diff --git a/Dockerfile b/Dockerfile
index d500304..65dedc5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,17 +23,17 @@ RUN \
     mkdir -p /opt/scitokens-server/var/storage/file_store &&\
     mkdir -p /opt/tomcat/webapps/scitokens-server ;\
     # Install the OA4MP webapp and associated dependencies.
-    curl -s -L https://github.com/ncsa/OA4MP/releases/download/v5.3.1/oauth2.war > /opt/tomcat/webapps/scitokens-server.war ;\
+    curl -s -L https://github.com/ncsa/OA4MP/releases/download/v5.3.3/oauth2.war > /opt/tomcat/webapps/scitokens-server.war ;\
     curl -s -L https://github.com/javaee/javamail/releases/download/JAVAMAIL-1_6_2/javax.mail.jar > /opt/tomcat/lib/javax.mail.jar ;\
-    curl -s -L https://github.com/ncsa/OA4MP/releases/download/v5.3.1/jwt.jar > /opt/scitokens-server/lib/jwt.jar ;\
-    curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.3.1/cli.jar > /opt/scitokens-server/lib/scitokens-cli.jar ;\
+    curl -s -L https://github.com/ncsa/OA4MP/releases/download/v5.3.3/jwt.jar > /opt/scitokens-server/lib/jwt.jar ;\
+    curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.3.3/cli.jar > /opt/scitokens-server/lib/scitokens-cli.jar ;\
     cd /opt/tomcat/webapps/scitokens-server ;\
     jar -xf ../scitokens-server.war ;\
     chgrp -R tomcat /opt/tomcat/webapps/scitokens-server ;\
     mkdir -p /opt/tomcat/var/storage/scitokens-server ;\
     chown -R tomcat:tomcat /opt/tomcat/var/storage/scitokens-server ;\
     # Install support for the QDL CLI
-    curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.3.1/oa2-qdl-installer.jar >/tmp/oa2-qdl-installer.jar ;\
+    curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.3.3/oa2-qdl-installer.jar >/tmp/oa2-qdl-installer.jar ;\
     java -jar /tmp/oa2-qdl-installer.jar -dir /opt/qdl ;\
     rm /tmp/oa2-qdl-installer.jar ;\
     mkdir -p /opt/qdl/var/scripts ;\
diff --git a/scitokens-server/etc/server-config.xml.tmpl b/scitokens-server/etc/server-config.xml.tmpl
index bc5869f..6d0b15a 100644
--- a/scitokens-server/etc/server-config.xml.tmpl
+++ b/scitokens-server/etc/server-config.xml.tmpl
@@ -9,6 +9,7 @@
              refreshTokenEnabled="true"
              enableTokenExchange="true"
              clientSecretLength="24"
+             cleanupInterval= "60 min"
              scheme="oa4mp"
              schemeSpecificPart=""
              debug="trace"
@@ -17,6 +18,14 @@
              issuer="https://{HOSTNAME}/scitokens-server"
              address="https://{HOSTNAME}/scitokens-server">
 
+        <unusedClientCleanup gracePeriod="6 hr"
+                             deleteVersions="false"
+                             enabled="true"
+                             interval="4 hr">
+          <whitelist>
+             <clientID>localhost:template</clientID>
+          </whitelist>
+        </unusedClientCleanup>
         <logging
                 logFileName="/dev/stdout"
                 logName="scitokens-server"
diff --git a/scitokens-server/var/qdl/scitokens/policies.qdl b/scitokens-server/var/qdl/scitokens/policies.qdl
index a42871f..210436f 100644
--- a/scitokens-server/var/qdl/scitokens/policies.qdl
+++ b/scitokens-server/var/qdl/scitokens/policies.qdl
@@ -2,6 +2,9 @@
    Basic script to fetch the capabilities for a user (by eppn here) and
    put it in the scopes for the access token.
 */
+ jload('edu.uiuc.ncsa.myproxy.oa4mp.qdl.claims.OA2Module');
+ jload('edu.uiuc.ncsa.myproxy.oa4mp.qdl.acl.AccessControlModule')
+
 define[
    stAud(x.)
  ][
@@ -17,7 +20,6 @@ define[
    /* Uncomment next two lines if you want to enable default user support */
    cfg.use_default := true;
  cfg.default_claim := 'default_claim';
-
    // Snarf up the exactly the EPE from the claims using the subject.
               eta. := get_claims(create_source(cfg.), claims.'sub');