diff --git a/addons/auth/addon/authenticators/password.js b/addons/auth/addon/authenticators/password.js
index eb383d6c8..814fffc22 100644
--- a/addons/auth/addon/authenticators/password.js
+++ b/addons/auth/addon/authenticators/password.js
@@ -46,8 +46,17 @@ export default class PasswordAuthenticator extends BaseAuthenticator {
   async restore(data) {
     if (!data) return reject();
     const tokenID = data.id;
+    const token = data.token;
     const tokenValidationURL = this.buildTokenValidationEndpointURL(tokenID);
-    const response = await fetch(tokenValidationURL, { method: 'get' });
+    const response = await fetch(tokenValidationURL, {
+      method: 'get',
+      headers: {
+        // TODO:  this is temporary to get the call working, but generating
+        // the auth header originated in the application authenticator.
+        // It should probably be factored out into a method on the base.
+        'Authorization': `Bearer ${token}`
+      }
+    });
     // 401 and 404 responses mean the token is invalid, whereas other types of
     // error responses do not tell us about the validity of the token.
     switch (response.status) {
diff --git a/addons/rose/addon/components/rose/form/index.hbs b/addons/rose/addon/components/rose/form/index.hbs
index 045ad70c4..80b027371 100644
--- a/addons/rose/addon/components/rose/form/index.hbs
+++ b/addons/rose/addon/components/rose/form/index.hbs
@@ -9,6 +9,10 @@
   {{!--
     Only show the edit toggle button if the toggle is enabled in the first place
     AND the form is not already in editable mode.
+
+    The cancel button's disabled state depends on the mode.  In edit mode,
+    the cancel button is only disabled if the disabled argument is true,
+    otherwise it is disabled based on the computed property this.disabled.
   --}}
   {{yield (hash
     radioGroup=(component 'rose/form/radio/group' disabled=this.disabled)
@@ -22,7 +26,7 @@
         'rose/form/actions'
       )
       submitDisabled=this.disabled
-      cancelDisabled=(if @showEditToggle false this.disabled)
+      cancelDisabled=(if @showEditToggle @disabled this.disabled)
       cancel=this.handleCancel
       enableEdit=this.enableEdit
     )
diff --git a/addons/rose/addon/components/rose/header/nav/index.hbs b/addons/rose/addon/components/rose/header/nav/index.hbs
index a0858cc1a..a045a7d0a 100644
--- a/addons/rose/addon/components/rose/header/nav/index.hbs
+++ b/addons/rose/addon/components/rose/header/nav/index.hbs
@@ -1,4 +1,4 @@
-<nav class="rose-header-nav">
+<nav class="rose-header-nav" aria-label="header-nav">
   {{yield (hash
     link=(component 'link-to' class="rose-header-nav-link")
     dropdown=(component 'rose/dropdown')
diff --git a/ui/core/app/routes/scopes/scope.js b/ui/core/app/routes/scopes/scope.js
index 820f7caf2..2cbe96d88 100644
--- a/ui/core/app/routes/scopes/scope.js
+++ b/ui/core/app/routes/scopes/scope.js
@@ -33,4 +33,12 @@ export default class ScopesScopeRoute extends Route {
       );
     });
   }
+
+  /**
+   * Set scope in application controller
+   */
+  afterModel() {
+    const scope = this.modelFor('scopes.scope');
+    this.controllerFor('application').set('scope', scope);
+  }
 }
diff --git a/ui/core/app/templates/application.hbs b/ui/core/app/templates/application.hbs
index 30d1302fe..b38e02f4d 100644
--- a/ui/core/app/templates/application.hbs
+++ b/ui/core/app/templates/application.hbs
@@ -7,6 +7,12 @@
     <Rose::Header class="{{if (is-loading) " loading"}}" as |header|>
       <header.brand @logo="logo-boundary" @text={{app-name}} />
       {{#if this.session.isAuthenticated}}
+        <header.nav as |nav|>
+          {{#if this.scope.isOrg}}
+            <nav.link @route="scopes.scope" @model={{this.scope}}>{{this.scope.displayName}}</nav.link>
+          {{/if}}
+        </header.nav>
+
         <header.utilities as |utilities|>
           <utilities.dropdown
             @text="user@example.net"