(:link_or_button, 'Back')
 
       click_back_button
 
diff --git a/spec/features/users/user_profile_spec.rb b/spec/features/users/user_profile_spec.rb
index bfb99b42b71..0b00385f4c7 100644
--- a/spec/features/users/user_profile_spec.rb
+++ b/spec/features/users/user_profile_spec.rb
@@ -31,6 +31,7 @@
       expect(User.count).to eq 1
       expect(AgencyIdentity.count).to eq 1
 
+      fill_in(t('idv.form.password'), with: Features::SessionHelper::VALID_PASSWORD)
       click_button t('users.delete.actions.delete')
       expect(page).to have_content t('devise.registrations.destroyed')
       expect(current_path).to eq root_path
@@ -59,6 +60,7 @@
         },
       )
 
+      fill_in(t('idv.form.password'), with: Features::SessionHelper::VALID_PASSWORD)
       click_button t('users.delete.actions.delete')
       expect(request).to have_been_requested
     end
@@ -74,6 +76,7 @@
       expect(User.count).to eq 1
       expect(Profile.count).to eq 1
 
+      fill_in(t('idv.form.password'), with: profile.user.password)
       click_button t('users.delete.actions.delete')
       expect(page).to have_content t('devise.registrations.destroyed')
       expect(current_path).to eq root_path
@@ -89,6 +92,7 @@
       sign_in_live_with_2fa(profile.user)
       visit account_path
       click_link(t('account.links.delete_account'), href: account_delete_path)
+      fill_in(t('idv.form.password'), with: profile.user.password)
       click_button t('users.delete.actions.delete')
 
       expect(User.count).to eq 0
diff --git a/spec/features/visitors/sign_up_with_email_spec.rb b/spec/features/visitors/sign_up_with_email_spec.rb
index eda2b9f653e..2a514f69f1c 100644
--- a/spec/features/visitors/sign_up_with_email_spec.rb
+++ b/spec/features/visitors/sign_up_with_email_spec.rb
@@ -12,7 +12,7 @@
     expect(Funnel::Registration::TotalRegisteredCount.call).to eq(0)
   end
 
-  scenario 'visitor cannot sign up with invalid email address' do
+  scenario 'visitor cannot sign up with invalid email address', js: true do
     sign_up_with('bogus')
     expect_email_invalid(page)
   end
@@ -26,11 +26,11 @@
 
     invalid_addresses.each do |email|
       sign_up_with(email)
-      expect_email_invalid(page)
+      expect(page).to have_content(t('valid_email.validations.email.invalid'))
     end
   end
 
-  scenario 'visitor cannot sign up with empty email address' do
+  scenario 'visitor cannot sign up with empty email address', js: true do
     sign_up_with('')
 
     expect_email_invalid(page)
diff --git a/spec/features/webauthn/hidden_spec.rb b/spec/features/webauthn/hidden_spec.rb
index 5016e791ba2..13858fd594c 100644
--- a/spec/features/webauthn/hidden_spec.rb
+++ b/spec/features/webauthn/hidden_spec.rb
@@ -21,6 +21,7 @@
     def webauthn_option_hidden?
       page.find(
         'label[for=two_factor_options_form_selection_webauthn]',
+        visible: :all,
       )[:class].include?('hide')
     end
   end
diff --git a/spec/features/webauthn/sign_up_spec.rb b/spec/features/webauthn/sign_up_spec.rb
index f459f5775cd..298b2a47a1c 100644
--- a/spec/features/webauthn/sign_up_spec.rb
+++ b/spec/features/webauthn/sign_up_spec.rb
@@ -6,7 +6,8 @@
   let!(:user) { sign_up_and_set_password }
 
   def visit_webauthn_setup
-    select_2fa_option('webauthn')
+    # webauthn option is hidden in browsers that don't support it
+    select_2fa_option('webauthn', visible: :all)
   end
 
   def expect_webauthn_setup_success
diff --git a/spec/models/otp_requests_tracker_spec.rb b/spec/models/otp_requests_tracker_spec.rb
index 2f4d1405ce6..a1a1868425d 100644
--- a/spec/models/otp_requests_tracker_spec.rb
+++ b/spec/models/otp_requests_tracker_spec.rb
@@ -4,29 +4,30 @@
   let(:phone) { '+1 703 555 1212' }
   let(:phone_fingerprint) { Pii::Fingerprinter.fingerprint(phone) }
 
-  describe '.find_or_create_with_phone' do
+  describe '.find_or_create_with_phone_and_confirmed' do
     context 'match found' do
       it 'returns the existing record and does not change it' do
         OtpRequestsTracker.create(
           phone_fingerprint: phone_fingerprint,
+          phone_confirmed: true,
           otp_send_count: 3,
           otp_last_sent_at: Time.zone.now - 1.hour,
         )
 
         existing = OtpRequestsTracker.where(phone_fingerprint: phone_fingerprint).first
 
-        expect { OtpRequestsTracker.find_or_create_with_phone(phone) }.
+        expect { OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone, true) }.
           to_not change(OtpRequestsTracker, :count)
-        expect { OtpRequestsTracker.find_or_create_with_phone(phone) }.
+        expect { OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone, true) }.
           to_not change(existing, :otp_send_count)
-        expect { OtpRequestsTracker.find_or_create_with_phone(phone) }.
+        expect { OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone, true) }.
           to_not change(existing, :otp_last_sent_at)
       end
     end
 
     context 'match not found' do
       it 'creates new record with otp_send_count = 0 and otp_last_sent_at = current time' do
-        expect { OtpRequestsTracker.find_or_create_with_phone(phone) }.
+        expect { OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone, true) }.
           to change(OtpRequestsTracker, :count).by(1)
 
         existing = OtpRequestsTracker.where(phone_fingerprint: phone_fingerprint).first
@@ -43,7 +44,7 @@
           and_raise(ActiveRecord::RecordNotUnique.new(tracker))
 
         expect(OtpRequestsTracker).to receive(:where).exactly(:once)
-        expect { OtpRequestsTracker.find_or_create_with_phone(phone) }.
+        expect { OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone, true) }.
           to raise_error ActiveRecord::RecordNotUnique
       end
     end
@@ -54,6 +55,7 @@
       old_ort = OtpRequestsTracker.create(
         phone_fingerprint: phone_fingerprint,
         otp_send_count: 3,
+        phone_confirmed: true,
         otp_last_sent_at: Time.zone.now - 1.hour,
       )
       new_ort = OtpRequestsTracker.atomic_increment(old_ort.id)
@@ -64,6 +66,7 @@
       old_ort = OtpRequestsTracker.create(
         phone_fingerprint: phone_fingerprint,
         otp_send_count: 3,
+        phone_confirmed: true,
         otp_last_sent_at: Time.zone.now,
       )
       new_ort = OtpRequestsTracker.atomic_increment(old_ort.id)
diff --git a/spec/requests/acuant_sdk_spec.rb b/spec/requests/acuant_sdk_spec.rb
index 0c212520804..ddc9922ff1f 100644
--- a/spec/requests/acuant_sdk_spec.rb
+++ b/spec/requests/acuant_sdk_spec.rb
@@ -31,5 +31,11 @@
 
       expect(response.status).to eq(404)
     end
+
+    it 'renders a 404 for map files' do
+      get '/verify/doc_auth/AcuantImageProcessingService.wasm.map'
+
+      expect(response.status).to eq(404)
+    end
   end
 end
diff --git a/spec/services/acuant/liveness_spec.rb b/spec/services/acuant/liveness_spec.rb
new file mode 100644
index 00000000000..dbf646c374e
--- /dev/null
+++ b/spec/services/acuant/liveness_spec.rb
@@ -0,0 +1,52 @@
+require 'rails_helper'
+
+describe Acuant::Liveness do
+  subject { described_class.new }
+  let(:image_data) { 'live-selfie' }
+  let(:good_liveness_result) do
+    [true, { 'LivenessResult': { 'Score': 99, 'LivenessAssessment': 'Live' }, 'Error': nil,
+             'ErrorCode': nil, 'TransactionId': '4a11ceed-7a54-45fa-9528-3945b51a1e23' }.to_json]
+  end
+  let(:not_live_api_body) do
+    { 'LivenessResult' => { 'Score' => 99, 'LivenessAssessment' => 'NotLive' }, 'Error' => nil,
+      'ErrorCode' => nil, 'TransactionId' => '4a11ceed-7a54-45fa-9528-3945b51a1e23' }
+  end
+  let(:bad_liveness_result) do
+    [true, not_live_api_body.to_json]
+  end
+  let(:good_faceimage_result) do
+    [true, 'license-image']
+  end
+  let(:good_facematch_result) do
+    [true, { IsMatch: true }.to_json]
+  end
+
+  before do
+    allow(Figaro.env).to receive(:acuant_simulator).and_return('false')
+    allow(Rails.env).to receive(:test?).and_return(false)
+  end
+
+  it 'determines the photo is live and also matches the face on the license' do
+    allow_any_instance_of(Idv::Acuant::Liveness).to receive(:liveness).
+      and_return(good_liveness_result)
+    allow_any_instance_of(Idv::Acuant::AssureId).to receive(:face_image).
+      and_return(good_faceimage_result)
+    allow_any_instance_of(Idv::Acuant::FacialMatch).to receive(:facematch).
+      and_return(good_facematch_result)
+    result = subject.call(image_data)
+
+    expect(result).to eq([true, {}])
+  end
+
+  it 'fails liveness and returns the api body if the selfie is not live' do
+    allow_any_instance_of(Idv::Acuant::Liveness).to receive(:liveness).
+      and_return(bad_liveness_result)
+    allow_any_instance_of(Idv::Acuant::AssureId).to receive(:face_image).
+      and_return(good_faceimage_result)
+    allow_any_instance_of(Idv::Acuant::FacialMatch).to receive(:facematch).
+      and_return(good_facematch_result)
+    result = subject.call(image_data)
+
+    expect(result).to eq([false, not_live_api_body])
+  end
+end
diff --git a/spec/services/idv/acuant/liveness_pass_through_spec.rb b/spec/services/idv/acuant/liveness_pass_through_spec.rb
new file mode 100644
index 00000000000..6eccc188e87
--- /dev/null
+++ b/spec/services/idv/acuant/liveness_pass_through_spec.rb
@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+describe Idv::Acuant::LivenessPassThrough do
+  describe '#liveness' do
+    let(:acuant_passlive_url) { 'https://example.com' }
+    let(:path) { '/api/v1/liveness' }
+    let(:body) { 'body' }
+
+    it 'returns a good status' do
+      stub_request(:post, acuant_passlive_url + path).
+        with(headers: { 'Accept' => 'application/json', 'Content-Type' => 'application/json' }).
+        to_return(status: 200, body: body)
+
+      result = subject.liveness(body)
+
+      expect(result).to eq([true, body])
+    end
+  end
+end
diff --git a/spec/services/idv/send_phone_confirmation_otp_spec.rb b/spec/services/idv/send_phone_confirmation_otp_spec.rb
index e94cd71b396..7d8e7fd97bc 100644
--- a/spec/services/idv/send_phone_confirmation_otp_spec.rb
+++ b/spec/services/idv/send_phone_confirmation_otp_spec.rb
@@ -17,7 +17,7 @@
   let(:user) { create(:user, :signed_up) }
 
   let(:exceeded_otp_send_limit) { false }
-  let(:otp_rate_limiter) { OtpRateLimiter.new(user: user, phone: phone) }
+  let(:otp_rate_limiter) { OtpRateLimiter.new(user: user, phone: phone, phone_confirmed: true) }
 
   before do
     # Setup Idv::Session
@@ -28,7 +28,7 @@
       and_return(otp_code)
 
     # Mock OtpRateLimiter
-    allow(OtpRateLimiter).to receive(:new).with(user: user, phone: phone).
+    allow(OtpRateLimiter).to receive(:new).with(user: user, phone: phone, phone_confirmed: true).
       and_return(otp_rate_limiter)
     allow(otp_rate_limiter).to receive(:exceeded_otp_send_limit?).
       and_return(exceeded_otp_send_limit)
diff --git a/spec/services/otp_rate_limiter_spec.rb b/spec/services/otp_rate_limiter_spec.rb
index df7aa0980b3..26ddd8fc9fe 100644
--- a/spec/services/otp_rate_limiter_spec.rb
+++ b/spec/services/otp_rate_limiter_spec.rb
@@ -3,15 +3,16 @@
 RSpec.describe OtpRateLimiter do
   let(:current_user) { build(:user, :with_phone) }
   let(:phone) { MfaContext.new(current_user).phone_configurations.first.phone }
-
   subject(:otp_rate_limiter) do
-    OtpRateLimiter.new(phone: phone, user: current_user)
+    OtpRateLimiter.new(phone: phone, user: current_user, phone_confirmed: false)
   end
-
-  let(:phone_fingerprint) do
-    Pii::Fingerprinter.fingerprint(phone)
+  subject(:otp_rate_limiter_confirmed) do
+    OtpRateLimiter.new(phone: phone, user: current_user, phone_confirmed: true)
+  end
+  let(:phone_fingerprint) { Pii::Fingerprinter.fingerprint(phone) }
+  let(:rate_limited_phone) do
+    OtpRequestsTracker.find_by(phone_fingerprint: phone_fingerprint, phone_confirmed: false)
   end
-  let(:rate_limited_phone) { OtpRequestsTracker.find_by(phone_fingerprint: phone_fingerprint) }
 
   describe '#exceeded_otp_send_limit?' do
     it 'is false by default' do
@@ -27,11 +28,23 @@
 
       expect(otp_rate_limiter.exceeded_otp_send_limit?).to eq(true)
     end
+
+    it 'tracks verified phones separately. limiting one does not limit the other' do
+      expect(otp_rate_limiter.exceeded_otp_send_limit?).to eq(false)
+
+      (Figaro.env.otp_delivery_blocklist_maxretry.to_i + 1).times do
+        otp_rate_limiter.increment
+      end
+
+      expect(otp_rate_limiter.exceeded_otp_send_limit?).to eq(true)
+      expect(otp_rate_limiter_confirmed.exceeded_otp_send_limit?).to eq(false)
+    end
   end
 
   describe '#increment' do
     it 'updates otp_last_sent_at' do
-      tracker = OtpRequestsTracker.find_or_create_with_phone(phone)
+      tracker = OtpRequestsTracker.find_or_create_with_phone_and_confirmed(phone,
+                                                                           false)
       old_otp_last_sent_at = tracker.reload.otp_last_sent_at
       otp_rate_limiter.increment
       new_otp_last_sent_at = tracker.reload.otp_last_sent_at
diff --git a/spec/services/service_provider_seeder_spec.rb b/spec/services/service_provider_seeder_spec.rb
index 482e7057975..4718b5b93a8 100644
--- a/spec/services/service_provider_seeder_spec.rb
+++ b/spec/services/service_provider_seeder_spec.rb
@@ -24,6 +24,12 @@
         expect(config_sp.approved).to eq(true)
         expect(config_sp.active).to eq(true)
         expect(config_sp.native).to eq(true)
+
+        expect(config_sp.deal_id).to eq('ABC123')
+        expect(config_sp.launch_date).to eq(Date.new(2020, 3, 1))
+        expect(config_sp.iaa).to eq('ABC123-2020')
+        expect(config_sp.iaa_start_date).to eq(Date.new(2020, 1, 1))
+        expect(config_sp.iaa_end_date).to eq(Date.new(2020, 12, 31))
       end
 
       it 'does not change approve, active and native on the other existing service providers' do
diff --git a/spec/support/features/doc_auth_helper.rb b/spec/support/features/doc_auth_helper.rb
index 8318c2ad1c1..ab24a1d14ad 100644
--- a/spec/support/features/doc_auth_helper.rb
+++ b/spec/support/features/doc_auth_helper.rb
@@ -96,8 +96,8 @@ def idv_doc_auth_verify_step
     idv_doc_auth_step_path(step: :verify)
   end
 
-  def idv_doc_auth_self_image_step
-    idv_doc_auth_step_path(step: :self_image)
+  def idv_doc_auth_selfie_step
+    idv_doc_auth_step_path(step: :selfie)
   end
 
   def idv_doc_auth_send_link_step
diff --git a/spec/support/features/idv_from_sp_helper.rb b/spec/support/features/idv_from_sp_helper.rb
index 7894e9afe77..cfac9b4f6ef 100644
--- a/spec/support/features/idv_from_sp_helper.rb
+++ b/spec/support/features/idv_from_sp_helper.rb
@@ -7,8 +7,8 @@ def self.included(base)
     end
   end
 
-  def create_ial2_user_from_sp(email)
-    visit_idp_from_sp_with_ial2(:oidc)
+  def create_ial2_user_from_sp(email, **options)
+    visit_idp_from_sp_with_ial2(:oidc, **options)
     register_user(email)
     complete_all_doc_auth_steps
     click_continue
diff --git a/spec/support/features/idv_helper.rb b/spec/support/features/idv_helper.rb
index fb9f9d0ead2..e9c87fb34bd 100644
--- a/spec/support/features/idv_helper.rb
+++ b/spec/support/features/idv_helper.rb
@@ -49,7 +49,7 @@ def choose_idv_otp_delivery_method_voice
     click_on t('idv.buttons.send_confirmation_code')
   end
 
-  def visit_idp_from_sp_with_ial2(sp)
+  def visit_idp_from_sp_with_ial2(sp, **extra)
     if sp == :saml
       settings = ial2_with_bundle_saml_settings
       settings.security[:embed_sign] = false
@@ -64,11 +64,16 @@ def visit_idp_from_sp_with_ial2(sp)
       @state = SecureRandom.hex
       @client_id = 'urn:gov:gsa:openidconnect:sp:server'
       @nonce = SecureRandom.hex
-      visit_idp_from_oidc_sp_with_ial2(state: @state, client_id: @client_id, nonce: @nonce)
+      visit_idp_from_oidc_sp_with_ial2(state: @state, client_id: @client_id, nonce: @nonce, **extra)
     end
   end
 
-  def visit_idp_from_oidc_sp_with_ial2(state: SecureRandom.hex, client_id:, nonce:)
+  def visit_idp_from_oidc_sp_with_ial2(
+    state: SecureRandom.hex,
+    client_id:,
+    nonce:,
+    verified_within: nil
+  )
     visit openid_connect_authorize_path(
       client_id: client_id,
       response_type: 'code',
@@ -78,6 +83,7 @@ def visit_idp_from_oidc_sp_with_ial2(state: SecureRandom.hex, client_id:, nonce:
       state: state,
       prompt: 'select_account',
       nonce: nonce,
+      verified_within: verified_within,
     )
   end
 
diff --git a/spec/support/features/session_helper.rb b/spec/support/features/session_helper.rb
index 4da8435660b..a4b493e2858 100644
--- a/spec/support/features/session_helper.rb
+++ b/spec/support/features/session_helper.rb
@@ -23,8 +23,8 @@ def choose_another_security_option(option)
       select_2fa_option(option)
     end
 
-    def select_2fa_option(option)
-      find("label[for='two_factor_options_form_selection_#{option}']").click
+    def select_2fa_option(option, **find_options)
+      find("label[for='two_factor_options_form_selection_#{option}']", **find_options).click
       click_on t('forms.buttons.continue')
       click_button t('forms.backup_code.are_you_sure_continue') if
         page.has_button?(t('forms.backup_code.are_you_sure_continue'))
diff --git a/spec/support/shared_examples/account_creation.rb b/spec/support/shared_examples/account_creation.rb
index 66b96bc280a..532d43c6b43 100644
--- a/spec/support/shared_examples/account_creation.rb
+++ b/spec/support/shared_examples/account_creation.rb
@@ -98,7 +98,7 @@
     mock_webauthn_setup_challenge
     visit_idp_from_sp_with_ial2(sp)
     confirm_email_and_password('test@test.com')
-    select_2fa_option('webauthn')
+    select_2fa_option('webauthn', visible: :all)
     fill_in_nickname_and_click_continue
     mock_press_button_on_hardware_key_on_setup
     expect(page).to have_current_path(idv_doc_auth_step_path(step: :welcome))
diff --git a/spec/views/layouts/application.html.slim_spec.rb b/spec/views/layouts/application.html.slim_spec.rb
index bea2cab8958..e98d3a9c7a3 100644
--- a/spec/views/layouts/application.html.slim_spec.rb
+++ b/spec/views/layouts/application.html.slim_spec.rb
@@ -54,7 +54,7 @@
       render
 
       doc = Nokogiri::HTML(rendered)
-      expect(doc.at_css('title').text).to eq("login.gov - Something with 'single quotes'")
+      expect(doc.at_css('title').text).to include("login.gov - Something with 'single quotes'")
     end
   end
 
diff --git a/spec/views/users/delete/show.html.slim_spec.rb b/spec/views/users/delete/show.html.erb_spec.rb
similarity index 86%
rename from spec/views/users/delete/show.html.slim_spec.rb
rename to spec/views/users/delete/show.html.erb_spec.rb
index 922ba39f3a0..46f8f24d671 100644
--- a/spec/views/users/delete/show.html.slim_spec.rb
+++ b/spec/views/users/delete/show.html.erb_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'users/delete/show.html.slim' do
+describe 'users/delete/show.html.erb' do
   let(:user) { build_stubbed(:user, :signed_up) }
   let(:decorated_user) { user.decorate }
 
@@ -44,7 +44,10 @@
 
   it 'contains link to cancel delete account link' do
     render
+    page = Capybara.string(rendered)
+    link = page.find_link(t('users.delete.actions.cancel'), href: account_path)
 
-    expect(rendered).to have_link(t('users.delete.actions.cancel'), href: account_path)
+    expect(link).to be_present
+    expect(link['role']).to eq('button')
   end
 end
diff --git a/spec/views/users/totp_setup/new.html.erb_spec.rb b/spec/views/users/totp_setup/new.html.erb_spec.rb
index ee507cb2496..93d40079587 100644
--- a/spec/views/users/totp_setup/new.html.erb_spec.rb
+++ b/spec/views/users/totp_setup/new.html.erb_spec.rb
@@ -33,6 +33,22 @@
 
       expect(rendered).to have_link(t('links.cancel'), href: account_path)
     end
+
+    it 'has a button to copy the QR code' do
+      render
+
+      expect(rendered).to have_button(t('links.copy'))
+    end
+
+    it 'has the correct aria-labelledby on the nickname field' do
+      render
+      page = Capybara.string(rendered)
+
+      nickname_field = page.find_field(:name)
+      label = page.find(:id, nickname_field['aria-labelledby'])
+
+      expect(label.text).to include(t('forms.totp_setup.totp_step_1'))
+    end
   end
 
   context 'user is setting up 2FA' do
diff --git a/yarn.lock b/yarn.lock
index d034375fbc0..b0573e54414 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2193,15 +2193,6 @@ cliui@^3.2.0:
     strip-ansi "^3.0.1"
     wrap-ansi "^2.0.0"
 
-cliui@^4.0.0:
-  version "4.1.0"
-  resolved "https://registry.yarnpkg.com/cliui/-/cliui-4.1.0.tgz#348422dbe82d800b3022eef4f6ac10bf2e4d1b49"
-  integrity sha512-4FG+RSG9DL7uEwRUZXZn3SS34DiDPfzP0VOiEwtUWlE+AR2EIg+hSyvrIgUUfhdgR/UkAeW2QHgeP+hWrXs7jQ==
-  dependencies:
-    string-width "^2.1.1"
-    strip-ansi "^4.0.0"
-    wrap-ansi "^2.0.0"
-
 cliui@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/cliui/-/cliui-5.0.0.tgz#deefcfdb2e800784aa34f46fa08e06851c7bbbc5"
@@ -4136,10 +4127,10 @@ html-encoding-sniffer@^2.0.1:
   dependencies:
     whatwg-encoding "^1.0.5"
 
-html-entities@^1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/html-entities/-/html-entities-1.2.1.tgz#0df29351f0721163515dfb9e5543e5f6eed5162f"
-  integrity sha1-DfKTUfByEWNRXfueVUPl9u7VFi8=
+html-entities@^1.3.1:
+  version "1.3.1"
+  resolved "https://registry.yarnpkg.com/html-entities/-/html-entities-1.3.1.tgz#fb9a1a4b5b14c5daba82d3e34c6ae4fe701a0e44"
+  integrity sha512-rhE/4Z3hIhzHAUKbW8jVcCyuT5oJCXXqhN/6mXXVCpzTmvJnoH2HL/bt3EZ6p55jbFJBeAe1ZNpL5BugLujxNA==
 
 http-deceiver@^1.2.7:
   version "1.2.7"
@@ -5079,10 +5070,10 @@ log-symbols@2.2.0:
   dependencies:
     chalk "^2.0.1"
 
-loglevel@^1.6.6:
-  version "1.6.7"
-  resolved "https://registry.yarnpkg.com/loglevel/-/loglevel-1.6.7.tgz#b3e034233188c68b889f5b862415306f565e2c56"
-  integrity sha512-cY2eLFrQSAfVPhCgH1s7JI73tMbg9YC3v3+ZHVW67sBS7UxWzNEk/ZBbSfLykBWHp33dqqtOv82gjhKEi81T/A==
+loglevel@^1.6.8:
+  version "1.6.8"
+  resolved "https://registry.yarnpkg.com/loglevel/-/loglevel-1.6.8.tgz#8a25fb75d092230ecd4457270d80b54e28011171"
+  integrity sha512-bsU7+gc9AJ2SqpzxwU3+1fedl8zAntbtC5XYlt3s2j1hJcn2PsXSmgN8TaLG/J1/2mod4+cE/3vNL70/c1RNCA==
 
 lolex@1.3.2:
   version "1.3.2"
@@ -5880,7 +5871,7 @@ os-locale@^1.4.0:
   dependencies:
     lcid "^1.0.0"
 
-os-locale@^3.0.0, os-locale@^3.1.0:
+os-locale@^3.1.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/os-locale/-/os-locale-3.1.0.tgz#a802a6ee17f24c10483ab9935719cef4ed16bf1a"
   integrity sha512-Z8l3R4wYWM40/52Z+S265okfFj8Kt2cC2MKY+xNi3kFs+XGI7WXu/I309QQQYbRW4ijiZ+yxs9pqEhJh0DqW3Q==
@@ -6222,10 +6213,10 @@ pnp-webpack-plugin@^1.5.0:
   dependencies:
     ts-pnp "^1.1.6"
 
-portfinder@^1.0.25:
-  version "1.0.25"
-  resolved "https://registry.yarnpkg.com/portfinder/-/portfinder-1.0.25.tgz#254fd337ffba869f4b9d37edc298059cb4d35eca"
-  integrity sha512-6ElJnHBbxVA1XSLgBp7G1FiCkQdlqGzuF7DswL5tcea+E8UpuvPU7beVAjjRwCioTS9ZluNbu+ZyRvgTsmqEBg==
+portfinder@^1.0.26:
+  version "1.0.26"
+  resolved "https://registry.yarnpkg.com/portfinder/-/portfinder-1.0.26.tgz#475658d56ca30bed72ac7f1378ed350bd1b64e70"
+  integrity sha512-Xi7mKxJHHMI3rIUrnm/jjUgwhbYMkp/XKEcZX3aG4BrumLpq3nmoQMX+ClYnDZnZ/New7IatC1no5RX0zo1vXQ==
   dependencies:
     async "^2.6.2"
     debug "^3.1.1"
@@ -7739,13 +7730,14 @@ sockjs-client@1.4.0:
     json3 "^3.3.2"
     url-parse "^1.4.3"
 
-sockjs@0.3.19:
-  version "0.3.19"
-  resolved "https://registry.yarnpkg.com/sockjs/-/sockjs-0.3.19.tgz#d976bbe800af7bd20ae08598d582393508993c0d"
-  integrity sha512-V48klKZl8T6MzatbLlzzRNhMepEys9Y4oGFpypBFFn1gLI/QQ9HtLLyWJNbPlwGLelOVOEijUbTTJeLLI59jLw==
+sockjs@0.3.20:
+  version "0.3.20"
+  resolved "https://registry.yarnpkg.com/sockjs/-/sockjs-0.3.20.tgz#b26a283ec562ef8b2687b44033a4eeceac75d855"
+  integrity sha512-SpmVOVpdq0DJc0qArhF3E5xsxvaiqGNb73XfgBpK1y3UD5gs8DSo8aCTsuT5pX8rssdc2NDIzANwP9eCAiSdTA==
   dependencies:
     faye-websocket "^0.10.0"
-    uuid "^3.0.1"
+    uuid "^3.4.0"
+    websocket-driver "0.6.5"
 
 sort-keys@^1.0.0:
   version "1.1.2"
@@ -7838,10 +7830,10 @@ spdy-transport@^3.0.0:
     readable-stream "^3.0.6"
     wbuf "^1.7.3"
 
-spdy@^4.0.1:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/spdy/-/spdy-4.0.1.tgz#6f12ed1c5db7ea4f24ebb8b89ba58c87c08257f2"
-  integrity sha512-HeZS3PBdMA+sZSu0qwpCxl3DeALD5ASx8pAX0jZdKXSpPWbQ6SYGnlg3BBmYLx5LtiZrmkAZfErCm2oECBcioA==
+spdy@^4.0.2:
+  version "4.0.2"
+  resolved "https://registry.yarnpkg.com/spdy/-/spdy-4.0.2.tgz#b74f466203a3eda452c02492b91fb9e84a27677b"
+  integrity sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==
   dependencies:
     debug "^4.1.0"
     handle-thing "^2.0.0"
@@ -7967,7 +7959,7 @@ string-width@^1.0.1, string-width@^1.0.2:
     is-fullwidth-code-point "^1.0.0"
     strip-ansi "^3.0.0"
 
-"string-width@^1.0.2 || 2", string-width@^2.0.0, string-width@^2.1.0, string-width@^2.1.1:
+"string-width@^1.0.2 || 2", string-width@^2.1.0, string-width@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-2.1.1.tgz#ab93f27a8dc13d28cac815c462143a6d9012ae9e"
   integrity sha512-nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==
@@ -8550,7 +8542,7 @@ utils-merge@1.0.1:
   resolved "https://registry.yarnpkg.com/utils-merge/-/utils-merge-1.0.1.tgz#9f95710f50a267947b2ccc124741c1028427e713"
   integrity sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM=
 
-uuid@^3.0.1, uuid@^3.3.2:
+uuid@^3.3.2, uuid@^3.4.0:
   version "3.4.0"
   resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
   integrity sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==
@@ -8673,10 +8665,10 @@ webpack-dev-middleware@^3.7.2:
     range-parser "^1.2.1"
     webpack-log "^2.0.0"
 
-webpack-dev-server@^3.10.3:
-  version "3.10.3"
-  resolved "https://registry.yarnpkg.com/webpack-dev-server/-/webpack-dev-server-3.10.3.tgz#f35945036813e57ef582c2420ef7b470e14d3af0"
-  integrity sha512-e4nWev8YzEVNdOMcNzNeCN947sWJNd43E5XvsJzbAL08kGc2frm1tQ32hTJslRS+H65LCb/AaUCYU7fjHCpDeQ==
+webpack-dev-server@^3.11.0:
+  version "3.11.0"
+  resolved "https://registry.yarnpkg.com/webpack-dev-server/-/webpack-dev-server-3.11.0.tgz#8f154a3bce1bcfd1cc618ef4e703278855e7ff8c"
+  integrity sha512-PUxZ+oSTxogFQgkTtFndEtJIPNmml7ExwufBZ9L2/Xyyd5PnOL5UreWe5ZT7IU25DSdykL9p1MLQzmLh2ljSeg==
   dependencies:
     ansi-html "0.0.7"
     bonjour "^3.5.0"
@@ -8686,31 +8678,31 @@ webpack-dev-server@^3.10.3:
     debug "^4.1.1"
     del "^4.1.1"
     express "^4.17.1"
-    html-entities "^1.2.1"
+    html-entities "^1.3.1"
     http-proxy-middleware "0.19.1"
     import-local "^2.0.0"
     internal-ip "^4.3.0"
     ip "^1.1.5"
     is-absolute-url "^3.0.3"
     killable "^1.0.1"
-    loglevel "^1.6.6"
+    loglevel "^1.6.8"
     opn "^5.5.0"
     p-retry "^3.0.1"
-    portfinder "^1.0.25"
+    portfinder "^1.0.26"
     schema-utils "^1.0.0"
     selfsigned "^1.10.7"
     semver "^6.3.0"
     serve-index "^1.9.1"
-    sockjs "0.3.19"
+    sockjs "0.3.20"
     sockjs-client "1.4.0"
-    spdy "^4.0.1"
+    spdy "^4.0.2"
     strip-ansi "^3.0.1"
     supports-color "^6.1.0"
     url "^0.11.0"
     webpack-dev-middleware "^3.7.2"
     webpack-log "^2.0.0"
     ws "^6.2.1"
-    yargs "12.0.5"
+    yargs "^13.3.2"
 
 webpack-log@^2.0.0:
   version "2.0.0"
@@ -8757,6 +8749,13 @@ webpack@^4.41.2:
     watchpack "^1.6.0"
     webpack-sources "^1.4.1"
 
+websocket-driver@0.6.5:
+  version "0.6.5"
+  resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.6.5.tgz#5cb2556ceb85f4373c6d8238aa691c8454e13a36"
+  integrity sha1-XLJVbOuF9Dc8bYI4qmkchFThOjY=
+  dependencies:
+    websocket-extensions ">=0.1.1"
+
 websocket-driver@>=0.5.1:
   version "0.7.3"
   resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.3.tgz#a2d4e0d4f4f116f1e6297eba58b05d430100e9f9"
@@ -8907,7 +8906,7 @@ y18n@^3.2.1:
   resolved "https://registry.yarnpkg.com/y18n/-/y18n-3.2.1.tgz#6d15fba884c08679c0d77e88e7759e811e07fa41"
   integrity sha1-bRX7qITAhnnA136I53WegR4H+kE=
 
-"y18n@^3.2.1 || ^4.0.0", y18n@^4.0.0:
+y18n@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/y18n/-/y18n-4.0.0.tgz#95ef94f85ecc81d007c264e190a120f0a3c8566b"
   integrity sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==
@@ -8942,14 +8941,6 @@ yargs-parser@13.1.1:
     camelcase "^5.0.0"
     decamelize "^1.2.0"
 
-yargs-parser@^11.1.1:
-  version "11.1.1"
-  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-11.1.1.tgz#879a0865973bca9f6bab5cbdf3b1c67ec7d3bcf4"
-  integrity sha512-C6kB/WJDiaxONLJQnF8ccx9SEeoTTLek8RVbaOIsrAUS8VrBEXfmeSnCZxygc+XC2sNMBIwOOnfcxiynjHsVSQ==
-  dependencies:
-    camelcase "^5.0.0"
-    decamelize "^1.2.0"
-
 yargs-parser@^13.1.0, yargs-parser@^13.1.1, yargs-parser@^13.1.2:
   version "13.1.2"
   resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-13.1.2.tgz#130f09702ebaeef2650d54ce6e3e5706f7a4fb38"
@@ -8974,24 +8965,6 @@ yargs-unparser@1.6.0:
     lodash "^4.17.15"
     yargs "^13.3.0"
 
-yargs@12.0.5:
-  version "12.0.5"
-  resolved "https://registry.yarnpkg.com/yargs/-/yargs-12.0.5.tgz#05f5997b609647b64f66b81e3b4b10a368e7ad13"
-  integrity sha512-Lhz8TLaYnxq/2ObqHDql8dX8CJi97oHxrjUcYtzKbbykPtVW9WB+poxI+NM2UIzsMgNCZTIf0AQwsjK5yMAqZw==
-  dependencies:
-    cliui "^4.0.0"
-    decamelize "^1.2.0"
-    find-up "^3.0.0"
-    get-caller-file "^1.0.1"
-    os-locale "^3.0.0"
-    require-directory "^2.1.1"
-    require-main-filename "^1.0.1"
-    set-blocking "^2.0.0"
-    string-width "^2.0.0"
-    which-module "^2.0.0"
-    y18n "^3.2.1 || ^4.0.0"
-    yargs-parser "^11.1.1"
-
 yargs@13.2.4:
   version "13.2.4"
   resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.2.4.tgz#0b562b794016eb9651b98bd37acf364aa5d6dc83"
@@ -9025,7 +8998,7 @@ yargs@13.3.0:
     y18n "^4.0.0"
     yargs-parser "^13.1.1"
 
-yargs@^13.3.0:
+yargs@^13.3.0, yargs@^13.3.2:
   version "13.3.2"
   resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.3.2.tgz#ad7ffefec1aa59565ac915f82dccb38a9c31a2dd"
   integrity sha512-AX3Zw5iPruN5ie6xGRIDgqkT+ZhnRlZMLMHAs8tg7nRruy2Nb+i5o9bwghAogtM08q1dpr2LVoS8KSTMYpWXUw==