diff --git a/build/build.py b/build/build.py
index ddea7be..9841d39 100644
--- a/build/build.py
+++ b/build/build.py
@@ -27,6 +27,9 @@ def main():
     if not env.init(warn_miss_tool=True):
         return
 
+    # wget = os.environ.get('TP_TOOLCHAIN_WGET')
+    # cc.w(wget)
+
     action = None
     argv = sys.argv[1:]
     if len(argv) >= 1:
diff --git a/server/www/teleport/static/js/user/user-list.js b/server/www/teleport/static/js/user/user-list.js
index ef2ebd8..3db85d1 100755
--- a/server/www/teleport/static/js/user/user-list.js
+++ b/server/www/teleport/static/js/user/user-list.js
@@ -769,7 +769,6 @@ $app.create_dlg_edit_user = function () {
         , btn_auth_username_password_captcha: $('#sec-auth-username-password-captcha')
         // , btn_auth_username_oath: $('#sec-auth-username-oath')
         , btn_auth_username_password_oath: $('#sec-auth-username-password-oath')
-
     };
 
     dlg.init = function (cb_stack) {
diff --git a/server/www/teleport/webroot/app/controller/ops.py b/server/www/teleport/webroot/app/controller/ops.py
index 0bd1802..78f5b00 100644
--- a/server/www/teleport/webroot/app/controller/ops.py
+++ b/server/www/teleport/webroot/app/controller/ops.py
@@ -177,12 +177,12 @@ class DoGetSessionIDHandler(TPBaseJsonHandler):
                 return
 
             acc_id = args['acc_id']
-            host_id = args['host_id']
 
             err, acc_info = account.get_account_info(acc_id)
             if err != TPE_OK:
                 return self.write_json(err)
 
+            host_id = acc_info['host_id']
             acc_info['protocol_flag'] = TP_FLAG_ALL
             acc_info['record_flag'] = TP_FLAG_ALL
 
diff --git a/server/www/teleport/webroot/app/logic/auth/oath.py b/server/www/teleport/webroot/app/logic/auth/oath.py
index d0ac7ea..ffd7497 100644
--- a/server/www/teleport/webroot/app/logic/auth/oath.py
+++ b/server/www/teleport/webroot/app/logic/auth/oath.py
@@ -14,7 +14,7 @@ __all__ = ['tp_oath_generate_secret', 'tp_oath_verify_code', 'tp_oath_generate_q
 
 
 def tp_oath_generate_secret():
-    return _convert_secret_to_base32(binascii.b2a_hex(os.urandom(16))).replace('=', '')
+    return _convert_secret_to_base32(binascii.b2a_hex(os.urandom(20))).replace('=', '')
 
 
 def tp_oath_verify_code(secret, code):