diff --git a/bubble-server/src/main/java/bubble/service/dbfilter/EntityIterator.java b/bubble-server/src/main/java/bubble/service/dbfilter/EntityIterator.java
index 44a45355..ef6767fd 100644
--- a/bubble-server/src/main/java/bubble/service/dbfilter/EntityIterator.java
+++ b/bubble-server/src/main/java/bubble/service/dbfilter/EntityIterator.java
@@ -9,6 +9,7 @@ import bubble.cloud.storage.local.LocalStorageConfig;
 import bubble.cloud.storage.local.LocalStorageDriver;
 import bubble.model.account.AccountSshKey;
 import bubble.model.account.AccountTemplate;
+import bubble.model.app.AppTemplateEntity;
 import bubble.model.app.BubbleApp;
 import bubble.model.bill.AccountPaymentMethod;
 import bubble.model.bill.BubblePlanApp;
@@ -160,12 +161,21 @@ public abstract class EntityIterator implements Iterator<Identifiable> {
                         log.info("addEntities: system BubblePlanApp " + systemPlanApp.getUuid() + ": no matching BubbleApp not found in userApps (not adding): " + names(userApps));
                     } else {
                         // systemPlanApp will now be associated with "root"'s BubblePlan, but user's BubbleApp
-                        log.info("addEntities: rewrote app for "+systemPlanApp.getUuid()+" -> "+userApp.getName()+"/"+userApp.getUuid());
+                        log.info("addEntities: rewrote app for " + systemPlanApp.getUuid() + " -> " + userApp.getName() + "/" + userApp.getUuid());
                         add(systemPlanApp.setApp(userApp.getUuid()));
                     }
                 }
             }
 
+        } else if (!fullCopy && planApps != null && AppTemplateEntity.class.isAssignableFrom(c)) {
+            // Only copy app-related objects if the corresponding app is among the planApps
+            // Make copied objects templates
+            for (AppTemplateEntity e : (List<? extends AppTemplateEntity>) entities) {
+                if (planAppEnabled(e.getApp(), planApps)) {
+                    add(e.setTemplate(true));
+                }
+            }
+
         } else if (!fullCopy && planApps != null && AccountTemplate.class.isAssignableFrom(c)) {
             // only copy app-related entities for enabled apps, make them all templates
             entities.stream()
diff --git a/bubble-server/src/main/resources/message_templates/en_US/server/pre_auth/ResourceMessages.properties b/bubble-server/src/main/resources/message_templates/en_US/server/pre_auth/ResourceMessages.properties
index 1bd80911..da772a3f 100644
--- a/bubble-server/src/main/resources/message_templates/en_US/server/pre_auth/ResourceMessages.properties
+++ b/bubble-server/src/main/resources/message_templates/en_US/server/pre_auth/ResourceMessages.properties
@@ -171,6 +171,7 @@ err.name.planMaxAccountLimit=No more accounts can be created on this plan. Upgra
 err.password.required=Password is required
 err.password.tooShort=Password must be at least 8 characters
 err.password.invalid=Password must contain at least one letter, one number, and one special character
+err.confirmPassword.mismatch=Password does not match
 err.account.suspended=Account is suspended
 err.account.locked=Account is locked
 err.account.noParent=No parent account found
@@ -253,6 +254,7 @@ err.storage.unknownError=Error connecting to Storage service
 form_title_login=Login
 field_label_username=Username
 field_label_password=Password
+field_label_confirm_password=Confirm Password
 field_label_unlock_key=Unlock Key
 form_title_register=Register
 field_label_contactType=Contact Type
diff --git a/bubble-server/src/main/resources/models/defaults/bubblePlan.json b/bubble-server/src/main/resources/models/defaults/bubblePlan.json
index 4fd167df..665c47ab 100644
--- a/bubble-server/src/main/resources/models/defaults/bubblePlan.json
+++ b/bubble-server/src/main/resources/models/defaults/bubblePlan.json
@@ -15,7 +15,8 @@
       "BubblePlanApp": [
         {"app": "TrafficAnalytics"},
         {"app": "BubbleBlock"},
-        {"app": "UserBlocker"}
+        {"app": "UserBlocker"},
+        {"app": "TlsPassthru"}
       ]
     }
   },
@@ -36,7 +37,8 @@
       "BubblePlanApp": [
         {"app": "TrafficAnalytics"},
         {"app": "BubbleBlock"},
-        {"app": "UserBlocker"}
+        {"app": "UserBlocker"},
+        {"app": "TlsPassthru"}
       ]
     }
   },
@@ -57,7 +59,8 @@
       "BubblePlanApp": [
         {"app": "TrafficAnalytics"},
         {"app": "BubbleBlock"},
-        {"app": "UserBlocker"}
+        {"app": "UserBlocker"},
+        {"app": "TlsPassthru"}
       ]
     }
   }
diff --git a/bubble-web b/bubble-web
index 8472c77a..70da8e0d 160000
--- a/bubble-web
+++ b/bubble-web
@@ -1 +1 @@
-Subproject commit 8472c77a2eedf2c3be56fa9dc103d4f3a454a6dc
+Subproject commit 70da8e0d38be1ea90edc33784e94a8d5435f8ac5