diff --git a/flows/authn/conditions/conditions-flow.xml b/flows/authn/conditions/conditions-flow.xml
index 00ff7f6..e48e2c9 100644
--- a/flows/authn/conditions/conditions-flow.xml
+++ b/flows/authn/conditions/conditions-flow.xml
@@ -25,7 +25,7 @@
 
     <subflow-state id="CallExpiringPassword" subflow="authn/conditions/expiring-password">
         <input name="calledAsSubflow" value="true" />
-        <transition on="proceed" to="proceed" />
+        <transition on="proceed" to="ContinueSuccessfulAuthentication" />
     </subflow-state>
 
     <subflow-state id="CallExpiredPassword" subflow="authn/conditions/expired-password">
diff --git a/messages/error-messages.properties b/messages/error-messages.properties
index 3606493..b91818e 100644
--- a/messages/error-messages.properties
+++ b/messages/error-messages.properties
@@ -117,3 +117,7 @@ error.message = An error occurred: $eventId
 root.title = Shibboleth IdP
 root.message = No services are available at this location.
 root.footer = Insert your footer text here.
+
+# https://wiki.shibboleth.net/confluence/display/IDP30/ReleaseNotes#ReleaseNotes-3.3.0(November10,2016)
+NoSuchFlowExecutionException = stale
+ExternalAuthenticationException = stale
diff --git a/system/flows/authn/password-authn-flow.xml b/system/flows/authn/password-authn-flow.xml
new file mode 100644
index 0000000..07f6fba
--- /dev/null
+++ b/system/flows/authn/password-authn-flow.xml
@@ -0,0 +1,111 @@
+<flow xmlns="http://www.springframework.org/schema/webflow"
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
+      parent="authn.abstract, authn/conditions">
+
+    <!--
+    This is a login flow for basic-auth or form-based password authentication. The back-end step is named
+    "ValidateUsernamePassword" and can be supplied by different back-end implementation files. 
+    -->
+
+    <var name="thisFlow" class="net.shibboleth.idp.authn.AuthenticationFlowDescriptor" />
+
+    <action-state id="ExtractUsernamePasswordFromBasicAuth">
+        <evaluate expression="ExtractUsernamePasswordFromBasicAuth" />
+        <evaluate expression="'proceed'" />
+        
+        <transition on="proceed" to="ValidateUsernamePassword" />
+        
+        <!-- Fall through to a different flow if basic-auth extract fails on a passive or non-browser request. -->
+        <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
+        
+        <transition on="NoCredentials" to="DisplayUsernamePasswordPage" />
+        <transition on="InvalidCredentials" to="DisplayUsernamePasswordPage" />
+        <on-exit>
+            <set name="thisFlow" value="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow()" />
+        </on-exit>
+    </action-state>
+    
+    <view-state id="DisplayUsernamePasswordPage" view="login">
+        <on-render>
+            <evaluate expression="environment" result="viewScope.environment" />
+            <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="viewScope.authenticationContext" />
+            <evaluate expression="authenticationContext.getPotentialFlows().values().?[id matches 'authn/(' + (flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.Password.ExtendedFlows') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.Password.ExtendedFlows').trim() : '') + ')']" result="viewScope.extendedAuthenticationFlows" />
+            <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.Password.PrincipalOverride') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.Password.PrincipalOverride') : null" result="viewScope.passwordPrincipals" />
+            <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" />
+            <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationErrorContext))" result="viewScope.authenticationErrorContext" />
+            <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationWarningContext))" result="viewScope.authenticationWarningContext" />
+            <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext))" result="viewScope.ldapResponseContext" />
+            <evaluate expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)" result="viewScope.encoder" />
+            <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
+            <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
+            <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
+        </on-render>
+
+        <transition on="proceed" to="ExtractUsernamePasswordFromFormRequest">
+            <evaluate expression="authenticationContext.setAttemptedFlow(thisFlow)" />
+        </transition>
+        <transition on="#{currentEvent.id.startsWith('authn/')}" to="PreserveAuthenticationFlowState">
+            <evaluate expression="authenticationContext.setAttemptedFlow(authenticationContext.getPotentialFlows().get(currentEvent.id))" />
+        </transition>
+
+        <on-exit>
+            <evaluate expression="opensamlProfileRequestContext.addSubcontext(new net.shibboleth.idp.consent.context.ConsentManagementContext(), true).setRevokeConsent(requestParameters._shib_idp_revokeConsent == 'true')" />
+        </on-exit>
+    </view-state>
+    
+    <action-state id="PreserveAuthenticationFlowState">
+        <evaluate expression="PreserveAuthenticationFlowState" />
+        <evaluate expression="'proceed'" />
+        
+        <transition on="proceed" to="CallExtendedFlow" />
+    </action-state>
+    
+    <subflow-state id="CallExtendedFlow" subflow="#{opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow().getId()}">
+        <input name="calledAsSubflow" value="true" />
+        <input name="calledAsExtendedFlow" value="true" />
+        <transition on="proceed" to="proceed" />
+        <transition to="DisplayUsernamePasswordPage">
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getIntermediateFlows().put(opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow().getId(), opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow())" />
+        </transition>
+    </subflow-state>
+    
+    <action-state id="ExtractUsernamePasswordFromFormRequest">
+        <evaluate expression="ExtractUsernamePasswordFromFormRequest" />
+        <evaluate expression="'proceed'" />
+    
+        <!-- Let the validate action handle any problems later. -->        
+        <transition to="ValidateUsernamePassword" />
+    </action-state>
+    
+    <action-state id="ValidateUsernamePassword" parent="authn/conditions#ValidateUsernamePassword">
+        <evaluate expression="ValidateUsernamePassword" />
+        <evaluate expression="'proceed'" />
+
+        <transition on="proceed" to="ContinueSuccessfulAuthentication" />
+        
+        <!-- Fall through to a different flow if login fails on a passive or non-browser request. -->
+        <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
+
+        <!-- Other event transitions are determined by deployer in /flows/authn/conditions/conditions-flow.xml -->
+    </action-state>
+
+    <action-state id="ContinueSuccessfulAuthentication">
+        <evaluate expression="PopulateSubjectCanonicalizationContext" />
+        <evaluate expression="'proceed'" />
+        <transition on="proceed" to="CallSubjectCanonicalization" />
+    </action-state>
+
+    <!-- This runs a c14n step on the result of the authentication. -->
+    <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
+        <input name="calledAsSubflow" value="true" />
+        <transition on="proceed" to="proceed" />
+        
+        <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
+        <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+    </subflow-state>
+
+    <bean-import resource="password-authn-beans.xml" />
+
+</flow>
diff --git a/views/logout.vm b/views/logout.vm
index a65c9ec..425e2bd 100644
--- a/views/logout.vm
+++ b/views/logout.vm
@@ -79,10 +79,9 @@
                 <li><a href="https://wiki.carleton.edu/Shibboleth.sso/Login?target=https%3A%2F%2Fwiki.carleton.edu&os_destination=%2F">Carleton Wiki</a></li>
                 <li><a href="https://shib.lynda.com/Shibboleth.sso/InCommon?providerId=urn:mace:incommon:carleton.edu&target=https://shib.lynda.com/InCommon">Lynda.com</a></li>
         </ul>
-                <!-- If SAML logout with no extra work to do, complete the flow by adding a hidden iframe. -->
-                #if ( $profileRequestContext.getProfileId().contains("saml2/logout") )
-                    <iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed">
-                #end
+                <!-- Complete the flow by adding a hidden iframe. -->
+                <iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed">
+
             #end
 
           </div>