heh - finally got it sorted using a different account. Fun times. I thought I had a client running as an IdP but... confirmed they're not which lowers the blood pressure a bit.