diff --git a/lib/galaxy/security/__init__.py b/lib/galaxy/security/__init__.py
index 6bcb9b79371..b4b911e79f8 100644
--- a/lib/galaxy/security/__init__.py
+++ b/lib/galaxy/security/__init__.py
@@ -799,7 +799,8 @@ class GalaxyRBACAgent(RBACAgent):
 
     def get_private_user_role(self, user, auto_create=False):
         role = self.sa_session.query(self.model.Role) \
-                              .filter(and_(self.model.Role.table.c.name == user.email,
+                              .filter(and_(self.model.UserRoleAssociation.table.c.user_id == user.id,
+                                           self.model.Role.table.c.id == self.model.UserRoleAssociation.table.c.role_id,
                                            self.model.Role.table.c.type == self.model.Role.types.PRIVATE)) \
                               .first()
         if not role:
diff --git a/lib/galaxy/webapps/galaxy/api/workflows.py b/lib/galaxy/webapps/galaxy/api/workflows.py
index 2043480838f..5d2c5d0e809 100644
--- a/lib/galaxy/webapps/galaxy/api/workflows.py
+++ b/lib/galaxy/webapps/galaxy/api/workflows.py
@@ -777,7 +777,9 @@ class WorkflowsAPIController(BaseAPIController, UsesStoredWorkflowMixin, UsesAnn
         decoded_workflow_invocation_id = self.decode_id(invocation_id)
         workflow_invocation = self.workflow_manager.get_invocation(trans, decoded_workflow_invocation_id)
         if workflow_invocation:
-            return self.__encode_invocation(workflow_invocation, **kwd)
+            step_details = util.string_as_bool(kwd.get('step_details', 'False'))
+            legacy_job_state = util.string_as_bool(kwd.get('legacy_job_state', 'False'))
+            return self.__encode_invocation(trans, workflow_invocation, step_details=step_details, legacy_job_state=legacy_job_state)
         return None
 
     @expose_api
@@ -867,5 +869,9 @@ class WorkflowsAPIController(BaseAPIController, UsesStoredWorkflowMixin, UsesAnn
     def __get_stored_workflow(self, trans, workflow_id):
         return self.workflow_manager.get_stored_workflow(trans, workflow_id)
 
-    def __encode_invocation(self, invocation, **kwd):
-        return self.workflow_manager.serialize_workflow_invocation(invocation, **kwd)
+    def __encode_invocation(self, trans, invocation, view="element", step_details=False, legacy_job_state=False):
+        return self.encode_all_ids(
+            trans,
+            invocation.to_dict(view, step_details=step_details, legacy_job_state=legacy_job_state),
+            True
+        )
diff --git a/lib/galaxy/webapps/galaxy/config_schema.yml b/lib/galaxy/webapps/galaxy/config_schema.yml
index a53d32821f8..243e8bd5fde 100644
--- a/lib/galaxy/webapps/galaxy/config_schema.yml
+++ b/lib/galaxy/webapps/galaxy/config_schema.yml
@@ -45,7 +45,7 @@ mapping:
 
       cookie_path:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           If proxy-prefix is enabled and you're running more than one Galaxy instance
@@ -109,7 +109,7 @@ mapping:
 
       database_template:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           If auto-creating a postgres database on startup - it can be based on an existing
@@ -343,7 +343,7 @@ mapping:
 
       watch_tools:
         type: str
-        default: false
+        default: 'false'
         required: false
         desc: |
           Set to True to enable monitoring of tools and tool directories
@@ -394,7 +394,7 @@ mapping:
 
       containers_resolvers_config_file:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Container resolvers configuration (beta). Setup a file describing container
@@ -490,7 +490,7 @@ mapping:
 
       watch_tool_data_dir:
         type: str
-        default: false
+        default: 'false'
         required: false
         desc: |
           Set to True to enable monitoring of the tool_data and shed_tool_data_path
@@ -653,7 +653,7 @@ mapping:
           Number of checks to execute if check_job_script_integrity is enabled.
 
       check_job_script_integrity_sleep:
-        type: str
+        type: float
         default: .25
         required: false
         desc: |
@@ -720,7 +720,7 @@ mapping:
 
       smtp_server:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Galaxy sends mail for various things: subscribing users to the mailing list
@@ -731,7 +731,7 @@ mapping:
 
       smtp_username:
         type: str
-        default: null
+        default: '' 
         required: false
         desc: |
           If your SMTP server requires a username and password, you can provide them
@@ -740,7 +740,7 @@ mapping:
 
       smtp_password:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           If your SMTP server requires a username and password, you can provide them
@@ -765,7 +765,7 @@ mapping:
 
       error_email_to:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Datasets in an error state include a link to report the error.  Those reports
@@ -775,7 +775,7 @@ mapping:
 
       email_from:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Email address to use in the 'From' field when sending emails for
@@ -859,7 +859,7 @@ mapping:
 
       ga_code:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           You can enter tracking code here to track visitor's behavior
@@ -911,7 +911,7 @@ mapping:
 
       message_box_content:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Show a message box under the masthead.
@@ -925,7 +925,7 @@ mapping:
 
       brand:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Append "/{brand}" to the "Galaxy" text in the masthead.
@@ -1013,21 +1013,21 @@ mapping:
 
       biostar_url:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Enable integration with a custom Biostar instance.
 
       biostar_key_name:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Enable integration with a custom Biostar instance.
 
       biostar_key:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Enable integration with a custom Biostar instance.
@@ -1084,7 +1084,7 @@ mapping:
 
       terms_url:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           The URL linked by the "Terms and Conditions" link in the "Help" menu, as well
@@ -1198,7 +1198,7 @@ mapping:
 
       nginx_x_accel_redirect_base:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           The same download handling can be done by nginx using X-Accel-Redirect.  This
@@ -1230,7 +1230,7 @@ mapping:
 
       nginx_upload_store:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           nginx can also handle file uploads (user-to-Galaxy) via nginx_upload_module.
@@ -1240,7 +1240,7 @@ mapping:
 
       nginx_upload_path:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           This value overrides the action set on the file upload form, e.g. the web
@@ -1249,7 +1249,7 @@ mapping:
 
       nginx_upload_job_files_store:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Galaxy can also use nginx_upload_module to receive files staged out upon job
@@ -1259,7 +1259,7 @@ mapping:
 
       nginx_upload_job_files_path:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Galaxy can also use nginx_upload_module to receive files staged out upon job
@@ -1374,7 +1374,7 @@ mapping:
 
       dynamic_proxy_golang_api_key:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           The golang proxy uses a RESTful HTTP API for communication with Galaxy
@@ -1401,7 +1401,7 @@ mapping:
 
       logging:
         type: map
-        default: galaxy.config.LOGGING_CONFIG_DEFAULT
+        allowempty: True
         desc: |
           Controls where and how the server logs messages. If unset, the default is to log all messages to standard
           output at the level defined by the `log_level` configuration option. Configuration is described in the
@@ -1494,7 +1494,7 @@ mapping:
 
       allowed_origin_hostnames:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Return a Access-Control-Allow-Origin response header that matches the Origin
@@ -1591,7 +1591,7 @@ mapping:
 
       sentry_dsn:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Log to Sentry
@@ -1658,7 +1658,7 @@ mapping:
 
       library_import_dir:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Add an option to the library upload form which allows administrators to
@@ -1666,7 +1666,7 @@ mapping:
 
       user_library_import_dir:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Add an option to the library upload form which allows authorized
@@ -1685,7 +1685,7 @@ mapping:
 
       user_library_import_symlink_whitelist:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           For security reasons, users may not import any files that actually lie
@@ -1739,7 +1739,7 @@ mapping:
 
       tool_name_boost:
         type: float
-        default: 9
+        default: 9.0
         required: false
         desc: |
           Boosts are used to customize this instance's toolbox search.
@@ -1749,7 +1749,7 @@ mapping:
 
       tool_section_boost:
         type: float
-        default: 3
+        default: 3.0
         required: false
         desc: |
           Boosts are used to customize this instance's toolbox search.
@@ -1759,7 +1759,7 @@ mapping:
 
       tool_description_boost:
         type: float
-        default: 2
+        default: 2.0
         required: false
         desc: |
           Boosts are used to customize this instance's toolbox search.
@@ -1769,7 +1769,7 @@ mapping:
 
       tool_label_boost:
         type: float
-        default: 1
+        default: 1.0
         required: false
         desc: |
           Boosts are used to customize this instance's toolbox search.
@@ -1779,7 +1779,7 @@ mapping:
 
       tool_stub_boost:
         type: float
-        default: 5
+        default: 5.0
         required: false
         desc: |
           Boosts are used to customize this instance's toolbox search.
@@ -1865,7 +1865,7 @@ mapping:
 
       remote_user_maildomain:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           If use_remote_user is enabled and your external authentication
@@ -1897,7 +1897,7 @@ mapping:
 
       remote_user_logout_href:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           If use_remote_user is enabled, you can set this to a URL that will log your
@@ -1924,7 +1924,7 @@ mapping:
 
       admin_users:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Administrative users - set this to a comma-separated list of valid Galaxy
@@ -2155,7 +2155,7 @@ mapping:
           invocation to schedule indefinitely. The default corresponds to 1 month.
 
       maximum_workflow_jobs_per_scheduling_iteration:
-        type: str
+        type: int
         default: -1
         required: false
         desc: |
@@ -2228,7 +2228,7 @@ mapping:
 
       api_allow_run_as:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Optional list of email addresses of API users who can make calls on behalf of
@@ -2274,7 +2274,7 @@ mapping:
 
       ftp_upload_dir:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           Enable Galaxy's "Upload via FTP" interface.  You'll need to install and
@@ -2285,7 +2285,7 @@ mapping:
 
       ftp_upload_site:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           This should be the hostname of your FTP server, which will be provided to
@@ -2565,7 +2565,7 @@ mapping:
 
       environment_setup_file:
         type: str
-        default: null
+        default: ''
         required: false
         desc: |
           File to source to set up the environment when running jobs.  By default, the
@@ -2720,3 +2720,12 @@ mapping:
         required: false
         desc: |
           persistent_communication_rooms is a comma-separated list of rooms that should be always available.
+
+      use_pbkdf2:
+        type: bool
+        default: true
+        required: false
+        desc: |
+          Allow disabling pbkdf2 hashing of passwords for legacy situations.
+          This should normally be left enabled unless there is a specific
+          reason to disable it.