diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index ffe6cd8..274ed9f 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -1,70 +1,70 @@
 name: Build container image, publish as GitHub-package
 
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support
 # documentation.
 
 on:
   push:
     branches: [ main, develop ]
     # Publish semver tags as releases.
     tags:
       - 'v*.*.*'
 
 env:
   # Use docker.io for Docker Hub if empty
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
 
       # Set up QEMU for cross-building
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4.0.0
 
       # Set up Docker Buildx
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.1.0
+        uses: docker/setup-buildx-action@v4.2.0
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Extract metadata (tags, labels) for Docker
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v6.1.0
+        uses: docker/metadata-action@v6.2.0
         with:
           images: |
             ghcr.io/${{ github.repository }}
           flavor: latest=true
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker images
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/Makefile b/Makefile
index 72c49b2..5b9157e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,158 +1,158 @@
 GITREV=`git describe | cut -c 2-`
 LDFLAGS=-ldflags="-s -w -X 'github.com/writefreely/writefreely.softwareVer=$(GITREV)' -extldflags '-static'"
 BASELDFLAGS=-ldflags="-s -w -X 'github.com/writefreely/writefreely.softwareVer=$(GITREV)'"
 
 GOCMD=go
 GOINSTALL=$(GOCMD) install $(LDFLAGS)
 GOBUILD=$(GOCMD) build $(LDFLAGS)
 GOTEST=$(GOCMD) test $(LDFLAGS)
 GOGET=$(GOCMD) get
 BINARY_NAME=writefreely
 BUILDPATH=build/$(BINARY_NAME)
 DOCKERCMD=docker
 IMAGE_NAME=writeas/writefreely
 TMPBIN=./tmp
 
 all : build
 
 ci: deps
 	cd cmd/writefreely; $(GOBUILD) -v
 
 build: deps
 	cd cmd/writefreely; $(GOBUILD) -v -tags='netgo sqlite'
 
 build-no-sqlite: deps-no-sqlite
 	cd cmd/writefreely; $(GOBUILD) -v -tags='netgo' -o $(BINARY_NAME)
 
 build-linux: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=linux/amd64, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=linux/amd64, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-windows: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=windows/amd64, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=windows/amd64, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-darwin: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=darwin/amd64, -dest build/ $(BASELDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=darwin/amd64, -dest build/ $(BASELDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-darwin-arm64: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=darwin/arm64, -dest build/ $(BASELDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=darwin/arm64, -dest build/ $(BASELDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-arm6: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=linux/arm-6, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=linux/arm-6, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-arm7: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=linux/arm-7, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=linux/arm-7, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-arm64: deps
 	@hash xgo > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GOCMD) install src.techknowlogick.com/xgo@latest; \
 	fi
-	xgo --targets=linux/arm64, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.23.x -out writefreely -pkg ./cmd/writefreely .
+	xgo --targets=linux/arm64, -dest build/ $(LDFLAGS) -tags='netgo sqlite' -go go-1.25.x -out writefreely -pkg ./cmd/writefreely .
 
 build-docker :
 	$(DOCKERCMD) build -t $(IMAGE_NAME):latest -t $(IMAGE_NAME):$(GITREV) .
 
 test:
 	$(GOTEST) -v ./...
 
 run:
 	$(GOINSTALL) -tags='netgo sqlite' ./...
 	$(BINARY_NAME) --debug
 
 deps :
 	$(GOGET) -tags='sqlite' -d -v ./...
 
 deps-no-sqlite:
 	$(GOGET) -d -v ./...
 
 install : build
 	cmd/writefreely/$(BINARY_NAME) --config
 	cmd/writefreely/$(BINARY_NAME) --gen-keys
 	cmd/writefreely/$(BINARY_NAME) --init-db
 	cd less/; $(MAKE) install $(MFLAGS)
 
 release : clean ui
 	mkdir -p $(BUILDPATH)
 	rsync -av --exclude=".*" templates $(BUILDPATH)
 	rsync -av --exclude=".*" pages $(BUILDPATH)
 	rsync -av --exclude=".*" static $(BUILDPATH)
 	rm -r $(BUILDPATH)/static/local
 	scripts/invalidate-css.sh $(BUILDPATH)
 	mkdir $(BUILDPATH)/keys
 	$(MAKE) build-linux
 	mv build/$(BINARY_NAME)-linux-amd64 $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_linux_amd64.tar.gz -C build $(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME)
 	$(MAKE) build-arm6
 	mv build/$(BINARY_NAME)-linux-arm-6 $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_linux_arm6.tar.gz -C build $(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME)
 	$(MAKE) build-arm7
 	mv build/$(BINARY_NAME)-linux-arm-7 $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_linux_arm7.tar.gz -C build $(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME)
 	$(MAKE) build-arm64
 	mv build/$(BINARY_NAME)-linux-arm64 $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_linux_arm64.tar.gz -C build $(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME)
 	$(MAKE) build-darwin
 	mv build/$(BINARY_NAME)-darwin-10.12-amd64 $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_macos_amd64.tar.gz -C build $(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME)
 	$(MAKE) build-darwin-arm64
 	mv build/$(BINARY_NAME)-darwin-10.12-arm64 $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_macos_arm64.tar.gz -C build $(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME)
 	$(MAKE) build-windows
 	mv build/$(BINARY_NAME)-windows-4.0-amd64.exe $(BUILDPATH)/$(BINARY_NAME).exe
 	cd build; zip -r ../$(BINARY_NAME)_$(GITREV)_windows_amd64.zip ./$(BINARY_NAME)
 	rm $(BUILDPATH)/$(BINARY_NAME).exe
 
 # This assumes you're on linux/amd64
 release-linux : clean ui
 	mkdir -p $(BUILDPATH)
 	cp -r templates $(BUILDPATH)
 	cp -r pages $(BUILDPATH)
 	cp -r static $(BUILDPATH)
 	mkdir $(BUILDPATH)/keys
 	$(MAKE) build-no-sqlite
 	mv cmd/writefreely/$(BINARY_NAME) $(BUILDPATH)/$(BINARY_NAME)
 	tar -cvzf $(BINARY_NAME)_$(GITREV)_linux_amd64.tar.gz -C build $(BINARY_NAME)
 
 release-docker :
 	$(DOCKERCMD) push $(IMAGE_NAME)
 
 ui : force_look
 	cd less/; $(MAKE) $(MFLAGS)
 	cd prose/; $(MAKE) $(MFLAGS)
 
 $(TMPBIN):
 	mkdir -p $(TMPBIN)
 
 $(TMPBIN)/xgo: deps $(TMPBIN)
 	$(GOBUILD) -o $(TMPBIN)/xgo src.techknowlogick.com/xgo
 
 clean :
 	-rm -rf build
 	-rm -rf tmp
 	cd less/; $(MAKE) clean $(MFLAGS)
 
 force_look :
 	true
diff --git a/README.md b/README.md
index 8a9579a..61dad98 100644
--- a/README.md
+++ b/README.md
@@ -1,90 +1,87 @@
 &nbsp;
 <p align="center">
 	<a href="https://writefreely.org"><img src="https://writefreely.org/img/writefreely.svg" width="350px" alt="WriteFreely" /></a>
 </p>
 <hr />
 <p align="center">
 	<a href="https://github.com/writefreely/writefreely/releases/">
 		<img src="https://img.shields.io/github/release/writefreely/writefreely.svg" alt="Latest release" />
 	</a>
 	<a href="https://github.com/writefreely/writefreely/releases/latest">
 		<img src="https://img.shields.io/github/downloads/writefreely/writefreely/total.svg" />
 	</a>
-	<a href="https://goreportcard.com/report/github.com/writefreely/writefreely">
-		<img src="https://goreportcard.com/badge/github.com/writefreely/writefreely" alt="Go Report Card" />
-	</a>
 	<a href="https://ghcr.io/writefreely/writefreely">
 		<img src="https://img.shields.io/badge/docker-%230db7ed.svg?logo=docker&logoColor=white" />
 	</a>
 	<a href="https://github.com/writefreely/writefreely/actions/workflows/docker-publish.yml">
 		<img src="https://github.com/writefreely/writefreely/actions/workflows/docker-publish.yml/badge.svg" alt="Build container image, publish as GitHub-package" />
 	</a>
 </p>
 &nbsp;
 
 WriteFreely is a clean, minimalist publishing platform made for writers. Start a blog, share knowledge within your organization, or build a community around the shared act of writing.
 
 ![Screenshot of the Reader view of a WriteFreely instance, pen.writefree.ly.](https://files.writefreely.org/img/screens/pen-reader.png)
 
 [Try the writing experience](https://write.as/new)
 
 [Find an instance](https://writefreely.org/instances)
 
 ## Features
 
 ### Made for writing
 
 Built on a plain, auto-saving editor, WriteFreely gives you a distraction-free writing environment. Once published, your words are front and center, and easy to read.
 
 ### A connected community
 
 Start writing together, publicly or privately. Connect with other communities, whether running WriteFreely, [Plume](https://joinplu.me/), or other ActivityPub-powered software. And bring members on board from your existing platforms, thanks to our OAuth 2.0 support.
 
 ### Intuitive organization
 
 Categorize articles [with hashtags](https://writefreely.org/docs/latest/writer/hashtags), and create static pages from normal posts by [_pinning_ them](https://writefreely.org/docs/latest/writer/static) to your blog. Create draft posts and publish to multiple blogs from one account.
 
 ### International
 
 Blog elements are localized in 20+ languages, and WriteFreely includes first-class support for non-Latin and right-to-left (RTL) script languages.
 
 ### Private by default
 
 WriteFreely collects minimal data, and never publicizes more than a writer consents to. Writers can seamlessly create multiple blogs from a single account for different pen names or purposes without publicly revealing their association.
 
 <h2><a href="https://write.as/writefreely"><img src="https://writefreely.org/img/writeas-readme.png" height="32px" alt="Write.as" /></a></h2>
 
 The quickest way to deploy WriteFreely is with [Write.as](https://write.as/writefreely), a hosted service from the team behind WriteFreely. You'll get fully-managed installation, backup, upgrades, and maintenance — and directly fund our free software work ❤️
 
 [**Learn more on Write.as**](https://write.as/writefreely).
 
 ## Quick start
 
 WriteFreely deploys as a static binary on any platform and architecture that Go supports. Just use our built-in SQLite support, or add a MySQL or MariaDB database, and you'll be up and running!
 
 For common platforms, start with our [pre-built binaries](https://github.com/writefreely/writefreely/releases/) and head over to our [installation guide](https://writefreely.org/start) to get started.
 
 ### Packages
 
 You can also find WriteFreely in these package repositories, thanks to our wonderful community!
 
 * [Arch User Repository](https://aur.archlinux.org/packages/writefreely/)
 * [Nanos Repository](https://repo.ops.city/v2/packages/eyberg/writefreely/show)
 
 ## Documentation
 
 Read our full [documentation on WriteFreely.org](https://writefreely.org/docs) &mdash;️ and help us improve by contributing to the [writefreely/documentation](https://github.com/writefreely/documentation) repo.
 
 ## Development
 
 Start hacking on WriteFreely with our [developer setup guide](https://writefreely.org/docs/latest/developer/setup). For Docker support, see our [Docker guide](https://writefreely.org/docs/latest/admin/docker).
 
 ## Contributing
 
 We gladly welcome contributions to WriteFreely, whether in the form of [code](https://github.com/writefreely/writefreely/blob/master/CONTRIBUTING.md#contributing-to-writefreely), [bug reports](https://github.com/writefreely/writefreely/issues/new?template=bug_report.md), [feature requests](https://discuss.write.as/c/feedback/feature-requests), [translations](https://poeditor.com/join/project/TIZ6HFRFdE), or [documentation](https://github.com/writefreely/documentation) improvements.
 
 Before contributing anything, please read our [Contributing Guide](https://github.com/writefreely/writefreely/blob/master/CONTRIBUTING.md#contributing-to-writefreely). It describes the correct channels for submitting contributions and any potential requirements.
 
 ## License
 
 Copyright © 2018-2026 [Musing Studio LLC](https://musing.studio) and contributing authors. Licensed under the [AGPL](https://github.com/writefreely/writefreely/blob/develop/LICENSE).
diff --git a/account.go b/account.go
index e187ab8..502a5c8 100644
--- a/account.go
+++ b/account.go
@@ -1,1550 +1,1566 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"regexp"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/gorilla/csrf"
 	"github.com/gorilla/mux"
 	"github.com/gorilla/sessions"
 	"github.com/guregu/null/zero"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/author"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/mailer"
 	"github.com/writefreely/writefreely/page"
 	"github.com/writefreely/writefreely/spam"
 )
 
 type (
 	userSettings struct {
 		Username string `schema:"username" json:"username"`
 		Email    string `schema:"email" json:"email"`
 		NewPass  string `schema:"new-pass" json:"new_pass"`
 		OldPass  string `schema:"current-pass" json:"current_pass"`
 		IsLogOut bool   `schema:"logout" json:"logout"`
 	}
 
 	UserPage struct {
 		page.StaticPage
 
 		PageTitle string
 		Separator template.HTML
 		IsAdmin   bool
 		CanInvite bool
 		CollAlias string
 	}
 )
 
 const maxPassByteLen = 72
 
 func NewUserPage(app *App, r *http.Request, u *User, title string, flashes []string) *UserPage {
 	up := &UserPage{
 		StaticPage: pageForReq(app, r),
 		PageTitle:  title,
 	}
 	up.Username = u.Username
 	up.Flashes = flashes
 	up.Path = r.URL.Path
 	up.IsAdmin = u.IsAdmin()
 	up.CanInvite = canUserInvite(app.cfg, up.IsAdmin)
 	return up
 }
 
 func canUserInvite(cfg *config.Config, isAdmin bool) bool {
 	return cfg.App.UserInvites != "" &&
 		(isAdmin || cfg.App.UserInvites != "admin")
 }
 
 func (up *UserPage) SetMessaging(u *User) {
 	// up.NeedsAuth = app.db.DoesUserNeedAuth(u.ID)
 }
 
 const (
 	loginAttemptExpiration = 3 * time.Second
 )
 
 var actuallyUsernameReg = regexp.MustCompile("username is actually ([a-z0-9\\-]+)\\. Please try that, instead")
 
 func apiSignup(app *App, w http.ResponseWriter, r *http.Request) error {
 	_, err := signup(app, w, r)
 	return err
 }
 
 func signup(app *App, w http.ResponseWriter, r *http.Request) (*AuthUser, error) {
 	if app.cfg.App.DisablePasswordAuth {
 		err := ErrDisabledPasswordAuth
 		return nil, err
 	}
 
 	reqJSON := IsJSON(r)
 
 	// Get params
 	var ur userRegistration
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&ur)
 		if err != nil {
 			log.Error("Couldn't parse signup JSON request: %v\n", err)
 			return nil, ErrBadJSON
 		}
 	} else {
 		// Check if user is already logged in
 		u := getUserSession(app, r)
 		if u != nil {
 			return &AuthUser{User: u}, nil
 		}
 
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse signup form request: %v\n", err)
 			return nil, ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&ur, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode signup form request: %v\n", err)
 			return nil, ErrBadFormData
 		}
 	}
 
 	return signupWithRegistration(app, ur, w, r)
 }
 
 func signupWithRegistration(app *App, signup userRegistration, w http.ResponseWriter, r *http.Request) (*AuthUser, error) {
 	reqJSON := IsJSON(r)
 
+	// Signup checks are enforced here to keep them from being bypassed on different endpoints.
+	if app.cfg.App.DisablePasswordAuth {
+		return nil, ErrDisabledPasswordAuth
+	}
+	// Closed registration requires a valid, active invite code.
+	if err := app.canRegister(signup.InviteCode); err != nil {
+		return nil, err
+	}
+
 	// Validate required params (alias)
 	if signup.Alias == "" {
 		return nil, impart.HTTPError{http.StatusBadRequest, "A username is required."}
 	}
 	if signup.Pass == "" {
 		return nil, impart.HTTPError{http.StatusBadRequest, "A password is required."}
 	}
 	var desiredUsername string
 	if signup.Normalize {
 		// With this option we simply conform the username to what we expect
 		// without complaining. Since they might've done something funny, like
 		// enter: write.as/Way Out There, we'll use their raw input for the new
 		// collection name and sanitize for the slug / username.
 		desiredUsername = signup.Alias
 		signup.Alias = getSlug(signup.Alias, "")
 	}
 	if !author.IsValidUsername(app.cfg, signup.Alias) {
 		// Ensure the username is syntactically correct.
 		return nil, impart.HTTPError{http.StatusPreconditionFailed, "Username is reserved or isn't valid. It must be at least 3 characters long, and can only include letters, numbers, and hyphens."}
 	}
 
 	// Handle empty optional params
 	hashedPass, err := auth.HashPass([]byte(signup.Pass))
 	if err != nil {
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Create struct to insert
 	u := &User{
 		Username:   signup.Alias,
 		HashedPass: hashedPass,
 		HasPass:    true,
 		Email:      prepareUserEmail(signup.Email, app.keys.EmailKey),
 		Created:    time.Now().Truncate(time.Second).UTC(),
 	}
 
 	// Create actual user
 	if err := app.db.CreateUser(app.cfg, u, desiredUsername, signup.Description); err != nil {
 		return nil, err
 	}
 
 	// Log invite if needed
 	if signup.InviteCode != "" {
 		err = app.db.CreateInvitedUser(signup.InviteCode, u.ID)
 		if err != nil {
 			return nil, err
 		}
 	}
 
 	// Add back unencrypted data for response
 	if signup.Email != "" {
 		u.Email.String = signup.Email
 	}
 
 	resUser := &AuthUser{
 		User: u,
 	}
 	title := signup.Alias
 	if signup.Normalize {
 		title = desiredUsername
 	}
 	resUser.Collections = &[]Collection{
 		{
 			Alias:       signup.Alias,
 			Title:       title,
 			Description: signup.Description,
 		},
 	}
 
 	var coll *Collection
 	if signup.Monetization != "" {
 		if coll == nil {
 			coll, err = app.db.GetCollection(signup.Alias)
 			if err != nil {
 				log.Error("Unable to get new collection '%s' for monetization on signup: %v", signup.Alias, err)
 				return nil, err
 			}
 		}
 		err = app.db.SetCollectionAttribute(coll.ID, "monetization_pointer", signup.Monetization)
 		if err != nil {
 			log.Error("Unable to add monetization on signup: %v", err)
 			return nil, err
 		}
 		coll.Monetization = signup.Monetization
 	}
 
 	var token string
 	if reqJSON && !signup.Web {
 		token, err = app.db.GetAccessToken(u.ID)
 		if err != nil {
 			return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
 		}
 		resUser.AccessToken = token
 	} else {
 		session, err := app.sessionStore.Get(r, cookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
 			log.Error("Session: %v; ignoring", err)
 		}
 		session.Values[cookieUserVal] = resUser.User.Cookie()
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Couldn't save session: %v", err)
 			return nil, err
 		}
 	}
 	if reqJSON {
 		return resUser, impart.WriteSuccess(w, resUser, http.StatusCreated)
 	}
 
 	return resUser, nil
 }
 
 func viewLogout(app *App, w http.ResponseWriter, r *http.Request) error {
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		return ErrInternalCookieSession
 	}
 
 	// Ensure user has an email or password set before they go, so they don't
 	// lose access to their account.
 	val := session.Values[cookieUserVal]
 	var u = &User{}
 	var ok bool
 	if u, ok = val.(*User); !ok {
 		log.Error("Error casting user object on logout. Vals: %+v Resetting cookie.", session.Values)
 
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Couldn't save session on logout: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
 		}
 
 		return impart.HTTPError{http.StatusFound, "/"}
 	}
 
 	u, err = app.db.GetUserByID(u.ID)
 	if err != nil && err != ErrUserNotFound {
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to fetch user information."}
 	}
 
 	session.Options.MaxAge = -1
 
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't save session on logout: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
 	}
 
 	return impart.HTTPError{http.StatusFound, "/"}
 }
 
 func handleAPILogout(app *App, w http.ResponseWriter, r *http.Request) error {
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		return ErrNoAccessToken
 	}
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return ErrNoAccessToken
 	}
 	err := app.db.DeleteToken(t)
 	if err != nil {
 		return err
 	}
 	return impart.HTTPError{Status: http.StatusNoContent}
 }
 
 func viewLogin(app *App, w http.ResponseWriter, r *http.Request) error {
 	var earlyError string
 	oneTimeToken := r.FormValue("with")
 	if oneTimeToken != "" {
 		log.Info("Calling login with one-time token.")
 		err := login(app, w, r)
 		if err != nil {
 			log.Info("Received error: %v", err)
 			earlyError = fmt.Sprintf("%s", err)
 		}
 	}
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// Ignore this
 		log.Error("Unable to get session; ignoring: %v", err)
 	}
 
 	p := &struct {
 		page.StaticPage
 		*OAuthButtons
 		To            string
 		Message       template.HTML
 		Flashes       []template.HTML
 		EmailEnabled  bool
 		LoginUsername string
 	}{
 		StaticPage:    pageForReq(app, r),
 		OAuthButtons:  NewOAuthButtons(app.Config()),
 		To:            r.FormValue("to"),
 		Message:       template.HTML(""),
 		Flashes:       []template.HTML{},
 		EmailEnabled:  app.cfg.Email.Enabled(),
 		LoginUsername: getTempInfo(app, "login-user", r, w),
 	}
 
 	if earlyError != "" {
 		p.Flashes = append(p.Flashes, template.HTML(earlyError))
 	}
 
 	// Display any error messages
 	flashes, _ := getSessionFlashes(app, w, r, session)
 	for _, flash := range flashes {
 		p.Flashes = append(p.Flashes, template.HTML(flash))
 	}
 	err = pages["login.tmpl"].ExecuteTemplate(w, "base", p)
 	if err != nil {
 		log.Error("Unable to render login: %v", err)
 		return err
 	}
 	return nil
 }
 
 func webLogin(app *App, w http.ResponseWriter, r *http.Request) error {
 	err := login(app, w, r)
 	if err != nil {
 		username := r.FormValue("alias")
 		// Login request was unsuccessful; save the error in the session and redirect them
 		if err, ok := err.(impart.HTTPError); ok {
 			session, _ := app.sessionStore.Get(r, cookieName)
 			if session != nil {
 				session.AddFlash(err.Message)
 				session.Save(r, w)
 			}
 
 			if m := actuallyUsernameReg.FindStringSubmatch(err.Message); len(m) > 0 {
 				// Retain fixed username recommendation for the login form
 				username = m[1]
 			}
 		}
 
 		// Pass along certain information
 		saveTempInfo(app, "login-user", username, r, w)
 
 		// Retain post-login URL if one was given
 		redirectTo := "/login"
 		postLoginRedirect := r.FormValue("to")
-		if postLoginRedirect != "" {
+		if postLoginRedirect != "" && strings.HasPrefix(postLoginRedirect, "/") && !strings.HasPrefix(postLoginRedirect, "//") {
 			redirectTo += "?to=" + postLoginRedirect
 		}
 
 		log.Error("Unable to login: %v", err)
 		return impart.HTTPError{http.StatusTemporaryRedirect, redirectTo}
 	}
 
 	return nil
 }
 
 var loginAttemptUsers = sync.Map{}
 
 func login(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	oneTimeToken := r.FormValue("with")
 	verbose := r.FormValue("all") == "true" || r.FormValue("verbose") == "1" || r.FormValue("verbose") == "true" || (reqJSON && oneTimeToken != "")
 
 	redirectTo := r.FormValue("to")
-	if redirectTo == "" {
+	if redirectTo == "" || !strings.HasPrefix(redirectTo, "/") || strings.HasPrefix(redirectTo, "//") {
 		if app.cfg.App.SingleUser {
 			redirectTo = "/me/new"
 		} else {
 			redirectTo = "/"
 		}
 	}
 
 	var u *User
 	var err error
 	var signin userCredentials
 
 	if app.cfg.App.DisablePasswordAuth {
 		err := ErrDisabledPasswordAuth
 		return err
 	}
 
 	// Log in with one-time token if one is given
 	if oneTimeToken != "" {
 		log.Info("Login: Logging user in via token.")
 		userID := app.db.GetUserID(oneTimeToken)
 		if userID == -1 {
 			log.Error("Login: Got user -1 from token")
 			err := ErrBadAccessToken
 			err.Message = "Expired or invalid login code."
 			return err
 		}
 		log.Info("Login: Found user %d.", userID)
 
 		u, err = app.db.GetUserByID(userID)
 		if err != nil {
 			log.Error("Unable to fetch user on one-time token login: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "There was an error retrieving the user you want."}
 		}
 		log.Info("Login: Got user via token")
 	} else {
 		// Get params
 		if reqJSON {
 			decoder := json.NewDecoder(r.Body)
 			err := decoder.Decode(&signin)
 			if err != nil {
 				log.Error("Couldn't parse signin JSON request: %v\n", err)
 				return ErrBadJSON
 			}
 		} else {
 			err := r.ParseForm()
 			if err != nil {
 				log.Error("Couldn't parse signin form request: %v\n", err)
 				return ErrBadFormData
 			}
 
 			err = app.formDecoder.Decode(&signin, r.PostForm)
 			if err != nil {
 				log.Error("Couldn't decode signin form request: %v\n", err)
 				return ErrBadFormData
 			}
 		}
 
 		log.Info("Login: Attempting login for '%s'", signin.Alias)
 
 		// Validate required params (all)
 		if signin.Alias == "" {
 			msg := "Parameter `alias` required."
 			if signin.Web {
 				msg = "A username is required."
 			}
 			return impart.HTTPError{http.StatusBadRequest, msg}
 		}
 		if !signin.EmailLogin && signin.Pass == "" {
 			msg := "Parameter `pass` required."
 			if signin.Web {
 				msg = "A password is required."
 			}
 			return impart.HTTPError{http.StatusBadRequest, msg}
 		}
 
 		// Prevent excessive login attempts on the same account
 		// Skip this check in dev environment
 		if !app.cfg.Server.Dev {
 			now := time.Now()
 			attemptExp, att := loginAttemptUsers.LoadOrStore(signin.Alias, now.Add(loginAttemptExpiration))
 			if att {
 				if attemptExpTime, ok := attemptExp.(time.Time); ok {
 					if attemptExpTime.After(now) {
 						// This user attempted previously, and the period hasn't expired yet
 						return impart.HTTPError{http.StatusTooManyRequests, "You're doing that too much."}
 					} else {
 						// This user attempted previously, but the time expired; free up space
 						loginAttemptUsers.Delete(signin.Alias)
 					}
 				} else {
 					log.Error("Unable to cast expiration to time")
 				}
 			}
 		}
 
 		// Retrieve password
 		u, err = app.db.GetUserForAuth(signin.Alias)
 		if err != nil {
 			log.Info("Unable to getUserForAuth on %s: %v", signin.Alias, err)
 			if strings.IndexAny(signin.Alias, "@") > 0 {
 				log.Info("Suggesting: %s", ErrUserNotFoundEmail.Message)
 				return ErrUserNotFoundEmail
 			}
 			return err
 		}
 		// Authenticate
 		if u.Email.String == "" {
 			// User has no email set, so check if they haven't added a password, either,
 			// so we can return a more helpful error message.
 			if hasPass, _ := app.db.IsUserPassSet(u.ID); !hasPass {
 				log.Info("Tried logging into %s, but no password or email.", signin.Alias)
 				return impart.HTTPError{http.StatusPreconditionFailed, "This user never added a password or email address. Please contact us for help."}
 			}
 		}
 		if len(u.HashedPass) == 0 {
 			return impart.HTTPError{http.StatusUnauthorized, "This user never set a password. Perhaps try logging in via OAuth?"}
 		}
 		if !auth.Authenticated(u.HashedPass, []byte(signin.Pass)) {
 			return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 		}
 	}
 
 	if reqJSON && !signin.Web {
 		var token string
 		if r.Header.Get("User-Agent") == "" {
 			// Get last created token when User-Agent is empty
 			token = app.db.FetchLastAccessToken(u.ID)
 			if token == "" {
 				token, err = app.db.GetAccessToken(u.ID)
 			}
 		} else {
 			token, err = app.db.GetAccessToken(u.ID)
 		}
 		if err != nil {
 			log.Error("Login: Unable to create access token: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
 		}
 		resUser := getVerboseAuthUser(app, token, u, verbose)
 		return impart.WriteSuccess(w, resUser, http.StatusOK)
 	}
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// The cookie should still save, even if there's an error.
 		log.Error("Login: Session: %v; ignoring", err)
 	}
 
 	// Remove unwanted data
 	session.Values[cookieUserVal] = u.Cookie()
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Login: Couldn't save session: %v", err)
 		// TODO: return error
 	}
 
 	// Send success
 	if reqJSON {
 		return impart.WriteSuccess(w, &AuthUser{User: u}, http.StatusOK)
 	}
 	log.Info("Login: Redirecting to %s", redirectTo)
 	w.Header().Set("Location", redirectTo)
 	w.WriteHeader(http.StatusFound)
 	return nil
 }
 
 func getVerboseAuthUser(app *App, token string, u *User, verbose bool) *AuthUser {
 	resUser := &AuthUser{
 		AccessToken: token,
 		User:        u,
 	}
 
 	// Fetch verbose user data if requested
 	if verbose {
 		posts, err := app.db.GetUserPosts(u)
 		if err != nil {
 			log.Error("Login: Unable to get user posts: %v", err)
 		}
 		colls, err := app.db.GetCollections(u, app.cfg.App.Host)
 		if err != nil {
 			log.Error("Login: Unable to get user collections: %v", err)
 		}
 		passIsSet, err := app.db.IsUserPassSet(u.ID)
 		if err != nil {
 			// TODO: correct error message
 			log.Error("Login: Unable to get user collections: %v", err)
 		}
 
 		resUser.Posts = posts
 		resUser.Collections = colls
 		resUser.User.HasPass = passIsSet
 	}
 	return resUser
 }
 
 func viewExportOptions(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	// Fetch extra user data
-	p := NewUserPage(app, r, u, "Export", nil)
+	p := struct {
+		*UserPage
+	}{
+		UserPage: NewUserPage(app, r, u, "Export", nil),
+	}
 
 	showUserPage(w, "export", p)
 	return nil
 }
 
 func viewExportPosts(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	var filename string
 	var u = &User{}
 	reqJSON := IsJSON(r)
 	if reqJSON {
 		// Use given Authorization header
 		accessToken := r.Header.Get("Authorization")
 		if accessToken == "" {
 			return nil, filename, ErrNoAccessToken
 		}
 
 		userID := app.db.GetUserID(accessToken)
 		if userID == -1 {
 			return nil, filename, ErrBadAccessToken
 		}
 
 		var err error
 		u, err = app.db.GetUserByID(userID)
 		if err != nil {
 			return nil, filename, impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve requested user."}
 		}
 	} else {
 		// Use user cookie
 		session, err := app.sessionStore.Get(r, cookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			log.Error("Session: %v; ignoring", err)
 		}
 
 		val := session.Values[cookieUserVal]
 		var ok bool
 		if u, ok = val.(*User); !ok {
 			return nil, filename, ErrNotLoggedIn
 		}
 	}
 
 	filename = u.Username + "-posts-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	// Fetch data we're exporting
 	var err error
 	var data []byte
 	posts, err := app.db.GetUserPosts(u)
 	if err != nil {
 		return data, filename, err
 	}
 
 	// Export as CSV
 	if strings.HasSuffix(r.URL.Path, ".csv") {
 		data = exportPostsCSV(app.cfg.App.Host, u, posts)
 		return data, filename, err
 	}
 	if strings.HasSuffix(r.URL.Path, ".zip") {
 		data = exportPostsZip(u, posts)
 		return data, filename, err
 	}
 
 	if r.FormValue("pretty") == "1" {
 		data, err = json.MarshalIndent(posts, "", "\t")
 	} else {
 		data, err = json.Marshal(posts)
 	}
 	return data, filename, err
 }
 
 func viewExportFull(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	var err error
 	filename := ""
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, filename, ErrNotLoggedIn
 	}
 	filename = u.Username + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	exportUser := compileFullExport(app, u)
 
 	var data []byte
 	if r.FormValue("pretty") == "1" {
 		data, err = json.MarshalIndent(exportUser, "", "\t")
 	} else {
 		data, err = json.Marshal(exportUser)
 	}
 	return data, filename, err
 }
 
 func viewMeAPI(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	uObj := struct {
 		ID       int64  `json:"id,omitempty"`
 		Username string `json:"username,omitempty"`
 	}{}
 	var err error
 
 	if reqJSON {
 		_, uObj.Username, err = app.db.GetUserDataFromToken(r.Header.Get("Authorization"))
 		if err != nil {
 			return err
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return impart.WriteSuccess(w, uObj, http.StatusOK)
 		}
 		uObj.Username = u.Username
 	}
 
 	return impart.WriteSuccess(w, uObj, http.StatusOK)
 }
 
 func viewMyPostsAPI(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return ErrBadRequestedType
 	}
 
 	isAnonPosts := r.FormValue("anonymous") == "1"
 	if isAnonPosts {
 		pageStr := r.FormValue("page")
 		pg, err := strconv.Atoi(pageStr)
 		if err != nil {
 			log.Error("Error parsing page parameter '%s': %s", pageStr, err)
 			pg = 1
 		}
 
 		p, err := app.db.GetAnonymousPosts(u, pg)
 		if err != nil {
 			return err
 		}
 		return impart.WriteSuccess(w, p, http.StatusOK)
 	}
 
 	var err error
 	p := GetPostsCache(u.ID)
 	if p == nil {
 		userPostsCache.Lock()
 		if userPostsCache.users[u.ID].ready == nil {
 			userPostsCache.users[u.ID] = postsCacheItem{ready: make(chan struct{})}
 			userPostsCache.Unlock()
 
 			p, err = app.db.GetUserPosts(u)
 			if err != nil {
 				return err
 			}
 
 			CachePosts(u.ID, p)
 		} else {
 			userPostsCache.Unlock()
 
 			<-userPostsCache.users[u.ID].ready
 			p = GetPostsCache(u.ID)
 		}
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func viewMyCollectionsAPI(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return ErrBadRequestedType
 	}
 
 	p, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func viewArticles(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p, err := app.db.GetAnonymousPosts(u, 1)
 	if err != nil {
 		log.Error("unable to fetch anon posts: %v", err)
 	}
 	// nil-out AnonymousPosts slice for easy detection in the template
 	if p != nil && len(*p) == 0 {
 		p = nil
 	}
 
 	f, err := getSessionFlashes(app, w, r, nil)
 	if err != nil {
 		log.Error("unable to fetch flashes: %v", err)
 	}
 
 	c, err := app.db.GetPublishableCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view articles: %v", err)
 	}
 	d := struct {
 		*UserPage
 		AnonymousPosts *[]PublicPost
 		Collections    *[]Collection
 		Silenced       bool
 	}{
 		UserPage:       NewUserPage(app, r, u, u.Username+"'s Posts", f),
 		AnonymousPosts: p,
 		Collections:    c,
 		Silenced:       silenced,
 	}
 	d.UserPage.SetMessaging(u)
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	w.Header().Set("Expires", "Thu, 04 Oct 1990 20:00:00 GMT")
 	showUserPage(w, "articles", d)
 
 	return nil
 }
 
 func viewCollections(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	c, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 		return fmt.Errorf("No collections")
 	}
 
 	f, _ := getSessionFlashes(app, w, r, nil)
 
 	uc, _ := app.db.GetUserCollectionCount(u.ID)
 	// TODO: handle any errors
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view collections: %v", err)
 		return fmt.Errorf("view collections: %v", err)
 	}
 	d := struct {
 		*UserPage
 		Collections *[]Collection
 
 		UsedCollections, TotalCollections int
 
 		NewBlogsDisabled bool
 		Silenced         bool
 	}{
 		UserPage:         NewUserPage(app, r, u, u.Username+"'s Blogs", f),
 		Collections:      c,
 		UsedCollections:  int(uc),
 		NewBlogsDisabled: !app.cfg.App.CanCreateBlogs(uc),
 		Silenced:         silenced,
 	}
 	d.UserPage.SetMessaging(u)
 	showUserPage(w, "collections", d)
 
 	return nil
 }
 
 func viewEditCollection(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	c, err := app.db.GetCollection(vars["collection"])
 	if err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 	if c.OwnerID != u.ID {
 		return ErrCollectionNotFound
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view edit collection %v", err)
 		return fmt.Errorf("view edit collection: %v", err)
 	}
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	obj := struct {
 		*UserPage
 		*Collection
 		Silenced bool
 
 		config.EmailCfg
 		LetterReplyTo string
 	}{
 		UserPage:   NewUserPage(app, r, u, "Edit "+c.DisplayTitle(), flashes),
 		Collection: c,
 		Silenced:   silenced,
 		EmailCfg:   app.cfg.Email,
 	}
 	obj.UserPage.CollAlias = c.Alias
 	if obj.EmailCfg.Enabled() {
 		obj.LetterReplyTo = app.db.GetCollectionAttribute(c.ID, collAttrLetterReplyTo)
 	}
 
 	showUserPage(w, "collection", obj)
 	return nil
 }
 
 func updateSettings(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 
 	var s userSettings
 	var u *User
 	var sess *sessions.Session
 	var err error
 	if reqJSON {
 		accessToken := r.Header.Get("Authorization")
 		if accessToken == "" {
 			return ErrNoAccessToken
 		}
 
 		u, err = app.db.GetAPIUser(accessToken)
 		if err != nil {
 			return ErrBadAccessToken
 		}
 
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&s)
 		if err != nil {
 			log.Error("Couldn't parse settings JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 
 		// Prevent all username updates
 		// TODO: support changing username via JSON API request
 		s.Username = ""
 	} else {
 		u, sess = getUserAndSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse settings form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&s, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode settings form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	// Do update
 	postUpdateReturn := r.FormValue("return")
 	redirectTo := "/me/settings"
 	if s.IsLogOut {
 		redirectTo += "?logout=1"
 	} else if postUpdateReturn != "" {
 		redirectTo = postUpdateReturn
 	}
 
 	// Only do updates on values we need
 	if s.Username != "" && s.Username == u.Username {
 		// Username hasn't actually changed; blank it out
 		s.Username = ""
 	}
 	err = app.db.ChangeSettings(app, u, &s)
 	if err != nil {
 		if reqJSON {
 			return err
 		}
 
 		if err, ok := err.(impart.HTTPError); ok {
 			addSessionFlash(app, w, r, err.Message, nil)
 		}
 	} else {
 		// Successful update.
 		if reqJSON {
 			return impart.WriteSuccess(w, u, http.StatusOK)
 		}
 
 		if s.IsLogOut {
 			redirectTo = "/me/logout"
 		} else {
 			sess.Values[cookieUserVal] = u.Cookie()
 			addSessionFlash(app, w, r, "Account updated.", nil)
 		}
 	}
 
 	w.Header().Set("Location", redirectTo)
 	w.WriteHeader(http.StatusFound)
 	return nil
 }
 
 func updatePassphrase(app *App, w http.ResponseWriter, r *http.Request) error {
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		return ErrNoAccessToken
 	}
 
 	curPass := r.FormValue("current")
 	newPass := r.FormValue("new")
 	// Ensure a new password is given (always required)
 	if newPass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Provide a new password."}
 	}
 
 	userID, sudo := app.db.GetUserIDPrivilege(accessToken)
 	if userID == -1 {
 		return ErrBadAccessToken
 	}
 
 	// Ensure a current password is given if the access token doesn't have sudo
 	// privileges.
 	if !sudo && curPass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Provide current password."}
 	}
 
 	// Hash the new password
 	hashedPass, err := auth.HashPass([]byte(newPass))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Do update
 	err = app.db.ChangePassphrase(userID, sudo, curPass, hashedPass)
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, struct{}{}, http.StatusOK)
 }
 
 func viewStats(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	var c *Collection
 	var err error
 	vars := mux.Vars(r)
 	alias := vars["collection"]
 	if alias != "" {
 		c, err = app.db.GetCollection(alias)
 		if err != nil {
 			return err
 		}
 		if c.OwnerID != u.ID {
 			return ErrCollectionNotFound
 		}
 		c.hostName = app.cfg.App.Host
 	}
 
 	topPosts, err := app.db.GetTopPosts(u, alias, c.hostName)
 	if err != nil {
 		log.Error("Unable to get top posts: %v", err)
 		return err
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	titleStats := ""
 	if c != nil {
 		titleStats = c.DisplayTitle() + " "
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view stats: %v", err)
 		return err
 	}
 	obj := struct {
 		*UserPage
 		VisitsBlog       string
 		Collection       *Collection
 		TopPosts         *[]PublicPost
 		APFollowers      int
 		EmailEnabled     bool
 		EmailSubscribers int
 		Silenced         bool
 	}{
 		UserPage:     NewUserPage(app, r, u, titleStats+"Stats", flashes),
 		VisitsBlog:   alias,
 		Collection:   c,
 		TopPosts:     topPosts,
 		EmailEnabled: app.cfg.Email.Enabled(),
 		Silenced:     silenced,
 	}
 	obj.UserPage.CollAlias = c.Alias
 	if app.cfg.App.Federation {
 		folls, err := app.db.GetAPFollowers(c)
 		if err != nil {
 			return err
 		}
 		obj.APFollowers = len(*folls)
 	}
 	if obj.EmailEnabled {
 		subs, err := app.db.GetEmailSubscribers(c.ID, true)
 		if err != nil {
 			return err
 		}
 		obj.EmailSubscribers = len(subs)
 	}
 
 	showUserPage(w, "stats", obj)
 	return nil
 }
 
 func handleViewSubscribers(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	c, err := app.db.GetCollection(vars["collection"])
 	if err != nil {
 		return err
 	}
+	if u.ID != c.OwnerID {
+		return ErrCollectionNotFound
+	}
 
 	filter := r.FormValue("filter")
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	obj := struct {
 		*UserPage
 		Collection CollectionNav
 		EmailSubs  []*EmailSubscriber
 		Followers  *[]RemoteUser
 		Silenced   bool
 
 		Filter            string
 		FederationEnabled bool
 		CanEmailSub       bool
 		CanAddSubs        bool
 		EmailSubsEnabled  bool
 	}{
 		UserPage: NewUserPage(app, r, u, c.DisplayTitle()+" Subscribers", flashes),
 		Collection: CollectionNav{
 			Collection: c,
 			Path:       r.URL.Path,
 			SingleUser: app.cfg.App.SingleUser,
 		},
 		Silenced:          u.IsSilenced(),
 		Filter:            filter,
 		FederationEnabled: app.cfg.App.Federation,
 		CanEmailSub:       app.cfg.Email.Enabled(),
 		EmailSubsEnabled:  c.EmailSubsEnabled(),
 	}
 
 	obj.Followers, err = app.db.GetAPFollowers(c)
 	if err != nil {
 		return err
 	}
 
 	obj.EmailSubs, err = app.db.GetEmailSubscribers(c.ID, true)
 	if err != nil {
 		return err
 	}
 
 	if obj.Filter == "" {
 		// Set permission to add email subscribers
 		//obj.CanAddSubs = app.db.GetUserAttribute(c.OwnerID, userAttrCanAddEmailSubs) == "1"
 	}
 
 	showUserPage(w, "subscribers", obj)
 	return nil
 }
 
 func viewSettings(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	fullUser, err := app.db.GetUserByID(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("Unable to get user for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 
 	passIsSet, err := app.db.IsUserPassSet(u.ID)
 	if err != nil {
 		log.Error("Unable to get isUserPassSet for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 
 	enableOauthSlack := app.Config().SlackOauth.ClientID != ""
 	enableOauthWriteAs := app.Config().WriteAsOauth.ClientID != ""
 	enableOauthGitLab := app.Config().GitlabOauth.ClientID != ""
 	enableOauthGeneric := app.Config().GenericOauth.ClientID != ""
 	enableOauthGitea := app.Config().GiteaOauth.ClientID != ""
 
 	oauthAccounts, err := app.db.GetOauthAccounts(r.Context(), u.ID)
 	if err != nil {
 		log.Error("Unable to get oauth accounts for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 	for idx, oauthAccount := range oauthAccounts {
 		switch oauthAccount.Provider {
 		case "slack":
 			enableOauthSlack = false
 		case "write.as":
 			enableOauthWriteAs = false
 		case "gitlab":
 			enableOauthGitLab = false
 		case "generic":
 			oauthAccounts[idx].DisplayName = app.Config().GenericOauth.DisplayName
 			oauthAccounts[idx].AllowDisconnect = app.Config().GenericOauth.AllowDisconnect
 			enableOauthGeneric = false
 		case "gitea":
 			enableOauthGitea = false
 		}
 	}
 
 	displayOauthSection := enableOauthSlack || enableOauthWriteAs || enableOauthGitLab || enableOauthGeneric || enableOauthGitea || len(oauthAccounts) > 0
 
 	obj := struct {
 		*UserPage
 		Email                   string
 		HasPass                 bool
 		IsLogOut                bool
 		Silenced                bool
 		CSRFField               template.HTML
 		OauthSection            bool
 		OauthAccounts           []oauthAccountInfo
 		OauthSlack              bool
 		OauthWriteAs            bool
 		OauthGitLab             bool
 		GitLabDisplayName       string
 		OauthGeneric            bool
 		OauthGenericDisplayName string
 		OauthGitea              bool
 		GiteaDisplayName        string
 	}{
 		UserPage:                NewUserPage(app, r, u, "Account Settings", flashes),
 		Email:                   fullUser.EmailClear(app.keys),
 		HasPass:                 passIsSet,
 		IsLogOut:                r.FormValue("logout") == "1",
 		Silenced:                fullUser.IsSilenced(),
 		CSRFField:               csrf.TemplateField(r),
 		OauthSection:            displayOauthSection,
 		OauthAccounts:           oauthAccounts,
 		OauthSlack:              enableOauthSlack,
 		OauthWriteAs:            enableOauthWriteAs,
 		OauthGitLab:             enableOauthGitLab,
 		GitLabDisplayName:       config.OrDefaultString(app.Config().GitlabOauth.DisplayName, gitlabDisplayName),
 		OauthGeneric:            enableOauthGeneric,
 		OauthGenericDisplayName: config.OrDefaultString(app.Config().GenericOauth.DisplayName, genericOauthDisplayName),
 		OauthGitea:              enableOauthGitea,
 		GiteaDisplayName:        config.OrDefaultString(app.Config().GiteaOauth.DisplayName, giteaDisplayName),
 	}
 
 	showUserPage(w, "settings", obj)
 	return nil
 }
 
 func viewResetPassword(app *App, w http.ResponseWriter, r *http.Request) error {
 	token := r.FormValue("t")
 	resetting := false
 	var userID int64 = 0
 	if token != "" {
 		// Show new password page
 		userID = app.db.GetUserFromPasswordReset(token)
 		if userID == 0 {
 			return impart.HTTPError{http.StatusNotFound, ""}
 		}
 		resetting = true
 	}
 
 	if r.Method == http.MethodPost {
 		newPass := r.FormValue("new-pass")
 		if newPass == "" {
 			// Send password reset email
 			return handleResetPasswordInit(app, w, r)
 		}
 
 		// Do actual password reset
 		// Assumes token has been validated above
 		err := doAutomatedPasswordChange(app, userID, newPass)
 		if err != nil {
 			return err
 		}
 		err = app.db.ConsumePasswordResetToken(token)
 		if err != nil {
 			log.Error("Couldn't consume token %s for user %d!!! %s", token, userID, err)
 		}
 		addSessionFlash(app, w, r, "Your password was reset. Now you can log in below.", nil)
 		return impart.HTTPError{http.StatusFound, "/login"}
 	}
 
 	f, _ := getSessionFlashes(app, w, r, nil)
 
 	// Show reset password page
 	d := struct {
 		page.StaticPage
 		Flashes      []string
 		EmailEnabled bool
 		CSRFField    template.HTML
 		Token        string
 		IsResetting  bool
 		IsSent       bool
 	}{
 		StaticPage:   pageForReq(app, r),
 		Flashes:      f,
 		EmailEnabled: app.cfg.Email.Enabled(),
 		CSRFField:    csrf.TemplateField(r),
 		Token:        token,
 		IsResetting:  resetting,
 		IsSent:       r.FormValue("sent") == "1",
 	}
 	err := pages["reset.tmpl"].ExecuteTemplate(w, "base", d)
 	if err != nil {
 		log.Error("Unable to render password reset page: %v", err)
 		return err
 	}
 	return err
 }
 
 func doAutomatedPasswordChange(app *App, userID int64, newPass string) error {
 	// Do password reset
 	hashedPass, err := auth.HashPass([]byte(newPass))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Do update
 	err = app.db.ChangePassphrase(userID, true, "", hashedPass)
 	if err != nil {
 		return err
 	}
 	return nil
 }
 
 func handleResetPasswordInit(app *App, w http.ResponseWriter, r *http.Request) error {
 	returnLoc := impart.HTTPError{http.StatusFound, "/reset"}
 
 	if !app.cfg.Email.Enabled() {
 		// Email isn't configured, so there's nothing to do; send back to the reset form, where they'll get an explanation
 		return returnLoc
 	}
 
 	ip := spam.GetIP(r)
 	alias := r.FormValue("alias")
 
 	u, err := app.db.GetUserForAuth(alias)
 	if err != nil {
 		if strings.IndexAny(alias, "@") > 0 {
 			addSessionFlash(app, w, r, ErrUserNotFoundEmail.Message, nil)
 			return returnLoc
 		}
 		addSessionFlash(app, w, r, ErrUserNotFound.Message, nil)
 		return returnLoc
 	}
 	if u.IsAdmin() {
 		// Prevent any reset emails on admin accounts
 		log.Error("Admin reset attempt", `Someone just tried to reset the password for an admin (ID %d - %s). IP address: %s`, u.ID, u.Username, ip)
 		return returnLoc
 	}
 	if u.Email.String == "" {
 		err := impart.HTTPError{http.StatusPreconditionFailed, "User doesn't have an email address. Please contact us (" + app.cfg.App.Host + "/contact) to reset your password."}
 		addSessionFlash(app, w, r, err.Message, nil)
 		return returnLoc
 	}
 	if isSet, _ := app.db.IsUserPassSet(u.ID); !isSet {
 		err = loginViaEmail(app, u.Username, "/me/settings")
 		if err != nil {
 			return err
 		}
 		addSessionFlash(app, w, r, "We've emailed you a link to log in with.", nil)
 		return returnLoc
 	}
 
 	token, err := app.db.CreatePasswordResetToken(u.ID)
 	if err != nil {
 		log.Error("Error resetting password: %s", err)
 		addSessionFlash(app, w, r, ErrInternalGeneral.Message, nil)
 		return returnLoc
 	}
 
 	err = emailPasswordReset(app, u.EmailClear(app.keys), token)
 	if err != nil {
 		log.Error("Error emailing password reset: %s", err)
 		addSessionFlash(app, w, r, ErrInternalGeneral.Message, nil)
 		return returnLoc
 	}
 
 	addSessionFlash(app, w, r, "We sent an email to the address associated with this account.", nil)
 	returnLoc.Message += "?sent=1"
 	return returnLoc
 }
 
 func emailPasswordReset(app *App, toEmail, token string) error {
 	// Send email
 	mlr, err := mailer.New(app.cfg.Email)
 	if err != nil {
 		return err
 	}
 	footerPara := "Didn't request this password reset? Your account is still safe, and you can safely ignore this email."
 
 	plainMsg := fmt.Sprintf("We received a request to reset your password on %s. Please click the following link to continue (or copy and paste it into your browser): %s/reset?t=%s\n\n%s", app.cfg.App.SiteName, app.cfg.App.Host, token, footerPara)
-	m, err := mlr.NewMessage(app.cfg.App.SiteName+" <noreply-password@"+app.cfg.Email.Domain+">", "Reset Your "+app.cfg.App.SiteName+" Password", plainMsg, fmt.Sprintf("<%s>", toEmail))
+	m, err := mlr.NewMessage(mailer.FormatAddress(app.cfg.App.SiteName, "noreply-password@"+app.cfg.Email.Domain), "Reset Your "+app.cfg.App.SiteName+" Password", plainMsg, fmt.Sprintf("<%s>", toEmail))
 	if err != nil {
 		return err
 	}
 	m.AddTag("Password Reset")
 	m.SetHTML(fmt.Sprintf(`<html>
 	<body style="font-family:Lora, 'Palatino Linotype', Palatino, Baskerville, 'Book Antiqua', 'New York', 'DejaVu serif', serif; font-size: 100%%; margin:1em 2em;">
 		<div style="margin:0 auto; max-width: 40em; font-size: 1.2em;">
         <h1 style="font-size:1.75em"><a style="text-decoration:none;color:#000;" href="%s">%s</a></h1>
 		<p>We received a request to reset your password on %s. Please click the following link to continue:</p>
 		<p style="font-size:1.2em;margin-bottom:1.5em;"><a href="%s/reset?t=%s">Reset your password</a></p>
         <p style="font-size: 0.86em;margin:1em auto">%s</p>
         </div>
 	</body>
 </html>`, app.cfg.App.Host, app.cfg.App.SiteName, app.cfg.App.SiteName, app.cfg.App.Host, token, footerPara))
 	return mlr.Send(m)
 }
 
 func loginViaEmail(app *App, alias, redirectTo string) error {
 	if !app.cfg.Email.Enabled() {
 		return fmt.Errorf("EMAIL ISN'T CONFIGURED on this server")
 	}
 
 	// Make sure user has added an email
 	// TODO: create a new func to just get user's email; "ForAuth" doesn't match here
 	u, _ := app.db.GetUserForAuth(alias)
 	if u == nil {
 		if strings.IndexAny(alias, "@") > 0 {
 			return ErrUserNotFoundEmail
 		}
 		return ErrUserNotFound
 	}
 	if u.Email.String == "" {
 		return impart.HTTPError{http.StatusPreconditionFailed, "User doesn't have an email address. Log in with password, instead."}
 	}
 
 	// Generate one-time login token
 	t, err := app.db.GetTemporaryOneTimeAccessToken(u.ID, 60*15, true)
 	if err != nil {
 		log.Error("Unable to generate token for email login: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to generate token."}
 	}
 
 	// Send email
 	mlr, err := mailer.New(app.cfg.Email)
 	if err != nil {
 		return err
 	}
 	toEmail := u.EmailClear(app.keys)
 	footerPara := "This link will only work once and expires in 15 minutes. Didn't ask us to log in? You can safely ignore this email."
 
 	plainMsg := fmt.Sprintf("Log in to %s here: %s/login?to=%s&with=%s\n\n%s", app.cfg.App.SiteName, app.cfg.App.Host, redirectTo, t, footerPara)
-	m, err := mlr.NewMessage(app.cfg.App.SiteName+" <noreply-login@"+app.cfg.Email.Domain+">", "Log in to "+app.cfg.App.SiteName, plainMsg, fmt.Sprintf("<%s>", toEmail))
+	m, err := mlr.NewMessage(mailer.FormatAddress(app.cfg.App.SiteName, "noreply-login@"+app.cfg.Email.Domain), "Log in to "+app.cfg.App.SiteName, plainMsg, fmt.Sprintf("<%s>", toEmail))
 	if err != nil {
 		return err
 	}
 	m.AddTag("Email Login")
 
 	m.SetHTML(fmt.Sprintf(`<html>
 	<body style="font-family:Lora, 'Palatino Linotype', Palatino, Baskerville, 'Book Antiqua', 'New York', 'DejaVu serif', serif; font-size: 100%%; margin:1em 2em;">
 		<div style="margin:0 auto; max-width: 40em; font-size: 1.2em;">
         <h1 style="font-size:1.75em"><a style="text-decoration:none;color:#000;" href="%s">%s</a></h1>
 		<p style="font-size:1.2em;margin-bottom:1.5em;text-align:center"><a href="%s/login?to=%s&with=%s">Log in to %s here</a>.</p>
         <p style="font-size: 0.86em;color:#666;text-align:center;max-width:35em;margin:1em auto">%s</p>
         </div>
 	</body>
 </html>`, app.cfg.App.Host, app.cfg.App.SiteName, app.cfg.App.Host, redirectTo, t, app.cfg.App.SiteName, footerPara))
 	return mlr.Send(m)
 }
 
 func saveTempInfo(app *App, key, val string, r *http.Request, w http.ResponseWriter) error {
 	session, err := app.sessionStore.Get(r, "t")
 	if err != nil {
 		return ErrInternalCookieSession
 	}
 
 	session.Values[key] = val
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't saveTempInfo for key-val (%s:%s): %v", key, val, err)
 	}
 	return err
 }
 
 func getTempInfo(app *App, key string, r *http.Request, w http.ResponseWriter) string {
 	session, err := app.sessionStore.Get(r, "t")
 	if err != nil {
 		return ""
 	}
 
 	// Get the information
 	var s = ""
 	var ok bool
 	if s, ok = session.Values[key].(string); !ok {
 		return ""
 	}
 
 	// Delete cookie
 	session.Options.MaxAge = -1
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't erase temp data for key %s: %v", key, err)
 	}
 
 	// Return value
 	return s
 }
 
 func handleUserDelete(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	if !app.cfg.App.OpenDeletion {
 		return impart.HTTPError{http.StatusForbidden, "Open account deletion is disabled on this instance."}
 	}
 
 	confirmUsername := r.PostFormValue("confirm-username")
 	if u.Username != confirmUsername {
 		return impart.HTTPError{http.StatusBadRequest, "Confirmation username must match your username exactly."}
 	}
 
 	// Check for account deletion safeguards in place
 	if u.IsAdmin() {
 		return impart.HTTPError{http.StatusForbidden, "Cannot delete admin."}
 	}
 
 	err := app.db.DeleteAccount(u.ID)
 	if err != nil {
 		log.Error("user delete account: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not delete account: %v", err)}
 	}
 
 	// FIXME: This doesn't ever appear to the user, as (I believe) the value is erased when the session cookie is reset
 	_ = addSessionFlash(app, w, r, "Thanks for writing with us! You account was deleted successfully.", nil)
 	return impart.HTTPError{http.StatusFound, "/me/logout"}
 }
 
 func removeOauth(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	provider := r.FormValue("provider")
 	clientID := r.FormValue("client_id")
 	remoteUserID := r.FormValue("remote_user_id")
 
 	err := app.db.RemoveOauth(r.Context(), u.ID, provider, clientID, remoteUserID)
 	if err != nil {
 		return impart.HTTPError{Status: http.StatusInternalServerError, Message: err.Error()}
 	}
 
 	return impart.HTTPError{Status: http.StatusFound, Message: "/me/settings"}
 }
 
 func prepareUserEmail(input string, emailKey []byte) zero.String {
 	email := zero.NewString("", input != "")
 	if len(input) > 0 {
 		encEmail, err := data.Encrypt(emailKey, input)
 		if err != nil {
 			log.Error("Unable to encrypt email: %s\n", err)
 		} else {
 			email.String = string(encEmail)
 
 		}
 	}
 	return email
 }
diff --git a/account_import.go b/account_import.go
index 656852f..f4438cf 100644
--- a/account_import.go
+++ b/account_import.go
@@ -1,194 +1,197 @@
 package writefreely
 
 import (
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"io"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 
+	"github.com/gorilla/csrf"
 	"github.com/hashicorp/go-multierror"
 	"github.com/writeas/impart"
 	wfimport "github.com/writeas/import"
 	"github.com/writeas/web-core/log"
 )
 
 func viewImport(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	// Fetch extra user data
 	p := NewUserPage(app, r, u, "Import Posts", nil)
 
 	c, err := app.db.GetCollections(u, app.Config().App.Host)
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("unable to fetch collections: %v", err)}
 	}
 
 	d := struct {
 		*UserPage
 		Collections *[]Collection
 		Flashes     []template.HTML
 		Message     string
 		InfoMsg     bool
+		CSRFField   template.HTML
 	}{
 		UserPage:    p,
 		Collections: c,
 		Flashes:     []template.HTML{},
+		CSRFField:   csrf.TemplateField(r),
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	for _, flash := range flashes {
 		if strings.HasPrefix(flash, "SUCCESS: ") {
 			d.Message = strings.TrimPrefix(flash, "SUCCESS: ")
 		} else if strings.HasPrefix(flash, "INFO: ") {
 			d.Message = strings.TrimPrefix(flash, "INFO: ")
 			d.InfoMsg = true
 		} else {
 			d.Flashes = append(d.Flashes, template.HTML(flash))
 		}
 	}
 
 	showUserPage(w, "import", d)
 	return nil
 }
 
 func handleImport(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	// limit 10MB per submission
 	r.ParseMultipartForm(10 << 20)
 
 	collAlias := r.PostFormValue("collection")
 	coll := &Collection{
 		ID: 0,
 	}
 	var err error
 	if collAlias != "" {
 		coll, err = app.db.GetCollection(collAlias)
 		if err != nil {
 			log.Error("Unable to get collection for import: %s", err)
 			return err
 		}
 		// Only allow uploading to collection if current user is owner
 		if coll.OwnerID != u.ID {
 			err := ErrUnauthorizedGeneral
 			_ = addSessionFlash(app, w, r, err.Message, nil)
 			return err
 		}
 		coll.hostName = app.cfg.App.Host
 	}
 
 	fileDates := make(map[string]int64)
 	err = json.Unmarshal([]byte(r.FormValue("fileDates")), &fileDates)
 	if err != nil {
 		log.Error("invalid form data for file dates: %v", err)
 		return impart.HTTPError{http.StatusBadRequest, "form data for file dates was invalid"}
 	}
 	files := r.MultipartForm.File["files"]
 	var fileErrs []error
 	filesSubmitted := len(files)
 	var filesImported int
 	for _, formFile := range files {
 		fname := ""
 		ok := func() bool {
 			file, err := formFile.Open()
 			if err != nil {
 				fileErrs = append(fileErrs, fmt.Errorf("Unable to read file %s", formFile.Filename))
 				log.Error("import file: open from form: %v", err)
 				return false
 			}
 			defer file.Close()
 
 			tempFile, err := os.CreateTemp("", "post-upload-*.txt")
 			if err != nil {
 				fileErrs = append(fileErrs, fmt.Errorf("Internal error for %s", formFile.Filename))
 				log.Error("import file: create temp file %s: %v", formFile.Filename, err)
 				return false
 			}
 			defer tempFile.Close()
 
 			_, err = io.Copy(tempFile, file)
 			if err != nil {
 				fileErrs = append(fileErrs, fmt.Errorf("Internal error for %s", formFile.Filename))
 				log.Error("import file: copy to temp location %s: %v", formFile.Filename, err)
 				return false
 			}
 
 			info, err := tempFile.Stat()
 			if err != nil {
 				fileErrs = append(fileErrs, fmt.Errorf("Internal error for %s", formFile.Filename))
 				log.Error("import file: stat temp file %s: %v", formFile.Filename, err)
 				return false
 			}
 			fname = info.Name()
 			return true
 		}()
 		if !ok {
 			continue
 		}
 
 		post, err := wfimport.FromFile(filepath.Join(os.TempDir(), fname))
 		if err == wfimport.ErrEmptyFile {
 			// not a real error so don't log
 			_ = addSessionFlash(app, w, r, fmt.Sprintf("%s was empty, import skipped", formFile.Filename), nil)
 			continue
 		} else if err == wfimport.ErrInvalidContentType {
 			// same as above
 			_ = addSessionFlash(app, w, r, fmt.Sprintf("%s is not a supported post file", formFile.Filename), nil)
 			continue
 		} else if err != nil {
 			fileErrs = append(fileErrs, fmt.Errorf("failed to read copy of %s", formFile.Filename))
 			log.Error("import textfile: file to post: %v", err)
 			continue
 		}
 
 		if collAlias != "" {
 			post.Collection = collAlias
 		}
 		dateTime := time.Unix(fileDates[formFile.Filename], 0)
 		post.Created = &dateTime
 		created := post.Created.Format("2006-01-02T15:04:05Z")
 		submittedPost := SubmittedPost{
 			Title:   &post.Title,
 			Content: &post.Content,
 			Font:    "norm",
 			Created: &created,
 		}
 		rp, err := app.db.CreatePost(u.ID, coll.ID, &submittedPost)
 		if err != nil {
 			fileErrs = append(fileErrs, fmt.Errorf("failed to create post from %s", formFile.Filename))
 			log.Error("import textfile: create db post: %v", err)
 			continue
 		}
 
 		// Federate post, if necessary
 		if app.cfg.App.Federation && coll.ID > 0 {
 			go federatePost(
 				app,
 				&PublicPost{
 					Post: rp,
 					Collection: &CollectionObj{
 						Collection: *coll,
 					},
 				},
 				coll.ID,
 				false,
 			)
 		}
 		filesImported++
 	}
 	if len(fileErrs) != 0 {
 		_ = addSessionFlash(app, w, r, multierror.ListFormatFunc(fileErrs), nil)
 	}
 
 	if filesImported == filesSubmitted {
 		verb := "posts"
 		if filesSubmitted == 1 {
 			verb = "post"
 		}
 		_ = addSessionFlash(app, w, r, fmt.Sprintf("SUCCESS: Import complete, %d %s imported.", filesImported, verb), nil)
 	} else if filesImported > 0 {
 		_ = addSessionFlash(app, w, r, fmt.Sprintf("INFO: %d of %d posts imported, see details below.", filesImported, filesSubmitted), nil)
 	}
 	return impart.HTTPError{http.StatusFound, "/me/import"}
 }
diff --git a/activitypub.go b/activitypub.go
index 14eeeff..89eca39 100644
--- a/activitypub.go
+++ b/activitypub.go
@@ -1,1245 +1,1298 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"bytes"
 	"crypto/sha256"
 	"database/sql"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/writeas/activity/streams"
 	"github.com/writeas/activityserve"
 	"github.com/writeas/httpsig"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/activitypub"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/id"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/silobridge"
 )
 
 const (
 	// TODO: delete. don't use this!
 	apCustomHandleDefault = "blog"
 
 	apCacheTime = time.Minute
 )
 
 var (
 	apCollectionPostIRIRegex = regexp.MustCompile("/api/collections/([a-z0-9\\-]+)/posts/([a-z0-9\\-]+)$")
 	apDraftPostIRIRegex      = regexp.MustCompile("/api/posts/([a-z0-9\\-]+)$")
 )
 
 var instanceColl *Collection
 
 func initActivityPub(app *App) {
 	ur, _ := url.Parse(app.cfg.App.Host)
 	instanceColl = &Collection{
 		ID:       0,
 		Alias:    ur.Host,
 		Title:    ur.Host,
 		db:       app.db,
 		hostName: app.cfg.App.Host,
 	}
 }
 
 type RemoteUser struct {
 	ID          int64
 	ActorID     string
 	Inbox       string
 	SharedInbox string
 	URL         string
 	Handle      string
 	Created     time.Time
 }
 
 func (ru *RemoteUser) CreatedFriendly() string {
 	return ru.Created.Format("January 2, 2006")
 }
 
 func (ru *RemoteUser) EstimatedHandle() string {
 	if ru.Handle != "" {
 		return ru.Handle
 	}
 	username := filepath.Base(ru.ActorID)
 	host, _ := url.Parse(ru.ActorID)
 	return username + "@" + host.Host
 }
 
 func (ru *RemoteUser) AsPerson() *activitystreams.Person {
 	return &activitystreams.Person{
 		BaseObject: activitystreams.BaseObject{
 			Type: "Person",
 			Context: []interface{}{
 				activitystreams.Namespace,
 			},
 			ID: ru.ActorID,
 		},
 		Inbox: ru.Inbox,
 		Endpoints: activitystreams.Endpoints{
 			SharedInbox: ru.SharedInbox,
 		},
 	}
 }
 
 func activityPubClient() *http.Client {
+	// Validate the resolved IP of every connection (including redirects) at
+	// dial time via safeDialContext.
 	return &http.Client{
 		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			DialContext: safeDialContext,
+		},
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if len(via) >= 5 {
+				return errors.New("too many redirects")
+			}
+			return nil
+		},
 	}
 }
 
 func handleFetchCollectionActivities(app *App, w http.ResponseWriter, r *http.Request) error {
 	w.Header().Set("Server", serverSoftware)
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 	if alias == "" {
 		alias = filepath.Base(r.RequestURI)
 	}
 
-	// TODO: enforce visibility
 	// Get base Collection data
 	var c *Collection
 	var err error
 	if alias == r.Host {
 		c = instanceColl
 	} else if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	if !c.IsInstanceColl() {
+		if c.IsPrivate() || c.IsProtected() {
+			return ErrCollectionNotFound
+		}
 		silenced, err := app.db.IsUserSilenced(c.OwnerID)
 		if err != nil {
 			log.Error("fetch collection activities: %v", err)
 			return ErrInternalGeneral
 		}
 		if silenced {
 			return ErrCollectionNotFound
 		}
 	}
 
 	p := c.PersonObject()
 
 	setCacheControl(w, apCacheTime)
 	return impart.RenderActivityJSON(w, p, http.StatusOK)
 }
 
 func handleFetchCollectionOutbox(app *App, w http.ResponseWriter, r *http.Request) error {
 	w.Header().Set("Server", serverSoftware)
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
-	// TODO: enforce visibility
 	// Get base Collection data
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		return err
 	}
+	if c.IsPrivate() || c.IsProtected() {
+		return ErrCollectionNotFound
+	}
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("fetch collection outbox: %v", err)
 		return ErrInternalGeneral
 	}
 	if silenced {
 		return ErrCollectionNotFound
 	}
 	c.hostName = app.cfg.App.Host
 
 	if app.cfg.App.SingleUser {
 		if alias != c.Alias {
 			return ErrCollectionNotFound
 		}
 	}
 
 	res := &CollectionObj{Collection: *c}
 	app.db.GetPostsCount(res, false)
 	accountRoot := c.FederatedAccount()
 
 	page := r.FormValue("page")
 	p, err := strconv.Atoi(page)
 	if err != nil || p < 1 {
 		// Return outbox
 		oc := activitystreams.NewOrderedCollection(accountRoot, "outbox", res.TotalPosts)
 		return impart.RenderActivityJSON(w, oc, http.StatusOK)
 	}
 
 	// Return outbox page
 	ocp := activitystreams.NewOrderedCollectionPage(accountRoot, "outbox", res.TotalPosts, p)
 	ocp.OrderedItems = []interface{}{}
 
 	posts, err := app.db.GetPosts(app.cfg, c, p, false, true, false, "")
 	for _, pp := range *posts {
 		pp.Collection = res
 		o := pp.ActivityObject(app)
 		a := activitystreams.NewCreateActivity(o)
 		a.Context = nil
 		ocp.OrderedItems = append(ocp.OrderedItems, *a)
 	}
 
 	setCacheControl(w, apCacheTime)
 	return impart.RenderActivityJSON(w, ocp, http.StatusOK)
 }
 
 func handleFetchCollectionFollowers(app *App, w http.ResponseWriter, r *http.Request) error {
 	w.Header().Set("Server", serverSoftware)
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
-	// TODO: enforce visibility
 	// Get base Collection data
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		return err
 	}
+	if c.IsPrivate() || c.IsProtected() {
+		return ErrCollectionNotFound
+	}
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("fetch collection followers: %v", err)
 		return ErrInternalGeneral
 	}
 	if silenced {
 		return ErrCollectionNotFound
 	}
 	c.hostName = app.cfg.App.Host
 
 	accountRoot := c.FederatedAccount()
 
 	folls, err := app.db.GetAPFollowers(c)
 	if err != nil {
 		return err
 	}
 
 	page := r.FormValue("page")
 	p, err := strconv.Atoi(page)
 	if err != nil || p < 1 {
 		// Return outbox
 		oc := activitystreams.NewOrderedCollection(accountRoot, "followers", len(*folls))
 		return impart.RenderActivityJSON(w, oc, http.StatusOK)
 	}
 
 	// Return outbox page
 	ocp := activitystreams.NewOrderedCollectionPage(accountRoot, "followers", len(*folls), p)
 	ocp.OrderedItems = []interface{}{}
 	/*
 		for _, f := range *folls {
 			ocp.OrderedItems = append(ocp.OrderedItems, f.ActorID)
 		}
 	*/
 	setCacheControl(w, apCacheTime)
 	return impart.RenderActivityJSON(w, ocp, http.StatusOK)
 }
 
 func handleFetchCollectionFollowing(app *App, w http.ResponseWriter, r *http.Request) error {
 	w.Header().Set("Server", serverSoftware)
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
-	// TODO: enforce visibility
 	// Get base Collection data
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		return err
 	}
+	if c.IsPrivate() || c.IsProtected() {
+		return ErrCollectionNotFound
+	}
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("fetch collection following: %v", err)
 		return ErrInternalGeneral
 	}
 	if silenced {
 		return ErrCollectionNotFound
 	}
 	c.hostName = app.cfg.App.Host
 
 	accountRoot := c.FederatedAccount()
 
 	page := r.FormValue("page")
 	p, err := strconv.Atoi(page)
 	if err != nil || p < 1 {
 		// Return outbox
 		oc := activitystreams.NewOrderedCollection(accountRoot, "following", 0)
 		return impart.RenderActivityJSON(w, oc, http.StatusOK)
 	}
 
 	// Return outbox page
 	ocp := activitystreams.NewOrderedCollectionPage(accountRoot, "following", 0, p)
 	ocp.OrderedItems = []interface{}{}
 	setCacheControl(w, apCacheTime)
 	return impart.RenderActivityJSON(w, ocp, http.StatusOK)
 }
 
 func handleFetchCollectionInbox(app *App, w http.ResponseWriter, r *http.Request) error {
 	w.Header().Set("Server", serverSoftware)
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		// TODO: return Reject?
 		return err
 	}
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("fetch collection inbox: %v", err)
 		return ErrInternalGeneral
 	}
 	if silenced {
 		return ErrCollectionNotFound
 	}
 	c.hostName = app.cfg.App.Host
 
 	if debugging {
 		dump, err := httputil.DumpRequest(r, true)
 		if err != nil {
 			log.Error("Can't dump: %v", err)
 		} else {
 			log.Info("Rec'd! %q", dump)
 		}
 	}
 
 	// Only call impart.RenderActivityJSON here if NO callback has already written a response.
 	// Track whether a callback has written a response
 	var responseWritten bool
 
 	// Read raw body for debugging before decoding
 	var rawBody bytes.Buffer
 	tee := io.TeeReader(r.Body, &rawBody)
 
 	var m map[string]any
 	if err := json.NewDecoder(tee).Decode(&m); err != nil {
 		log.Error("Failed decoding JSON: %v", err)
 		log.Error("Raw body: %s", rawBody.String())
 		return err
 	}
 	if debugging {
 		log.Info("Decoded JSON: %v", m)
 	}
 
 	a := streams.NewAccept()
 	p := c.PersonObject()
 	var to *url.URL
 	var isFollow, isUnfollow, isLike, isUnlike bool
 	var likePostID, unlikePostID string
 	fullActor := &activitystreams.Person{}
 	var remoteUser *RemoteUser
 
 	res := &streams.Resolver{
 		LikeCallback: func(l *streams.Like) error {
 			isLike = true
 
 			// 1) Use the Like concrete type here
 			// 2) Errors are propagated to res.Deserialize call below
 			m["@context"] = []string{activitystreams.Namespace}
 			b, _ := json.Marshal(m)
 			if debugging {
 				log.Info("Like: %s", b)
 			}
 
 			_, likeID := l.GetId()
 			if likeID == nil {
 				log.Error("Didn't resolve Like ID")
 			}
 			if p := l.HasObject(0); p == streams.NoPresence {
 				return fmt.Errorf("no object for Like activity at index 0")
 			}
 
 			obj := l.Raw().GetObjectIRI(0)
 			/*
 			   // TODO: handle this more robustly
 			   l.ResolveObject(&streams.Resolver{
 			     LinkCallback: func(link *streams.Link) error {
 			       return nil
 			     },
 			   }, 0)
 			*/
 
 			if obj == nil {
 				return fmt.Errorf("didn't get ObjectIRI to Like")
 			}
 			likePostID, err = parsePostIDFromURL(app, obj)
 			if err != nil {
 				return err
 			}
 
 			// Finally, get actor information
 			_, from := l.GetActor(0)
 			if from == nil {
 				return fmt.Errorf("No valid actor string")
 			}
 			fullActor, remoteUser, err = getActor(app, from.String())
 			if err != nil {
 				return err
 			}
 			responseWritten = true
 			return nil
 		},
 		FollowCallback: func(f *streams.Follow) error {
 			isFollow = true
 
 			// 1) Use the Follow concrete type here
 			// 2) Errors are propagated to res.Deserialize call below
 			m["@context"] = []string{activitystreams.Namespace}
 			b, _ := json.Marshal(m)
 			if debugging {
 				log.Info("Follow: %s", b)
 			}
 
 			_, followID := f.GetId()
 			if followID == nil {
 				log.Error("Didn't resolve follow ID")
 			} else {
 				aID := c.FederatedAccount() + "#accept-" + id.GenerateFriendlyRandomString(20)
 				acceptID, err := url.Parse(aID)
 				if err != nil {
 					log.Error("Couldn't parse generated Accept URL '%s': %v", aID, err)
 				}
 				a.SetId(acceptID)
 			}
 			a.AppendObject(f.Raw())
 			_, to = f.GetActor(0)
 			obj := f.Raw().GetObjectIRI(0)
 			if obj == nil {
 				if debugging {
 					log.Error("GetObjectIRI on Follow for actor is empty; trying object")
 				}
 				ao := f.Raw().GetObject(0)
 				if ao == nil {
 					log.Error("Fell back to GetObject and none parsed, so no actor ID! Follow request probably FAILED!")
 				} else {
 					obj = ao.GetId()
 				}
 			}
 			a.AppendActor(obj)
 
 			// First get actor information
 			if to == nil {
 				return fmt.Errorf("No valid `to` string")
 			}
 			fullActor, remoteUser, err = getActor(app, to.String())
 			if err != nil {
 				return err
 			}
 			responseWritten = true
 			return impart.RenderActivityJSON(w, m, http.StatusOK)
 		},
 		UndoCallback: func(u *streams.Undo) error {
 			m["@context"] = []string{activitystreams.Namespace}
 			b, _ := json.Marshal(m)
 			if debugging {
 				log.Info("Undo: %s", b)
 			}
 
 			a.AppendObject(u.Raw())
 
 			// Check type -- we handle Undo:Like and Undo:Follow
 			_, err := u.ResolveObject(&streams.Resolver{
 				LikeCallback: func(like *streams.Like) error {
 					isUnlike = true
 
 					_, from := like.GetActor(0)
 					obj := like.Raw().GetObjectIRI(0)
 					if obj == nil {
 						return fmt.Errorf("didn't get ObjectIRI for Undo Like")
 					}
 					unlikePostID, err = parsePostIDFromURL(app, obj)
 					if err != nil {
 						return err
 					}
 					fullActor, remoteUser, err = getActor(app, from.String())
 					if err != nil {
 						return err
 					}
 					return nil
 				},
 				// TODO: add FollowCallback for more robust handling
 			}, 0)
 			if err != nil {
 				return err
 			}
 			if isUnlike {
 				return nil
 			}
 
 			isUnfollow = true
 			_, to = u.GetActor(0)
 			// TODO: get actor from object.object, not object
 			obj := u.Raw().GetObjectIRI(0)
 			a.AppendActor(obj)
 			if to != nil {
 				// Populate fullActor from DB?
 				remoteUser, err = getRemoteUser(app, to.String())
 				if err != nil {
 					if iErr, ok := err.(*impart.HTTPError); ok {
 						if iErr.Status == http.StatusNotFound {
 							log.Error("No remoteuser info for Undo event!")
 						}
 					}
 					return err
 				} else {
 					fullActor = remoteUser.AsPerson()
 				}
 			} else {
 				log.Error("No to on Undo!")
 			}
 			responseWritten = true
 			return impart.RenderActivityJSON(w, m, http.StatusOK)
 		},
 		DeleteCallback: func(d *streams.Delete) error {
 			if debugging {
 				b, _ := json.Marshal(m)
 				log.Info("Delete: %s", b)
 			}
 			impart.RenderActivityJSON(w, m, http.StatusOK)
 			responseWritten = true
 			return nil
 		},
 	}
 	if err := res.Deserialize(m); err != nil {
 		// 3) Any errors from #2 can be handled, or the payload is an unknown type.
 		log.Error("Unable to resolve Activity: %v", err)
 		if debugging {
 			log.Error("Map: %s", m)
 		}
 		if t, ok := m["type"]; ok {
 			log.Error("Unhandled activity type: %v", t)
 		}
 		impart.RenderActivityJSON(w, "", http.StatusOK)
 		return nil
 	}
 
 	// Handle synchronous activities
 	if isLike {
 		t, err := app.db.Begin()
 		if err != nil {
 			log.Error("Unable to start transaction: %v", err)
 			return fmt.Errorf("unable to start transaction: %v", err)
 		}
 
 		var remoteUserID int64
 		if remoteUser != nil {
 			remoteUserID = remoteUser.ID
 		} else {
 			remoteUserID, err = apAddRemoteUser(app, t, fullActor)
 		}
 
 		// Add like
 		_, err = t.Exec("INSERT INTO remote_likes (post_id, remote_user_id, created) VALUES (?, ?, "+app.db.now()+")", likePostID, remoteUserID)
 		if err != nil {
 			if !app.db.isDuplicateKeyErr(err) {
 				t.Rollback()
 				log.Error("Couldn't add like in DB: %v\n", err)
 				return fmt.Errorf("Couldn't add like in DB: %v", err)
 			} else {
 				t.Rollback()
 				log.Error("Couldn't add like in DB: %v\n", err)
 				return fmt.Errorf("Couldn't add like in DB: %v", err)
 			}
 		}
 
 		err = t.Commit()
 		if err != nil {
 			t.Rollback()
 			log.Error("Rolling back after Commit(): %v\n", err)
 			return fmt.Errorf("Rolling back after Commit(): %v\n", err)
 		}
 
 		if debugging {
 			log.Info("Successfully liked post %s by remote user %s", likePostID, remoteUser.URL)
 		}
 		impart.RenderActivityJSON(w, "", http.StatusOK)
 		return nil
 	} else if isUnlike {
 		t, err := app.db.Begin()
 		if err != nil {
 			log.Error("Unable to start transaction: %v", err)
 			return fmt.Errorf("unable to start transaction: %v", err)
 		}
 
 		var remoteUserID int64
 		if remoteUser != nil {
 			remoteUserID = remoteUser.ID
 		} else {
 			remoteUserID, err = apAddRemoteUser(app, t, fullActor)
 		}
 
 		// Remove like
 		_, err = t.Exec("DELETE FROM remote_likes WHERE post_id = ? AND remote_user_id = ?", unlikePostID, remoteUserID)
 		if err != nil {
 			t.Rollback()
 			log.Error("Couldn't delete Like from DB: %v\n", err)
 			return fmt.Errorf("Couldn't delete Like from DB: %v", err)
 		}
 
 		err = t.Commit()
 		if err != nil {
 			t.Rollback()
 			log.Error("Rolling back after Commit(): %v\n", err)
 			return fmt.Errorf("Rolling back after Commit(): %v\n", err)
 		}
 
 		if debugging {
 			log.Info("Successfully un-liked post %s by remote user %s", unlikePostID, remoteUser.URL)
 		}
 		impart.RenderActivityJSON(w, "", http.StatusOK)
 		return nil
 	}
 
 	go func() {
 		if to == nil {
 			if debugging {
 				log.Info("No `to` value: likely not needed for this activity type.")
 			}
 			return
 		}
 
 		time.Sleep(2 * time.Second)
 		am, err := a.Serialize()
 		if err != nil {
 			log.Error("Unable to serialize Accept: %v", err)
 			return
 		}
 		am["@context"] = []string{activitystreams.Namespace}
 		if debugging {
 			logOutgoingActivity("Accept", am)
 		}
 
 		err = makeActivityPost(app.cfg.App.Host, p, fullActor.Inbox, am)
 		if err != nil {
 			log.Error("Unable to make activity POST: %v", err)
 			return
 		}
 
 		if isFollow {
 			t, err := app.db.Begin()
 			if err != nil {
 				log.Error("Unable to start transaction: %v", err)
 				return
 			}
 
 			var followerID int64
 
 			if remoteUser != nil {
 				followerID = remoteUser.ID
 			} else {
 				// TODO: use apAddRemoteUser() here, instead!
 				// Add follower locally, since it wasn't found before
 				res, err := t.Exec("INSERT INTO remoteusers (actor_id, inbox, shared_inbox, url) VALUES (?, ?, ?, ?)", fullActor.ID, fullActor.Inbox, fullActor.Endpoints.SharedInbox, fullActor.URL)
 				if err != nil {
 					// if duplicate key, res will be nil and panic on
 					// res.LastInsertId below
 					t.Rollback()
 					log.Error("Couldn't add new remoteuser in DB: %v\n", err)
 					return
 				}
 
 				followerID, err = res.LastInsertId()
 				if err != nil {
 					t.Rollback()
 					log.Error("no lastinsertid for followers, rolling back: %v", err)
 					return
 				}
 
 				// Add in key
 				_, err = t.Exec("INSERT INTO remoteuserkeys (id, remote_user_id, public_key) VALUES (?, ?, ?)", fullActor.PublicKey.ID, followerID, fullActor.PublicKey.PublicKeyPEM)
 				if err != nil {
 					if !app.db.isDuplicateKeyErr(err) {
 						t.Rollback()
 						log.Error("Couldn't add follower keys in DB: %v\n", err)
 						return
 					}
 				}
 			}
 
 			// Add follow
 			_, err = t.Exec("INSERT INTO remotefollows (collection_id, remote_user_id, created) VALUES (?, ?, "+app.db.now()+")", c.ID, followerID)
 			if err != nil {
 				if !app.db.isDuplicateKeyErr(err) {
 					t.Rollback()
 					log.Error("Couldn't add follower in DB: %v\n", err)
 					return
 				}
 			}
 
 			err = t.Commit()
 			if err != nil {
 				t.Rollback()
 				log.Error("Rolling back after Commit(): %v\n", err)
 				return
 			}
 		} else if isUnfollow {
 			// Remove follower locally
 			_, err = app.db.Exec("DELETE FROM remotefollows WHERE collection_id = ? AND remote_user_id = (SELECT id FROM remoteusers WHERE actor_id = ?)", c.ID, to.String())
 			if err != nil {
 				log.Error("Couldn't remove follower from DB: %v\n", err)
 			}
 		}
 	}()
 
 	if !responseWritten {
 		if debugging {
 			log.Info("Received unhandled activity type, returning OK")
 		}
 		impart.RenderActivityJSON(w, "", http.StatusOK)
 	}
 
 	return nil
 }
 
 func makeActivityPost(hostName string, p *activitystreams.Person, url string, m interface{}) error {
 	if url == "" {
         log.Error("Target POST URL is empty! Person: %+v, Activity: %+v", p, m)
         return fmt.Errorf("target POST URL is empty")
     }
 
 	log.Info("POST %s", url)
 	b, err := json.Marshal(m)
 	if err != nil {
 		return err
 	}
 
 	r, _ := http.NewRequest("POST", url, bytes.NewBuffer(b))
 	r.Header.Add("Content-Type", "application/activity+json")
 	r.Header.Set("User-Agent", ServerUserAgent(hostName))
 	h := sha256.New()
 	h.Write(b)
 	r.Header.Add("Digest", "SHA-256="+base64.StdEncoding.EncodeToString(h.Sum(nil)))
 
 	// Sign using the 'Signature' header
 	privKey, err := activitypub.DecodePrivateKey(p.GetPrivKey())
 	if err != nil {
 		return err
 	}
 	signer := httpsig.NewSigner(p.PublicKey.ID, privKey, httpsig.RSASHA256, []string{"(request-target)", "date", "host", "digest"})
 	err = signer.SignSigHeader(r)
 	if err != nil {
 		log.Error("Can't sign: %v", err)
 	}
 
 	if debugging {
 		dump, err := httputil.DumpRequestOut(r, true)
 		if err != nil {
 			log.Error("Can't dump: %v", err)
 		} else {
 			log.Info("%s", dump)
 		}
 	}
 
 	resp, err := activityPubClient().Do(r)
 	if err != nil {
 		return err
 	}
 	if resp != nil && resp.Body != nil {
 		defer resp.Body.Close()
 	}
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
 	if debugging {
 		log.Info("Status  : %s", resp.Status)
 		log.Info("Response: %s", body)
 	}
 
 	return nil
 }
 
+// isPublicIRI reports whether iri is an http(s) URL whose host resolves
+// exclusively to public, routable IP addresses. It rejects loopback,
+// private, link-local (including cloud metadata endpoints like
+// 169.254.169.254), and unspecified addresses.
+func isPublicIRI(iri string) error {
+	u, err := url.Parse(iri)
+	if err != nil {
+		return fmt.Errorf("invalid IRI: %v", err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return fmt.Errorf("unsupported IRI scheme %q", u.Scheme)
+	}
+	host := u.Hostname()
+	if host == "" {
+		return fmt.Errorf("missing host in IRI")
+	}
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		return fmt.Errorf("unable to resolve host %q: %v", host, err)
+	}
+	for _, ip := range ips {
+		if !isPublicAddr(ip) {
+			return fmt.Errorf("host %q resolves to disallowed address %s", host, ip)
+		}
+	}
+	return nil
+}
+
 func resolveIRI(hostName, url string) ([]byte, error) {
 	log.Info("GET %s", url)
 
+	if err := isPublicIRI(url); err != nil {
+		return nil, fmt.Errorf("refusing to fetch IRI: %v", err)
+	}
+
 	r, _ := http.NewRequest("GET", url, nil)
 	r.Header.Add("Accept", "application/activity+json")
 	r.Header.Set("User-Agent", ServerUserAgent(hostName))
 
 	p := instanceColl.PersonObject()
 	h := sha256.New()
 	h.Write([]byte{})
 	r.Header.Add("Digest", "SHA-256="+base64.StdEncoding.EncodeToString(h.Sum(nil)))
 
 	// Sign using the 'Signature' header
 	privKey, err := activitypub.DecodePrivateKey(p.GetPrivKey())
 	if err != nil {
 		return nil, err
 	}
 	signer := httpsig.NewSigner(p.PublicKey.ID, privKey, httpsig.RSASHA256, []string{"(request-target)", "date", "host", "digest"})
 	err = signer.SignSigHeader(r)
 	if err != nil {
 		log.Error("Can't sign: %v", err)
 	}
 
 	if debugging {
 		dump, err := httputil.DumpRequestOut(r, true)
 		if err != nil {
 			log.Error("Can't dump: %v", err)
 		} else {
 			log.Info("%s", dump)
 		}
 	}
 
 	resp, err := activityPubClient().Do(r)
 	if err != nil {
 		return nil, err
 	}
 	if resp != nil && resp.Body != nil {
 		defer resp.Body.Close()
 	}
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
 	if debugging {
 		log.Info("Status  : %s", resp.Status)
 		log.Info("Response: %s", body)
 	}
 
 	return body, nil
 }
 
 func deleteFederatedPost(app *App, p *PublicPost, collID int64) error {
 	if debugging {
 		log.Info("Deleting federated post!")
 	}
 	p.Collection.hostName = app.cfg.App.Host
 	actor := p.Collection.PersonObject(collID)
 	na := p.ActivityObject(app)
 
 	// Add followers
 	p.Collection.ID = collID
 	followers, err := app.db.GetAPFollowers(&p.Collection.Collection)
 	if err != nil {
 		log.Error("Couldn't delete post (get followers)! %v", err)
 		return err
 	}
 
 	inboxes := map[string][]string{}
 	for _, f := range *followers {
 		inbox := f.SharedInbox
 		if inbox == "" {
 			inbox = f.Inbox
 		}
 		if _, ok := inboxes[inbox]; ok {
 			inboxes[inbox] = append(inboxes[inbox], f.ActorID)
 		} else {
 			inboxes[inbox] = []string{f.ActorID}
 		}
 	}
 
 	for si, instFolls := range inboxes {
 		na.CC = []string{}
 		na.CC = append(na.CC, instFolls...)
 		da := activitystreams.NewDeleteActivity(na)
 		// Make the ID unique to ensure it works in Pleroma
 		// See: https://git.pleroma.social/pleroma/pleroma/issues/1481
 		da.ID += "#Delete"
 
 		err = makeActivityPost(app.cfg.App.Host, actor, si, da)
 		if err != nil {
 			log.Error("Couldn't delete post! %v", err)
 		}
 	}
 	return nil
 }
 
 func federatePost(app *App, p *PublicPost, collID int64, isUpdate bool) error {
 	// If app is private, do not federate
 	if app.cfg.App.Private {
 		return nil
 	}
 
 	// Do not federate posts from private or protected blogs
 	if p.Collection.Visibility == CollPrivate || p.Collection.Visibility == CollProtected {
 		return nil
 	}
 
 	if debugging {
 		if isUpdate {
 			log.Info("Federating updated post!")
 		} else {
 			log.Info("Federating new post!")
 		}
 	}
 
 	actor := p.Collection.PersonObject(collID)
 	na := p.ActivityObject(app)
 
 	// Add followers
 	p.Collection.ID = collID
 	followers, err := app.db.GetAPFollowers(&p.Collection.Collection)
 	if err != nil {
 		log.Error("Couldn't post! %v", err)
 		return err
 	}
 	log.Info("Followers for %d: %+v", collID, followers)
 
 	inboxes := map[string][]string{}
 	for _, f := range *followers {
 		inbox := f.SharedInbox
 		if inbox == "" {
 			inbox = f.Inbox
 		}
 		if _, ok := inboxes[inbox]; ok {
 			// check if we're already sending to this shared inbox
 			inboxes[inbox] = append(inboxes[inbox], f.ActorID)
 		} else {
 			// add the new shared inbox to the list
 			inboxes[inbox] = []string{f.ActorID}
 		}
 	}
 
 	var activity *activitystreams.Activity
 	// for each one of the shared inboxes
 	for si, instFolls := range inboxes {
 		// add all followers from that instance
 		// to the CC field
 		na.CC = []string{}
 		na.CC = append(na.CC, instFolls...)
 		// create a new "Create" activity
 		// with our article as object
 		label := "Create"
 		if isUpdate {
 			label = "Update"
 			na.Updated = &p.Updated
 			activity = activitystreams.NewUpdateActivity(na)
 		} else {
 			activity = activitystreams.NewCreateActivity(na)
 			activity.To = na.To
 			activity.CC = na.CC
 		}
 		// and post it to that sharedInbox
 		if debugging {
 			logOutgoingActivity(label, activity)
 		}
 		err = makeActivityPost(app.cfg.App.Host, actor, si, activity)
 		if err != nil {
 			log.Error("Couldn't post! %v", err)
 		}
 	}
 
 	// re-create the object so that the CC list gets reset and has
 	// the mentioned users. This might seem wasteful but the code is
 	// cleaner than adding the mentioned users to CC here instead of
 	// in p.ActivityObject()
 	na = p.ActivityObject(app)
 	for _, tag := range na.Tag {
 		if tag.Type == "Mention" {
 			activity = activitystreams.NewCreateActivity(na)
 			activity.To = na.To
 			activity.CC = na.CC
 			// This here might be redundant in some cases as we might have already
 			// sent this to the sharedInbox of this instance above, but we need too
 			// much logic to catch this at the expense of the odd extra request.
 			// I don't believe we'd ever have too many mentions in a single post that this
 			// could become a burden.
 			remoteUser, err := getRemoteUser(app, tag.HRef)
 			if err != nil {
 				log.Error("Unable to find remote user %s. Skipping: %v", tag.HRef, err)
 				continue
 			}
 			err = makeActivityPost(app.cfg.App.Host, actor, remoteUser.Inbox, activity)
 			if err != nil {
 				log.Error("Couldn't post! %v", err)
 			}
 		}
 	}
 
 	return nil
 }
 
 func getRemoteUser(app *App, actorID string) (*RemoteUser, error) {
 	u := RemoteUser{ActorID: actorID}
 	var urlVal, handle sql.NullString
 	err := app.db.QueryRow("SELECT id, inbox, shared_inbox, url, handle FROM remoteusers WHERE actor_id = ?", actorID).Scan(&u.ID, &u.Inbox, &u.SharedInbox, &urlVal, &handle)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, impart.HTTPError{http.StatusNotFound, "No remote user with that ID."}
 	case err != nil:
 		log.Error("Couldn't get remote user %s: %v", actorID, err)
 		return nil, err
 	}
 
 	u.URL = urlVal.String
 	u.Handle = handle.String
 
 	return &u, nil
 }
 
 // getRemoteUserFromHandle retrieves the profile page of a remote user
 // from the @user@server.tld handle
 func getRemoteUserFromHandle(app *App, handle string) (*RemoteUser, error) {
 	u := RemoteUser{Handle: handle}
 	var urlVal sql.NullString
 	err := app.db.QueryRow("SELECT id, actor_id, inbox, shared_inbox, url FROM remoteusers WHERE handle = ?", handle).Scan(&u.ID, &u.ActorID, &u.Inbox, &u.SharedInbox, &urlVal)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrRemoteUserNotFound
 	case err != nil:
 		log.Error("Couldn't get remote user %s: %v", handle, err)
 		return nil, err
 	}
 	u.URL = urlVal.String
 	return &u, nil
 }
 
 // getRemoteUserFromURL retrieves a RemoteUser from their public profile URL.
 func getRemoteUserFromURL(app *App, urlStr string) (*RemoteUser, error) {
 	u := RemoteUser{URL: urlStr}
 	var urlVal, handle sql.NullString
 	err := app.db.QueryRow("SELECT id, actor_id, inbox, shared_inbox, url, handle FROM remoteusers WHERE url = ?", urlStr).Scan(&u.ID, &u.ActorID, &u.Inbox, &u.SharedInbox, &urlVal, &handle)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrRemoteUserNotFound
 	case err != nil:
 		log.Error("Couldn't get remote user from URL %s: %v", urlStr, err)
 		return nil, err
 	}
 	u.URL = urlVal.String
 	u.Handle = handle.String
 	return &u, nil
 }
 
 func getActor(app *App, actorIRI string) (*activitystreams.Person, *RemoteUser, error) {
 	log.Info("Fetching actor %s locally", actorIRI)
 	actor := &activitystreams.Person{}
 	remoteUser, err := getRemoteUser(app, actorIRI)
 	if err != nil {
 		if iErr, ok := err.(impart.HTTPError); ok {
 			if iErr.Status == http.StatusNotFound {
 				// Fetch remote actor
 				log.Info("Not found; fetching actor %s remotely", actorIRI)
 				actorResp, err := resolveIRI(app.cfg.App.Host, actorIRI)
 				if err != nil {
 					log.Error("Unable to get base actor! %v", err)
 					return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't fetch actor."}
 				}
 				if err := unmarshalActor(actorResp, actor); err != nil {
 					log.Error("Unable to unmarshal base actor! %v", err)
 					return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't parse actor."}
 				}
 				baseActor := &activitystreams.Person{}
 				if err := unmarshalActor(actorResp, baseActor); err != nil {
 					log.Error("Unable to unmarshal actual actor! %v", err)
 					return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't parse actual actor."}
 				}
 				// Fetch the actual actor using the owner field from the publicKey object
 				actualActorResp, err := resolveIRI(app.cfg.App.Host, baseActor.PublicKey.Owner)
 				if err != nil {
 					log.Error("Unable to get actual actor! %v", err)
 					return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't fetch actual actor."}
 				}
 				if err := unmarshalActor(actualActorResp, actor); err != nil {
 					log.Error("Unable to unmarshal actual actor! %v", err)
 					return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't parse actual actor."}
 				}
 			} else {
 				return nil, nil, err
 			}
 		} else {
 			return nil, nil, err
 		}
 	} else {
 		actor = remoteUser.AsPerson()
 	}
 	return actor, remoteUser, nil
 }
 
 func GetProfileURLFromHandle(app *App, handle string) (string, error) {
 	handle = strings.TrimLeft(handle, "@")
 	actorIRI := ""
 	parts := strings.Split(handle, "@")
 	if len(parts) != 2 {
 		return "", fmt.Errorf("invalid handle format")
 	}
 	domain := parts[1]
 
 	// Check non-AP instances
 	if siloProfileURL := silobridge.Profile(parts[0], domain); siloProfileURL != "" {
 		return siloProfileURL, nil
 	}
 
 	remoteUser, err := getRemoteUserFromHandle(app, handle)
 	if err != nil {
 		// can't find using handle in the table but the table may already have this user without
 		// handle from a previous version
 		// TODO: Make this determination. We should know whether a user exists without a handle, or doesn't exist at all
 		actorIRI = RemoteLookup(handle)
 		_, errRemoteUser := getRemoteUser(app, actorIRI)
 		// if it exists then we need to update the handle
 		if errRemoteUser == nil {
 			_, err := app.db.Exec("UPDATE remoteusers SET handle = ? WHERE actor_id = ?", handle, actorIRI)
 			if err != nil {
 				log.Error("Couldn't update handle '%s' for user %s", handle, actorIRI)
 			}
 		} else {
 			// this probably means we don't have the user in the table so let's try to insert it
 			// here we need to ask the server for the inboxes
 			remoteActor, err := activityserve.NewRemoteActor(actorIRI)
 			if err != nil {
 				log.Error("Couldn't fetch remote actor: %v", err)
 			}
 			if debugging {
 				log.Info("Got remote actor: %s %s %s %s %s", actorIRI, remoteActor.GetInbox(), remoteActor.GetSharedInbox(), remoteActor.URL(), handle)
 			}
 			_, err = app.db.Exec("INSERT INTO remoteusers (actor_id, inbox, shared_inbox, url, handle) VALUES(?, ?, ?, ?, ?)", actorIRI, remoteActor.GetInbox(), remoteActor.GetSharedInbox(), remoteActor.URL(), handle)
 			if err != nil {
 				log.Error("Couldn't insert remote user: %v", err)
 				return "", err
 			}
 			actorIRI = remoteActor.URL()
 		}
 	} else if remoteUser.URL == "" {
 		log.Info("Remote user %s URL empty, fetching", remoteUser.ActorID)
 		newRemoteActor, err := activityserve.NewRemoteActor(remoteUser.ActorID)
 		if err != nil {
 			log.Error("Couldn't fetch remote actor: %v", err)
 		} else {
 			_, err := app.db.Exec("UPDATE remoteusers SET url = ? WHERE actor_id = ?", newRemoteActor.URL(), remoteUser.ActorID)
 			if err != nil {
 				log.Error("Couldn't update handle '%s' for user %s", handle, actorIRI)
 			} else {
 				actorIRI = newRemoteActor.URL()
 			}
 		}
 	} else {
 		actorIRI = remoteUser.URL
 	}
 	return actorIRI, nil
 }
 
 // unmarshal actor normalizes the actor response to conform to
 // the type Person from github.com/writeas/web-core/activitysteams
 //
 // some implementations return different context field types
 // this converts any non-slice contexts into a slice
 func unmarshalActor(actorResp []byte, actor *activitystreams.Person) error {
 	// FIXME: Hubzilla has an object for the Actor's url: cannot unmarshal object into Go struct field Person.url of type string
 
 	// flexActor overrides the Context field to allow
 	// all valid representations during unmarshal
 	flexActor := struct {
 		activitystreams.Person
 		Context json.RawMessage `json:"@context,omitempty"`
 	}{}
 	if err := json.Unmarshal(actorResp, &flexActor); err != nil {
 		return err
 	}
 
 	actor.Endpoints = flexActor.Endpoints
 	actor.Followers = flexActor.Followers
 	actor.Following = flexActor.Following
 	actor.ID = flexActor.ID
 	actor.Icon = flexActor.Icon
 	actor.Inbox = flexActor.Inbox
 	actor.Name = flexActor.Name
 	actor.Outbox = flexActor.Outbox
 	actor.PreferredUsername = flexActor.PreferredUsername
 	actor.PublicKey = flexActor.PublicKey
 	actor.Summary = flexActor.Summary
 	actor.Type = flexActor.Type
 	actor.URL = flexActor.URL
 
 	func(val interface{}) {
 		switch val.(type) {
 		case []interface{}:
 			// already a slice, do nothing
 			actor.Context = val.([]interface{})
 		default:
 			actor.Context = []interface{}{val}
 		}
 	}(flexActor.Context)
 
 	return nil
 }
 
 func parsePostIDFromURL(app *App, u *url.URL) (string, error) {
 	// Get post ID from URL
 	var collAlias, slug, postID string
 	if m := apCollectionPostIRIRegex.FindStringSubmatch(u.String()); len(m) == 3 {
 		collAlias = m[1]
 		slug = m[2]
 	} else if m = apDraftPostIRIRegex.FindStringSubmatch(u.String()); len(m) == 2 {
 		postID = m[1]
 	} else {
 		return "", fmt.Errorf("unable to match objectIRI: %s", u)
 	}
 
 	// Get postID if all we have is collection and slug
 	if collAlias != "" && slug != "" {
 		c, err := app.db.GetCollection(collAlias)
 		if err != nil {
 			return "", err
 		}
 		p, err := app.db.GetPost(slug, c.ID)
 		if err != nil {
 			return "", err
 		}
 		postID = p.ID
 	}
 
 	return postID, nil
 }
 
 func setCacheControl(w http.ResponseWriter, ttl time.Duration) {
 	w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%.0f", ttl.Seconds()))
 }
 
 func logOutgoingActivity(label string, activity any) {
 	b, err := json.MarshalIndent(activity, "", "  ")
 	if err != nil {
 		log.Error("Failed to marshal %s activity: %v", label, err)
 		return
 	}
 	log.Info("%s outgoing ActivityPub payload:\n%s", label, string(b))
 }
diff --git a/admin.go b/admin.go
index 6e0f3d5..a1fa39c 100644
--- a/admin.go
+++ b/admin.go
@@ -1,693 +1,689 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"fmt"
 	"html/template"
 	"net/http"
 	"runtime"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/passgen"
 	"github.com/writefreely/writefreely/appstats"
 	"github.com/writefreely/writefreely/config"
 )
 
 var (
 	appStartTime = time.Now()
 	sysStatus    systemStatus
 )
 
 const adminUsersPerPage = 30
 
 type systemStatus struct {
 	Uptime       string
 	NumGoroutine int
 
 	// General statistics.
 	MemAllocated string // bytes allocated and still in use
 	MemTotal     string // bytes allocated (even if freed)
 	MemSys       string // bytes obtained from system (sum of XxxSys below)
 	Lookups      uint64 // number of pointer lookups
 	MemMallocs   uint64 // number of mallocs
 	MemFrees     uint64 // number of frees
 
 	// Main allocation heap statistics.
 	HeapAlloc    string // bytes allocated and still in use
 	HeapSys      string // bytes obtained from system
 	HeapIdle     string // bytes in idle spans
 	HeapInuse    string // bytes in non-idle span
 	HeapReleased string // bytes released to the OS
 	HeapObjects  uint64 // total number of allocated objects
 
 	// Low-level fixed-size structure allocator statistics.
 	//	Inuse is bytes used now.
 	//	Sys is bytes obtained from system.
 	StackInuse  string // bootstrap stacks
 	StackSys    string
 	MSpanInuse  string // mspan structures
 	MSpanSys    string
 	MCacheInuse string // mcache structures
 	MCacheSys   string
 	BuckHashSys string // profiling bucket hash table
 	GCSys       string // GC metadata
 	OtherSys    string // other system allocations
 
 	// Garbage collector statistics.
 	NextGC       string // next run in HeapAlloc time (bytes)
 	LastGC       string // last run in absolute time (ns)
 	PauseTotalNs string
 	PauseNs      string // circular buffer of recent GC pause times, most recent at [(NumGC+255)%256]
 	NumGC        uint32
 }
 
 type inspectedCollection struct {
 	CollectionObj
 	Followers int
 	LastPost  string
 }
 
 type instanceContent struct {
 	ID      string
 	Type    string
 	Title   sql.NullString
 	Content string
 	Updated time.Time
 }
 
+// AdminPage holds any additional variables needed to render Admin pages. Currently none.
 type AdminPage struct {
-	UpdateAvailable bool
 }
 
 func NewAdminPage(app *App) *AdminPage {
-	ap := &AdminPage{}
-	if app.updates != nil {
-		ap.UpdateAvailable = app.updates.AreAvailableNoCheck()
-	}
-	return ap
+	return &AdminPage{}
 }
 
 func (c instanceContent) UpdatedFriendly() template.HTML {
 	/*
 		// TODO: accept a locale in this method and use that for the format
 		var loc monday.Locale = monday.LocaleEnUS
 		return monday.Format(u.Created, monday.DateTimeFormatsByLocale[loc], loc)
 	*/
 	if c.Updated.IsZero() {
 		return "<em>Never</em>"
 	}
 	return template.HTML(c.Updated.Format("January 2, 2006, 3:04 PM"))
 }
 
 func handleViewAdminDash(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p := struct {
 		*UserPage
 		*AdminPage
 		Message string
 
 		UsersCount, CollectionsCount, PostsCount int64
 	}{
 		UserPage:  NewUserPage(app, r, u, "Admin", nil),
 		AdminPage: NewAdminPage(app),
 		Message:   r.FormValue("m"),
 	}
 
 	// Get user stats
 	p.UsersCount = app.db.GetAllUsersCount()
 	var err error
 	p.CollectionsCount, err = app.db.GetTotalCollections()
 	if err != nil {
 		return err
 	}
 	p.PostsCount, err = app.db.GetTotalPosts()
 	if err != nil {
 		return err
 	}
 
 	showUserPage(w, "admin", p)
 	return nil
 }
 
 func handleViewAdminMonitor(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	updateAppStats()
 	p := struct {
 		*UserPage
 		*AdminPage
 		SysStatus systemStatus
 		Config    config.AppCfg
 
 		Message, ConfigMessage string
 	}{
 		UserPage:  NewUserPage(app, r, u, "Admin", nil),
 		AdminPage: NewAdminPage(app),
 		SysStatus: sysStatus,
 		Config:    app.cfg.App,
 
 		Message:       r.FormValue("m"),
 		ConfigMessage: r.FormValue("cm"),
 	}
 
 	showUserPage(w, "monitor", p)
 	return nil
 }
 
 func handleViewAdminSettings(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p := struct {
 		*UserPage
 		*AdminPage
 		Config config.AppCfg
 
 		Message, ConfigMessage string
 	}{
 		UserPage:  NewUserPage(app, r, u, "Admin", nil),
 		AdminPage: NewAdminPage(app),
 		Config:    app.cfg.App,
 
 		Message:       r.FormValue("m"),
 		ConfigMessage: r.FormValue("cm"),
 	}
 
 	showUserPage(w, "app-settings", p)
 	return nil
 }
 
 func handleViewAdminUsers(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p := struct {
 		*UserPage
 		*AdminPage
 		Config  config.AppCfg
 		Message string
 		Flashes []string
 
 		Users      *[]User
 		CurPage    int
 		TotalUsers int64
 		TotalPages []int
 	}{
 		UserPage:  NewUserPage(app, r, u, "Users", nil),
 		AdminPage: NewAdminPage(app),
 		Config:    app.cfg.App,
 		Message:   r.FormValue("m"),
 	}
 
 	p.Flashes, _ = getSessionFlashes(app, w, r, nil)
 	p.TotalUsers = app.db.GetAllUsersCount()
 	ttlPages := (p.TotalUsers - 1) / adminUsersPerPage + 1
 	p.TotalPages = []int{}
 	for i := 1; i <= int(ttlPages); i++ {
 		p.TotalPages = append(p.TotalPages, i)
 	}
 
 	var err error
 	p.CurPage, err = strconv.Atoi(r.FormValue("p"))
 	if err != nil || p.CurPage < 1 {
 		p.CurPage = 1
 	} else if p.CurPage > int(ttlPages) {
 		p.CurPage = int(ttlPages)
 	}
 
 	p.Users, err = app.db.GetAllUsers(uint(p.CurPage))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get users: %v", err)}
 	}
 
 	showUserPage(w, "users", p)
 	return nil
 }
 
 func handleViewAdminUser(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	username := vars["username"]
 	if username == "" {
 		return impart.HTTPError{http.StatusFound, "/admin/users"}
 	}
 
 	p := struct {
 		*UserPage
 		*AdminPage
 		Config  config.AppCfg
 		Message string
 
 		User        *User
 		Colls       []inspectedCollection
 		LastPost    string
 		NewPassword string
 		TotalPosts  int64
 		ClearEmail  string
 	}{
 		AdminPage: NewAdminPage(app),
 		Config:    app.cfg.App,
 		Message:   r.FormValue("m"),
 		Colls:     []inspectedCollection{},
 	}
 
 	var err error
 	p.User, err = app.db.GetUserForAuth(username)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("Could not get user: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, err.Error()}
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	for _, flash := range flashes {
 		if strings.HasPrefix(flash, "SUCCESS: ") {
 			p.NewPassword = strings.TrimPrefix(flash, "SUCCESS: ")
 			p.ClearEmail = p.User.EmailClear(app.keys)
 		}
 	}
 	p.UserPage = NewUserPage(app, r, u, p.User.Username, nil)
 	p.TotalPosts = app.db.GetUserPostsCount(p.User.ID)
 	lp, err := app.db.GetUserLastPostTime(p.User.ID)
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user's last post time: %v", err)}
 	}
 	if lp != nil {
 		p.LastPost = lp.Format("January 2, 2006, 3:04 PM")
 	}
 
 	colls, err := app.db.GetCollections(p.User, app.cfg.App.Host)
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user's collections: %v", err)}
 	}
 	for _, c := range *colls {
 		ic := inspectedCollection{
 			CollectionObj: CollectionObj{Collection: c},
 		}
 
 		if app.cfg.App.Federation {
 			folls, err := app.db.GetAPFollowers(&c)
 			if err == nil {
 				// TODO: handle error here (at least log it)
 				ic.Followers = len(*folls)
 			}
 		}
 
 		app.db.GetPostsCount(&ic.CollectionObj, true)
 
 		lp, err := app.db.GetCollectionLastPostTime(c.ID)
 		if err != nil {
 			log.Error("Didn't get last post time for collection %d: %v", c.ID, err)
 		}
 		if lp != nil {
 			ic.LastPost = lp.Format("January 2, 2006, 3:04 PM")
 		}
 
 		p.Colls = append(p.Colls, ic)
 	}
 
 	showUserPage(w, "view-user", p)
 	return nil
 }
 
 func handleAdminDeleteUser(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	if !u.IsAdmin() {
 		return impart.HTTPError{http.StatusForbidden, "Administrator privileges required for this action"}
 	}
 
 	vars := mux.Vars(r)
 	username := vars["username"]
 	confirmUsername := r.PostFormValue("confirm-username")
 
 	if confirmUsername != username {
 		return impart.HTTPError{http.StatusBadRequest, "Username was not confirmed"}
 	}
 
 	user, err := app.db.GetUserForAuth(username)
 	if err == ErrUserNotFound {
 		return impart.HTTPError{http.StatusNotFound, fmt.Sprintf("User '%s' was not found", username)}
 	} else if err != nil {
 		log.Error("get user for deletion: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user with username '%s': %v", username, err)}
 	}
 
 	err = app.db.DeleteAccount(user.ID)
 	if err != nil {
 		log.Error("delete user %s: %v", user.Username, err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not delete user account for '%s': %v", username, err)}
 	}
 
 	_ = addSessionFlash(app, w, r, fmt.Sprintf("User \"%s\" was deleted successfully.", username), nil)
 	return impart.HTTPError{http.StatusFound, "/admin/users"}
 }
 
 func handleAdminToggleUserStatus(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	username := vars["username"]
 	if username == "" {
 		return impart.HTTPError{http.StatusFound, "/admin/users"}
 	}
 
 	user, err := app.db.GetUserForAuth(username)
 	if err != nil {
 		log.Error("failed to get user: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user from username: %v", err)}
 	}
 	if user.IsSilenced() {
 		err = app.db.SetUserStatus(user.ID, UserActive)
 	} else {
 		err = app.db.SetUserStatus(user.ID, UserSilenced)
 
 		// reset the cache to removed silence user posts
 		updateTimelineCache(app.timeline, true)
 	}
 	if err != nil {
 		log.Error("toggle user silenced: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not toggle user status: %v", err)}
 	}
 	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/admin/user/%s#status", username)}
 }
 
 func handleAdminResetUserPass(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	username := vars["username"]
 	if username == "" {
 		return impart.HTTPError{http.StatusFound, "/admin/users"}
 	}
 
 	// Generate new random password since none supplied
 	pass := passgen.NewWordish()
 	hashedPass, err := auth.HashPass([]byte(pass))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
 	}
 
 	userIDVal := r.FormValue("user")
 	log.Info("ADMIN: Changing user %s password", userIDVal)
 	id, err := strconv.Atoi(userIDVal)
 	if err != nil {
 		return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Invalid user ID: %v", err)}
 	}
 
 	err = app.db.ChangePassphrase(int64(id), true, "", hashedPass)
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
 	}
 	log.Info("ADMIN: Successfully changed.")
 
 	addSessionFlash(app, w, r, fmt.Sprintf("SUCCESS: %s", pass), nil)
 
 	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/admin/user/%s", username)}
 }
 
 func handleViewAdminPages(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p := struct {
 		*UserPage
 		*AdminPage
 		Config  config.AppCfg
 		Message string
 
 		Pages []*instanceContent
 	}{
 		UserPage:  NewUserPage(app, r, u, "Pages", nil),
 		AdminPage: NewAdminPage(app),
 		Config:    app.cfg.App,
 		Message:   r.FormValue("m"),
 	}
 
 	var err error
 	p.Pages, err = app.db.GetInstancePages()
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get pages: %v", err)}
 	}
 
 	// Add in default pages
 	var hasAbout, hasContact, hasPrivacy bool
 	for i, c := range p.Pages {
 		if hasAbout && hasContact && hasPrivacy {
 			break
 		}
 		if c.ID == "about" {
 			hasAbout = true
 			if !c.Title.Valid {
 				p.Pages[i].Title = defaultAboutTitle(app.cfg)
 			}
 		} else if c.ID == "contact" {
 			hasContact = true
 			if !c.Title.Valid {
 				p.Pages[i].Title = defaultContactTitle()
 			}
 		} else if c.ID == "privacy" {
 			hasPrivacy = true
 			if !c.Title.Valid {
 				p.Pages[i].Title = defaultPrivacyTitle()
 			}
 		}
 	}
 	if !hasAbout {
 		p.Pages = append(p.Pages, &instanceContent{
 			ID:      "about",
 			Title:   defaultAboutTitle(app.cfg),
 			Content: defaultAboutPage(app.cfg),
 			Updated: defaultPageUpdatedTime,
 		})
 	}
 	if !hasContact {
 		p.Pages = append(p.Pages, &instanceContent{
 			ID:      "contact",
 			Title:   defaultContactTitle(),
 			Content: defaultContactPage(app),
 		})
 	}
 	if !hasPrivacy {
 		p.Pages = append(p.Pages, &instanceContent{
 			ID:      "privacy",
 			Title:   defaultPrivacyTitle(),
 			Content: defaultPrivacyPolicy(app.cfg),
 			Updated: defaultPageUpdatedTime,
 		})
 	}
 
 	showUserPage(w, "pages", p)
 	return nil
 }
 
 func handleViewAdminPage(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 	if slug == "" {
 		return impart.HTTPError{http.StatusFound, "/admin/pages"}
 	}
 
 	p := struct {
 		*UserPage
 		*AdminPage
 		Config  config.AppCfg
 		Message string
 
 		Banner  *instanceContent
 		Content *instanceContent
 	}{
 		AdminPage: NewAdminPage(app),
 		Config:    app.cfg.App,
 		Message:   r.FormValue("m"),
 	}
 
 	var err error
 	// Get pre-defined pages, or select slug
 	if slug == "about" {
 		p.Content, err = getAboutPage(app)
 	} else if slug == "contact" {
 		p.Content, err = getContactPage(app)
 	} else if slug == "privacy" {
 		p.Content, err = getPrivacyPage(app)
 	} else if slug == "landing" {
 		p.Banner, err = getLandingBanner(app)
 		if err != nil {
 			return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
 		}
 		p.Content, err = getLandingBody(app)
 		p.Content.ID = "landing"
 	} else if slug == "reader" {
 		p.Content, err = getReaderSection(app)
 	} else {
 		p.Content, err = app.db.GetDynamicContent(slug)
 	}
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get page: %v", err)}
 	}
 	title := "New page"
 	if p.Content != nil {
 		title = "Edit " + p.Content.ID
 	} else {
 		p.Content = &instanceContent{}
 	}
 	p.UserPage = NewUserPage(app, r, u, title, nil)
 
 	showUserPage(w, "view-page", p)
 	return nil
 }
 
 func handleAdminUpdateSite(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	id := vars["page"]
 
 	// Validate
 	if id != "about" && id != "contact" && id != "privacy" && id != "landing" && id != "reader" {
 		return impart.HTTPError{http.StatusNotFound, "No such page."}
 	}
 
 	var err error
 	m := ""
 	if id == "landing" {
 		// Handle special landing page
 		err = app.db.UpdateDynamicContent("landing-banner", "", r.FormValue("banner"), "section")
 		if err != nil {
 			m = "?m=" + err.Error()
 			return impart.HTTPError{http.StatusFound, "/admin/page/" + id + m}
 		}
 		err = app.db.UpdateDynamicContent("landing-body", "", r.FormValue("content"), "section")
 	} else if id == "reader" {
 		// Update sections with titles
 		err = app.db.UpdateDynamicContent(id, r.FormValue("title"), r.FormValue("content"), "section")
 	} else {
 		// Update page
 		err = app.db.UpdateDynamicContent(id, r.FormValue("title"), r.FormValue("content"), "page")
 	}
 	if err != nil {
 		m = "?m=" + err.Error()
 	}
 	return impart.HTTPError{http.StatusFound, "/admin/page/" + id + m}
 }
 
 func handleAdminUpdateConfig(apper Apper, u *User, w http.ResponseWriter, r *http.Request) error {
 	apper.App().cfg.App.SiteName = r.FormValue("site_name")
 	apper.App().cfg.App.SiteDesc = r.FormValue("site_desc")
 	apper.App().cfg.App.Landing = r.FormValue("landing")
 	apper.App().cfg.App.OpenRegistration = r.FormValue("open_registration") == "on"
 	apper.App().cfg.App.OpenDeletion = r.FormValue("open_deletion") == "on"
 	mul, err := strconv.Atoi(r.FormValue("min_username_len"))
 	if err == nil {
 		apper.App().cfg.App.MinUsernameLen = mul
 	}
 	mb, err := strconv.Atoi(r.FormValue("max_blogs"))
 	if err == nil {
 		apper.App().cfg.App.MaxBlogs = mb
 	}
 	apper.App().cfg.App.Federation = r.FormValue("federation") == "on"
 	apper.App().cfg.App.PublicStats = r.FormValue("public_stats") == "on"
 	apper.App().cfg.App.Monetization = r.FormValue("monetization") == "on"
 	apper.App().cfg.App.Private = r.FormValue("private") == "on"
 	apper.App().cfg.App.LocalTimeline = r.FormValue("local_timeline") == "on"
 	if apper.App().cfg.App.LocalTimeline && apper.App().timeline == nil {
 		log.Info("Initializing local timeline...")
 		initLocalTimeline(apper.App())
 	}
 	apper.App().cfg.App.UserInvites = r.FormValue("user_invites")
 	if apper.App().cfg.App.UserInvites == "none" {
 		apper.App().cfg.App.UserInvites = ""
 	}
 	apper.App().cfg.App.DefaultVisibility = r.FormValue("default_visibility")
 
 	m := "?cm=Configuration+saved."
 	err = apper.SaveConfig(apper.App().cfg)
 	if err != nil {
 		m = "?cm=" + err.Error()
 	}
 	return impart.HTTPError{http.StatusFound, "/admin/settings" + m + "#config"}
 }
 
 func updateAppStats() {
 	sysStatus.Uptime = appstats.TimeSincePro(appStartTime)
 
 	m := new(runtime.MemStats)
 	runtime.ReadMemStats(m)
 	sysStatus.NumGoroutine = runtime.NumGoroutine()
 
 	sysStatus.MemAllocated = appstats.FileSize(int64(m.Alloc))
 	sysStatus.MemTotal = appstats.FileSize(int64(m.TotalAlloc))
 	sysStatus.MemSys = appstats.FileSize(int64(m.Sys))
 	sysStatus.Lookups = m.Lookups
 	sysStatus.MemMallocs = m.Mallocs
 	sysStatus.MemFrees = m.Frees
 
 	sysStatus.HeapAlloc = appstats.FileSize(int64(m.HeapAlloc))
 	sysStatus.HeapSys = appstats.FileSize(int64(m.HeapSys))
 	sysStatus.HeapIdle = appstats.FileSize(int64(m.HeapIdle))
 	sysStatus.HeapInuse = appstats.FileSize(int64(m.HeapInuse))
 	sysStatus.HeapReleased = appstats.FileSize(int64(m.HeapReleased))
 	sysStatus.HeapObjects = m.HeapObjects
 
 	sysStatus.StackInuse = appstats.FileSize(int64(m.StackInuse))
 	sysStatus.StackSys = appstats.FileSize(int64(m.StackSys))
 	sysStatus.MSpanInuse = appstats.FileSize(int64(m.MSpanInuse))
 	sysStatus.MSpanSys = appstats.FileSize(int64(m.MSpanSys))
 	sysStatus.MCacheInuse = appstats.FileSize(int64(m.MCacheInuse))
 	sysStatus.MCacheSys = appstats.FileSize(int64(m.MCacheSys))
 	sysStatus.BuckHashSys = appstats.FileSize(int64(m.BuckHashSys))
 	sysStatus.GCSys = appstats.FileSize(int64(m.GCSys))
 	sysStatus.OtherSys = appstats.FileSize(int64(m.OtherSys))
 
 	sysStatus.NextGC = appstats.FileSize(int64(m.NextGC))
 	sysStatus.LastGC = fmt.Sprintf("%.1fs", float64(time.Now().UnixNano()-int64(m.LastGC))/1000/1000/1000)
 	sysStatus.PauseTotalNs = fmt.Sprintf("%.1fs", float64(m.PauseTotalNs)/1000/1000/1000)
 	sysStatus.PauseNs = fmt.Sprintf("%.3fs", float64(m.PauseNs[(m.NumGC+255)%256])/1000/1000/1000)
 	sysStatus.NumGC = m.NumGC
 }
 
 func adminResetPassword(app *App, u *User, newPass string) error {
 	hashedPass, err := auth.HashPass([]byte(newPass))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
 	}
 
 	err = app.db.ChangePassphrase(u.ID, true, "", hashedPass)
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
 	}
 	return nil
 }
 
 func handleViewAdminUpdates(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	check := r.URL.Query().Get("check")
 
 	if check == "now" && app.cfg.App.UpdateChecks {
 		app.updates.CheckNow()
 	}
 
 	p := struct {
 		*UserPage
 		*AdminPage
 		CurReleaseNotesURL    string
 		LastChecked           string
 		LastChecked8601       string
 		LatestVersion         string
 		LatestReleaseURL      string
 		LatestReleaseNotesURL string
 		CheckFailed           bool
 	}{
 		UserPage:  NewUserPage(app, r, u, "Updates", nil),
 		AdminPage: NewAdminPage(app),
 	}
 	p.CurReleaseNotesURL = wfReleaseNotesURL(p.Version)
 	if app.cfg.App.UpdateChecks {
 		p.LastChecked = app.updates.lastCheck.Format("January 2, 2006, 3:04 PM")
 		p.LastChecked8601 = app.updates.lastCheck.Format("2006-01-02T15:04:05Z")
 		p.LatestVersion = app.updates.LatestVersion()
 		p.LatestReleaseURL = app.updates.ReleaseURL()
 		p.LatestReleaseNotesURL = app.updates.ReleaseNotesURL()
 		p.UpdateAvailable = app.updates.AreAvailable()
 		p.CheckFailed = app.updates.checkError != nil
 	}
 
 	showUserPage(w, "app-updates", p)
 	return nil
 }
diff --git a/app.go b/app.go
index 8e2b688..3114daa 100644
--- a/app.go
+++ b/app.go
@@ -1,1021 +1,1162 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"crypto/tls"
 	"database/sql"
 	_ "embed"
 	"fmt"
 	"html/template"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
 	"os/signal"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"syscall"
+	"text/tabwriter"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/gorilla/schema"
 	"github.com/gorilla/sessions"
 	"github.com/manifoldco/promptui"
 	stripmd "github.com/writeas/go-strip-markdown/v2"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/converter"
 	"github.com/writeas/web-core/log"
 	"golang.org/x/crypto/acme/autocert"
 
 	"github.com/writefreely/writefreely/author"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/key"
 	"github.com/writefreely/writefreely/migrations"
 	"github.com/writefreely/writefreely/page"
 )
 
 const (
 	staticDir        = "static"
 	assumedTitleLen  = 80
 	postsPerPage     = 10
 	postsPerArchPage = 40
 
 	serverSoftware = "WriteFreely"
 	softwareURL    = "https://writefreely.org"
 )
 
 var (
 	debugging bool
 
 	// Software version can be set from git env using -ldflags
-	softwareVer = "0.16.0"
+	softwareVer = "0.17.2"
 
 	// DEPRECATED VARS
 	isSingleUser bool
 )
 
 // App holds data and configuration for an individual WriteFreely instance.
 type App struct {
 	router       *mux.Router
 	shttp        *http.ServeMux
 	db           *datastore
 	cfg          *config.Config
 	cfgFile      string
 	keys         *key.Keychain
 	sessionStore sessions.Store
 	formDecoder  *schema.Decoder
 	updates      *updatesCache
 
 	timeline *localTimeline
 }
 
 // DB returns the App's datastore
 func (app *App) DB() *datastore {
 	return app.db
 }
 
 // Router returns the App's router
 func (app *App) Router() *mux.Router {
 	return app.router
 }
 
 // Config returns the App's current configuration.
 func (app *App) Config() *config.Config {
 	return app.cfg
 }
 
 // SetConfig updates the App's Config to the given value.
 func (app *App) SetConfig(cfg *config.Config) {
 	app.cfg = cfg
 }
 
 // SetKeys updates the App's Keychain to the given value.
 func (app *App) SetKeys(k *key.Keychain) {
 	app.keys = k
 }
 
 func (app *App) SessionStore() sessions.Store {
 	return app.sessionStore
 }
 
 func (app *App) SetSessionStore(s sessions.Store) {
 	app.sessionStore = s
 }
 
 // Apper is the interface for getting data into and out of a WriteFreely
 // instance (or "App").
 //
 // App returns the App for the current instance.
 //
 // LoadConfig reads an app configuration into the App, returning any error
 // encountered.
 //
 // SaveConfig persists the current App configuration.
 //
 // LoadKeys reads the App's encryption keys and loads them into its
 // key.Keychain.
 type Apper interface {
 	App() *App
 
 	LoadConfig() error
 	SaveConfig(*config.Config) error
 
 	LoadKeys() error
 
 	ReqLog(r *http.Request, status int, timeSince time.Duration) string
 }
 
 // App returns the App
 func (app *App) App() *App {
 	return app
 }
 
 // LoadConfig loads and parses a config file.
 func (app *App) LoadConfig() error {
 	log.Info("Loading %s configuration...", app.cfgFile)
 	cfg, err := config.Load(app.cfgFile)
 	if err != nil {
 		log.Error("Unable to load configuration: %v", err)
 		os.Exit(1)
 		return err
 	}
 	app.cfg = cfg
 	return nil
 }
 
 // SaveConfig saves the given Config to disk -- namely, to the App's cfgFile.
 func (app *App) SaveConfig(c *config.Config) error {
 	return config.Save(c, app.cfgFile)
 }
 
 // LoadKeys reads all needed keys from disk into the App. In order to use the
 // configured `Server.KeysParentDir`, you must call initKeyPaths(App) before
 // this.
 func (app *App) LoadKeys() error {
 	var err error
 	app.keys = &key.Keychain{}
 
 	if debugging {
 		log.Info("  %s", emailKeyPath)
 	}
 
 	executable, err := os.Executable()
 	if err != nil {
 		executable = "writefreely"
 	} else {
 		executable = filepath.Base(executable)
 	}
 
 	app.keys.EmailKey, err = os.ReadFile(emailKeyPath)
 	if err != nil {
 		return err
 	}
 
 	if debugging {
 		log.Info("  %s", cookieAuthKeyPath)
 	}
 	app.keys.CookieAuthKey, err = os.ReadFile(cookieAuthKeyPath)
 	if err != nil {
 		return err
 	}
 
 	if debugging {
 		log.Info("  %s", cookieKeyPath)
 	}
 	app.keys.CookieKey, err = os.ReadFile(cookieKeyPath)
 	if err != nil {
 		return err
 	}
 
 	if debugging {
 		log.Info("  %s", csrfKeyPath)
 	}
 	app.keys.CSRFKey, err = os.ReadFile(csrfKeyPath)
 	if err != nil {
 		if os.IsNotExist(err) {
 			log.Error(`Missing key: %s.
 
   Run this command to generate missing keys:
     %s keys generate
 
 `, csrfKeyPath, executable)
 		}
 		return err
 	}
 
 	return nil
 }
 
 func (app *App) ReqLog(r *http.Request, status int, timeSince time.Duration) string {
 	return fmt.Sprintf("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, timeSince, r.UserAgent())
 }
 
 // handleViewHome shows page at root path. It checks the configuration and
 // authentication state to show the correct page.
 func handleViewHome(app *App, w http.ResponseWriter, r *http.Request) error {
 	if app.cfg.App.SingleUser {
 		// Render blog index
 		return handleViewCollection(app, w, r)
 	}
 
 	// Multi-user instance
 	forceLanding := r.FormValue("landing") == "1"
 	if !forceLanding {
 		// Show correct page based on user auth status and configured landing path
 		u := getUserSession(app, r)
 
 		if app.cfg.App.Chorus {
 			// This instance is focused on reading, so show Reader on home route if not
 			// private or a private-instance user is logged in.
 			if !app.cfg.App.Private || u != nil {
 				return viewLocalTimeline(app, w, r)
 			}
 		}
 
 		if u != nil {
 			// User is logged in, so show the Pad
 			return handleViewPad(app, w, r)
 		}
 
 		if app.cfg.App.Private {
 			return viewLogin(app, w, r)
 		}
 
 		if land := app.cfg.App.LandingPath(); land != "/" {
 			return impart.HTTPError{http.StatusFound, land}
 		}
 	}
 
 	return handleViewLanding(app, w, r)
 }
 
 func handleViewLanding(app *App, w http.ResponseWriter, r *http.Request) error {
 	forceLanding := r.FormValue("landing") == "1"
 
 	p := struct {
 		page.StaticPage
 		*OAuthButtons
 		Flashes []template.HTML
 		Banner  template.HTML
 		Content template.HTML
 
 		ForcedLanding bool
 	}{
 		StaticPage:    pageForReq(app, r),
 		OAuthButtons:  NewOAuthButtons(app.Config()),
 		ForcedLanding: forceLanding,
 	}
 
 	banner, err := getLandingBanner(app)
 	if err != nil {
 		log.Error("unable to get landing banner: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
 	}
 	p.Banner = template.HTML(applyMarkdown([]byte(banner.Content), "", app.cfg))
 
 	content, err := getLandingBody(app)
 	if err != nil {
 		log.Error("unable to get landing content: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get content: %v", err)}
 	}
 	p.Content = template.HTML(applyMarkdown([]byte(content.Content), "", app.cfg))
 
 	// Get error messages
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// Ignore this
 		log.Error("Unable to get session in handleViewHome; ignoring: %v", err)
 	}
 	flashes, _ := getSessionFlashes(app, w, r, session)
 	for _, flash := range flashes {
 		p.Flashes = append(p.Flashes, template.HTML(flash))
 	}
 
 	// Show landing page
 	return renderPage(w, "landing.tmpl", p)
 }
 
 func handleTemplatedPage(app *App, w http.ResponseWriter, r *http.Request, t *template.Template) error {
 	p := struct {
 		page.StaticPage
 		ContentTitle string
 		Content      template.HTML
 		PlainContent string
 		Updated      string
 
 		AboutStats *InstanceStats
 	}{
 		StaticPage: pageForReq(app, r),
 	}
 	if r.URL.Path == "/about" || r.URL.Path == "/contact" || r.URL.Path == "/privacy" {
 		var c *instanceContent
 		var err error
 
 		if r.URL.Path == "/about" {
 			c, err = getAboutPage(app)
 
 			// Fetch stats
 			p.AboutStats = &InstanceStats{}
 			p.AboutStats.NumPosts, _ = app.db.GetTotalPosts()
 			p.AboutStats.NumBlogs, _ = app.db.GetTotalCollections()
 		} else if r.URL.Path == "/contact" {
 			c, err = getContactPage(app)
 			if c.Updated.IsZero() {
 				// Page was never set up, so return 404
 				return ErrPostNotFound
 			}
 		} else {
 			c, err = getPrivacyPage(app)
 		}
 
 		if err != nil {
 			return err
 		}
 		p.ContentTitle = c.Title.String
 		p.Content = template.HTML(applyMarkdown([]byte(c.Content), "", app.cfg))
 		p.PlainContent = shortPostDescription(stripmd.Strip(c.Content))
 		if !c.Updated.IsZero() {
 			p.Updated = c.Updated.Format("January 2, 2006")
 		}
 	}
 
 	// Serve templated page
 	err := t.ExecuteTemplate(w, "base", p)
 	if err != nil {
 		log.Error("Unable to render page: %v", err)
 	}
 	return nil
 }
 
 func pageForReq(app *App, r *http.Request) page.StaticPage {
 	p := page.StaticPage{
 		AppCfg:  app.cfg.App,
 		Path:    r.URL.Path,
 		Version: "v" + softwareVer,
 	}
 
 	// Use custom style, if file exists
 	if _, err := os.Stat(filepath.Join(app.cfg.Server.StaticParentDir, staticDir, "local", "custom.css")); err == nil {
 		p.CustomCSS = true
 	}
 
 	// Add user information, if given
 	var u *User
 	accessToken := r.FormValue("t")
 	if accessToken != "" {
 		userID := app.db.GetUserID(accessToken)
 		if userID != -1 {
 			var err error
 			u, err = app.db.GetUserByID(userID)
 			if err == nil {
 				p.Username = u.Username
 			}
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u != nil {
 			p.Username = u.Username
 			p.IsAdmin = u != nil && u.IsAdmin()
 			p.CanInvite = canUserInvite(app.cfg, p.IsAdmin)
+			if p.IsAdmin && app.updates != nil {
+				p.UpdateAvailable = app.updates.AreAvailableNoCheck()
+			}
 		}
 	}
 	p.CanViewReader = !app.cfg.App.Private || u != nil
 
 	return p
 }
 
 var fileRegex = regexp.MustCompile("/([^/]*\\.[^/]*)$")
 
 // Initialize loads the app configuration and initializes templates, keys,
 // session, route handlers, and the database connection.
 func Initialize(apper Apper, debug bool) (*App, error) {
 	debugging = debug
 
+	// Ensure a configuration file exists first, for a nicer error message
+	if _, err := os.Stat(apper.App().cfgFile); os.IsNotExist(err) {
+		flagOpt := ""
+		loc := " yet"
+		if apper.App().cfgFile != config.FileName {
+			flagOpt = " -c " + apper.App().cfgFile
+			loc = " at " + apper.App().cfgFile
+		}
+		return nil, fmt.Errorf("No configuration file%s. To create, run:\n  writefreely%s config start", loc, flagOpt)
+	}
+
 	apper.LoadConfig()
 
 	// Load templates
 	err := InitTemplates(apper.App().Config())
 	if err != nil {
 		return nil, fmt.Errorf("load templates: %s", err)
 	}
 
 	// Load keys and set up session
 	initKeyPaths(apper.App()) // TODO: find a better way to do this, since it's unneeded in all Apper implementations
 	err = InitKeys(apper)
 	if err != nil {
 		return nil, fmt.Errorf("init keys: %s", err)
 	}
 	apper.App().InitUpdates()
 
 	apper.App().InitSession()
 
 	apper.App().InitDecoder()
 
 	err = ConnectToDatabase(apper.App())
 	if err != nil {
 		return nil, fmt.Errorf("connect to DB: %s", err)
 	}
 
 	initActivityPub(apper.App())
 
 	if apper.App().cfg.Email.Enabled() {
 		log.Info("Starting publish jobs queue...")
 		go startPublishJobsQueue(apper.App())
 	} else {
 		log.Info("[jobs] Not starting publish jobs queue: no email provider is configured.")
 	}
 
 	// Handle local timeline, if enabled
 	if apper.App().cfg.App.LocalTimeline {
 		log.Info("Initializing local timeline...")
 		initLocalTimeline(apper.App())
 	}
 
 	return apper.App(), nil
 }
 
 func Serve(app *App, r *mux.Router) {
 	log.Info("Going to serve...")
 
 	isSingleUser = app.cfg.App.SingleUser
 	app.cfg.Server.Dev = debugging
 
 	// Handle shutdown
 	c := make(chan os.Signal, 2)
 	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
 	go func() {
 		<-c
 		log.Info("Shutting down...")
 		shutdown(app)
 		log.Info("Done.")
 		os.Exit(0)
 	}()
 
 	// Start gopher server
 	if app.cfg.Server.GopherPort > 0 && !app.cfg.App.Private {
 		go initGopher(app)
 	}
 
 	// Start web application server
 	var bindAddress = app.cfg.Server.Bind
 	if bindAddress == "" {
 		bindAddress = "localhost"
 	}
 	var err error
 	if app.cfg.IsSecureStandalone() {
 		if app.cfg.Server.Autocert {
 			m := &autocert.Manager{
 				Prompt: autocert.AcceptTOS,
 				Cache:  autocert.DirCache(app.cfg.Server.TLSCertPath),
 			}
 			host, err := url.Parse(app.cfg.App.Host)
 			if err != nil {
 				log.Error("[WARNING] Unable to parse configured host! %s", err)
 				log.Error(`[WARNING] ALL hosts are allowed, which can open you to an attack where
 clients connect to a server by IP address and pretend to be asking for an
 incorrect host name, and cause you to reach the CA's rate limit for certificate
 requests. We recommend supplying a valid host name.`)
 				log.Info("Using autocert on ANY host")
 			} else {
 				log.Info("Using autocert on host %s", host.Host)
 				m.HostPolicy = autocert.HostWhitelist(host.Host)
 			}
 			s := &http.Server{
 				Addr:    ":https",
 				Handler: r,
 				TLSConfig: &tls.Config{
 					GetCertificate: m.GetCertificate,
 				},
 			}
 			s.SetKeepAlivesEnabled(false)
 
 			go func() {
 				log.Info("Serving redirects on http://%s:80", bindAddress)
 				err = http.ListenAndServe(":80", m.HTTPHandler(nil))
 				log.Error("Unable to start redirect server: %v", err)
 			}()
 
 			log.Info("Serving on https://%s:443", bindAddress)
 			log.Info("---")
 			err = s.ListenAndServeTLS("", "")
 		} else {
 			go func() {
 				log.Info("Serving redirects on http://%s:80", bindAddress)
 				err = http.ListenAndServe(fmt.Sprintf("%s:80", bindAddress), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					http.Redirect(w, r, app.cfg.App.Host, http.StatusMovedPermanently)
 				}))
 				log.Error("Unable to start redirect server: %v", err)
 			}()
 
 			log.Info("Serving on https://%s:443", bindAddress)
 			log.Info("Using manual certificates")
 			log.Info("---")
 			err = http.ListenAndServeTLS(fmt.Sprintf("%s:443", bindAddress), app.cfg.Server.TLSCertPath, app.cfg.Server.TLSKeyPath, r)
 		}
 	} else {
 		network := "tcp"
 		protocol := "http"
 		if strings.HasPrefix(bindAddress, "/") {
 			network = "unix"
 			protocol = "http+unix"
 
 			// old sockets will remain after server closes;
 			// we need to delete them in order to open new ones
 			err = os.Remove(bindAddress)
 			if err != nil && !os.IsNotExist(err) {
 				log.Error("%s already exists but could not be removed: %v", bindAddress, err)
 				os.Exit(1)
 			}
 		} else {
 			bindAddress = fmt.Sprintf("%s:%d", bindAddress, app.cfg.Server.Port)
 		}
 
 		log.Info("Serving on %s://%s", protocol, bindAddress)
 		log.Info("---")
 		listener, err := net.Listen(network, bindAddress)
 		if err != nil {
 			log.Error("Could not bind to address: %v", err)
 			os.Exit(1)
 		}
 
 		if network == "unix" {
 			err = os.Chmod(bindAddress, 0o666)
 			if err != nil {
 				log.Error("Could not update socket permissions: %v", err)
 				os.Exit(1)
 			}
 		}
 
 		defer listener.Close()
 		err = http.Serve(listener, r)
 	}
 	if err != nil {
 		log.Error("Unable to start: %v", err)
 		os.Exit(1)
 	}
 }
 
 func (app *App) InitDecoder() {
 	// TODO: do this at the package level, instead of the App level
 	// Initialize modules
 	app.formDecoder = schema.NewDecoder()
+	// Ignore fields like the CSRF token that forms submit but that don't
+	// map to any decoded struct.
+	app.formDecoder.IgnoreUnknownKeys(true)
 	app.formDecoder.RegisterConverter(converter.NullJSONString{}, converter.ConvertJSONNullString)
 	app.formDecoder.RegisterConverter(converter.NullJSONBool{}, converter.ConvertJSONNullBool)
 	app.formDecoder.RegisterConverter(sql.NullString{}, converter.ConvertSQLNullString)
 	app.formDecoder.RegisterConverter(sql.NullBool{}, converter.ConvertSQLNullBool)
 	app.formDecoder.RegisterConverter(sql.NullInt64{}, converter.ConvertSQLNullInt64)
 	app.formDecoder.RegisterConverter(sql.NullFloat64{}, converter.ConvertSQLNullFloat64)
 }
 
 // ConnectToDatabase validates and connects to the configured database, then
 // tests the connection.
 func ConnectToDatabase(app *App) error {
 	// Check database configuration
 	if app.cfg.Database.Type == driverMySQL && app.cfg.Database.User == "" {
 		return fmt.Errorf("Database user not set.")
 	}
 	if app.cfg.Database.Host == "" {
 		app.cfg.Database.Host = "localhost"
 	}
 	if app.cfg.Database.Database == "" {
 		app.cfg.Database.Database = "writefreely"
 	}
 
 	// TODO: check err
 	connectToDatabase(app)
 
 	// Test database connection
 	err := app.db.Ping()
 	if err != nil {
 		return fmt.Errorf("Database ping failed: %s", err)
 	}
 	log.Info("Connected to database.")
 
 	ver, err := app.db.version()
 	if err != nil {
 		log.Error("Unable to get DB version: %v", err)
 	} else {
 		log.Info("Database version: %v", ver)
 		if app.cfg.Database.Type == driverMySQL && strings.HasPrefix(ver, "5.") {
 			log.Info("Enabling compatibility for MySQL v5.x")
 			app.db.useSpencerRegex = true
 		}
 	}
 
+	// Ensure the database schema is up-to-date
+	var dbVer int
+	err = app.db.QueryRow("SELECT MAX(version) FROM appmigrations").Scan(&dbVer)
+	if err != nil {
+		log.Error("Unable to read migrations version: %v", err)
+	} else if dbVer < migrations.CurrentVer() {
+		log.Info("+--------------------------------------------------------------------------+")
+		log.Info("| IMPORTANT! There are pending migrations (%d). Run: writefreely db migrate |", migrations.CurrentVer()-dbVer)
+		log.Info("+--------------------------------------------------------------------------+")
+	}
+
 	return nil
 }
 
 // FormatVersion constructs the version string for the application
 func FormatVersion() string {
 	return serverSoftware + " " + softwareVer
 }
 
 // OutputVersion prints out the version of the application.
 func OutputVersion() {
 	fmt.Println(FormatVersion())
 }
 
 // NewApp creates a new app instance.
 func NewApp(cfgFile string) *App {
 	return &App{
 		cfgFile: cfgFile,
 	}
 }
 
 // CreateConfig creates a default configuration and saves it to the app's cfgFile.
 func CreateConfig(app *App) error {
 	log.Info("Creating configuration...")
 	c := config.New()
 	log.Info("Saving configuration %s...", app.cfgFile)
 	err := config.Save(c, app.cfgFile)
 	if err != nil {
 		return fmt.Errorf("Unable to save configuration: %v", err)
 	}
 	return nil
 }
 
 // DoConfig runs the interactive configuration process.
 func DoConfig(app *App, configSections string) {
 	if configSections == "" {
 		configSections = "server db app"
 	}
 	// let's check there aren't any garbage in the list
 	configSectionsArray := strings.Split(configSections, " ")
 	for _, element := range configSectionsArray {
 		if element != "server" && element != "db" && element != "app" {
 			log.Error("Invalid argument to --sections. Valid arguments are only \"server\", \"db\" and \"app\"")
 			os.Exit(1)
 		}
 	}
 	d, err := config.Configure(app.cfgFile, configSections)
 	if err != nil {
 		log.Error("Unable to configure: %v", err)
 		os.Exit(1)
 	}
 	app.cfg = d.Config
 	connectToDatabase(app)
 	defer shutdown(app)
 
 	if !app.db.DatabaseInitialized() {
 		err = adminInitDatabase(app)
 		if err != nil {
 			log.Error(err.Error())
 			os.Exit(1)
 		}
 	} else {
 		log.Info("Database already initialized.")
 	}
 
 	if d.User != nil {
 		u := &User{
 			Username:   d.User.Username,
 			HashedPass: d.User.HashedPass,
 			Created:    time.Now().Truncate(time.Second).UTC(),
 		}
 
 		// Create blog
 		log.Info("Creating user %s...\n", u.Username)
 		err = app.db.CreateUser(app.cfg, u, app.cfg.App.SiteName, "")
 		if err != nil {
 			log.Error("Unable to create user: %s", err)
 			os.Exit(1)
 		}
 		log.Info("Done!")
 	}
 	os.Exit(0)
 }
 
 // GenerateKeyFiles creates app encryption keys and saves them into the configured KeysParentDir.
 func GenerateKeyFiles(app *App) error {
 	// Read keys path from config
 	app.LoadConfig()
 
 	// Create keys dir if it doesn't exist yet
 	fullKeysDir := filepath.Join(app.cfg.Server.KeysParentDir, keysDir)
 	if _, err := os.Stat(fullKeysDir); os.IsNotExist(err) {
 		err = os.Mkdir(fullKeysDir, 0700)
 		if err != nil {
 			return err
 		}
 	}
 
 	// Generate keys
 	initKeyPaths(app)
 	// TODO: use something like https://github.com/hashicorp/go-multierror to return errors
 	var keyErrs error
 	err := generateKey(emailKeyPath)
 	if err != nil {
 		keyErrs = err
 	}
 	err = generateKey(cookieAuthKeyPath)
 	if err != nil {
 		keyErrs = err
 	}
 	err = generateKey(cookieKeyPath)
 	if err != nil {
 		keyErrs = err
 	}
 	err = generateKey(csrfKeyPath)
 	if err != nil {
 		keyErrs = err
 	}
 
 	return keyErrs
 }
 
 // CreateSchema creates all database tables needed for the application.
 func CreateSchema(apper Apper) error {
 	apper.LoadConfig()
 	connectToDatabase(apper.App())
 	defer shutdown(apper.App())
 	err := adminInitDatabase(apper.App())
 	if err != nil {
 		return err
 	}
 	return nil
 }
 
 // Migrate runs all necessary database migrations.
 func Migrate(apper Apper) error {
 	apper.LoadConfig()
 	connectToDatabase(apper.App())
 	defer shutdown(apper.App())
 
 	err := migrations.Migrate(migrations.NewDatastore(apper.App().db.DB, apper.App().db.driverName))
 	if err != nil {
 		return fmt.Errorf("migrate: %s", err)
 	}
 	return nil
 }
 
 // ResetPassword runs the interactive password reset process.
 func ResetPassword(apper Apper, username string) error {
 	// Connect to the database
 	apper.LoadConfig()
 	connectToDatabase(apper.App())
 	defer shutdown(apper.App())
 
 	// Fetch user
 	u, err := apper.App().db.GetUserForAuth(username)
 	if err != nil {
 		log.Error("Get user: %s", err)
 		os.Exit(1)
 	}
 
 	// Prompt for new password
 	prompt := promptui.Prompt{
 		Templates: &promptui.PromptTemplates{
 			Success: "{{ . | bold | faint }}: ",
 		},
 		Label: "New password",
 		Mask:  '*',
 	}
 	newPass, err := prompt.Run()
 	if err != nil {
 		log.Error("%s", err)
 		os.Exit(1)
 	}
 
 	// Do the update
 	log.Info("Updating...")
 	err = adminResetPassword(apper.App(), u, newPass)
 	if err != nil {
 		log.Error("%s", err)
 		os.Exit(1)
 	}
 	log.Info("Success.")
 	return nil
 }
 
 // DoDeleteAccount runs the confirmation and account delete process.
 func DoDeleteAccount(apper Apper, username string) error {
 	// Connect to the database
 	apper.LoadConfig()
 	connectToDatabase(apper.App())
 	defer shutdown(apper.App())
 
 	// check user exists
 	u, err := apper.App().db.GetUserForAuth(username)
 	if err != nil {
 		log.Error("%s", err)
 		os.Exit(1)
 	}
 	userID := u.ID
 
 	// do not delete the admin account
 	// TODO: check for other admins and skip?
 	if u.IsAdmin() {
 		log.Error("Can not delete admin account")
 		os.Exit(1)
 	}
 
 	// confirm deletion, w/ w/out posts
 	prompt := promptui.Prompt{
 		Templates: &promptui.PromptTemplates{
 			Success: "{{ . | bold | faint }}: ",
 		},
 		Label:     fmt.Sprintf("Really delete user : %s", username),
 		IsConfirm: true,
 	}
 	_, err = prompt.Run()
 	if err != nil {
 		log.Info("Aborted...")
 		os.Exit(0)
 	}
 
 	log.Info("Deleting...")
 	err = apper.App().db.DeleteAccount(userID)
 	if err != nil {
 		log.Error("%s", err)
 		os.Exit(1)
 	}
 	log.Info("Success.")
 	return nil
 }
 
+// UserAction is a bulk moderation action applied to a filtered set of users.
+type UserAction int
+
+const (
+	// ActionList only prints matching users, changing nothing.
+	ActionList UserAction = iota
+	// ActionSilence silences all matching users.
+	ActionSilence
+	// ActionDelete permanently deletes all matching users and their content.
+	ActionDelete
+)
+
+// ModerateUsers lists users matching the given filter and, when action is
+// ActionSilence or ActionDelete, applies that action to the whole set after a
+// single confirmation prompt. It's the backend for the `users` command,
+// intended for cleaning up waves of spam signups.
+func ModerateUsers(apper Apper, filter UserFilter, action UserAction) error {
+	// Connect to the database
+	apper.LoadConfig()
+	connectToDatabase(apper.App())
+	defer shutdown(apper.App())
+
+	app := apper.App()
+
+	// Admins are only ever included when listing; silence/delete must never
+	// touch them, regardless of the filter passed in.
+	filter.IncludeAdmins = action == ActionList
+
+	users, err := app.db.GetUsersFiltered(filter)
+	if err != nil {
+		log.Error("%s", err)
+		os.Exit(1)
+	}
+
+	// Print the matching users
+	fmt.Printf("Matched %d users:\n", len(users))
+	if len(users) > 0 {
+		w := tabwriter.NewWriter(os.Stdout, 0, 4, 2, ' ', 0)
+		fmt.Fprintln(w, "ID\tUSERNAME\tCREATED\tPOSTS\tSTATUS")
+		for _, u := range users {
+			status := ""
+			if u.IsAdmin() {
+				status = "admin"
+			} else if u.IsSilenced() {
+				status = "silenced"
+			}
+			fmt.Fprintf(w, "%d\t%s\t%s\t%d\t%s\n", u.ID, u.Username, u.Created.Format("2006-01-02 15:04 MST"), u.PostCount, status)
+		}
+		w.Flush()
+	}
+	fmt.Printf("(%d total)\n", len(users))
+
+	// List-only: nothing more to do
+	if action == ActionList {
+		return nil
+	}
+
+	// Nothing to act on
+	if len(users) == 0 {
+		log.Info("No users to act on.")
+		return nil
+	}
+
+	// Confirm the action, echoing the count and verb
+	verb := "SILENCE"
+	if action == ActionDelete {
+		verb = "DELETE"
+	}
+	label := fmt.Sprintf("Really %s %d users", verb, len(users))
+	if action == ActionDelete {
+		label += " and all their content? This cannot be undone"
+	}
+	prompt := promptui.Prompt{
+		Templates: &promptui.PromptTemplates{
+			Success: "{{ . | bold | faint }}: ",
+		},
+		Label:     label,
+		IsConfirm: true,
+	}
+	if _, err = prompt.Run(); err != nil {
+		log.Info("Aborted...")
+		return nil
+	}
+
+	// Apply the action, isolating per-user errors so one failure doesn't
+	// halt the whole batch.
+	log.Info("Working...")
+	var done, failed int
+	for _, u := range users {
+		switch action {
+		case ActionSilence:
+			err = app.db.SetUserStatus(u.ID, UserSilenced)
+		case ActionDelete:
+			err = app.db.DeleteAccount(u.ID)
+		}
+		if err != nil {
+			log.Error("Failed on user %s (%d): %v", u.Username, u.ID, err)
+			failed++
+			continue
+		}
+		done++
+	}
+
+	// Silenced users' posts may be cached in the timeline; refresh it once.
+	if action == ActionSilence && done > 0 && app.timeline != nil {
+		updateTimelineCache(app.timeline, true)
+	}
+
+	log.Info("Done. %d/%d succeeded, %d errors.", done, len(users), failed)
+	return nil
+}
+
 func connectToDatabase(app *App) {
 	log.Info("Connecting to %s database...", app.cfg.Database.Type)
 
 	var db *sql.DB
 	var err error
 	if app.cfg.Database.Type == driverMySQL {
 		db, err = sql.Open(app.cfg.Database.Type, fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=true&loc=%s&tls=%t", app.cfg.Database.User, app.cfg.Database.Password, app.cfg.Database.Host, app.cfg.Database.Port, app.cfg.Database.Database, url.QueryEscape(time.Local.String()), app.cfg.Database.TLS))
 		db.SetMaxOpenConns(50)
 	} else if app.cfg.Database.Type == driverSQLite {
 		if !SQLiteEnabled {
 			log.Error("Invalid database type '%s'. Binary wasn't compiled with SQLite3 support.", app.cfg.Database.Type)
 			os.Exit(1)
 		}
 		if app.cfg.Database.FileName == "" {
 			log.Error("SQLite database filename value in config.ini is empty.")
 			os.Exit(1)
 		}
 		db, err = sql.Open("sqlite3_with_regex", app.cfg.Database.FileName+"?parseTime=true&cached=shared")
 		db.SetMaxOpenConns(2)
 	} else {
 		log.Error("Invalid database type '%s'. Only 'mysql' and 'sqlite3' are supported right now.", app.cfg.Database.Type)
 		os.Exit(1)
 	}
 	if err != nil {
 		log.Error("%s", err)
 		os.Exit(1)
 	}
 	app.db = &datastore{DB: db, driverName: app.cfg.Database.Type}
 }
 
 func shutdown(app *App) {
 	log.Info("Closing database connection...")
 	app.db.Close()
 	if strings.HasPrefix(app.cfg.Server.Bind, "/") {
 		// Clean up socket
 		log.Info("Removing socket file...")
 		err := os.Remove(app.cfg.Server.Bind)
 		if err != nil {
 			if os.IsNotExist(err) {
 				// Safely ignore, in cases like initializing / migrating DB (see #790)
 				log.Info("No socket file; ignoring...")
 			} else {
 				log.Error("Unable to remove socket: %s", err)
 				os.Exit(1)
 			}
 		}
 		log.Info("Success.")
 	}
 }
 
 // CreateUser creates a new admin or normal user from the given credentials.
 func CreateUser(apper Apper, username, password string, isAdmin bool) error {
 	// Create an admin user with --create-admin
 	apper.LoadConfig()
 	connectToDatabase(apper.App())
 	defer shutdown(apper.App())
 
 	// Ensure an admin / first user doesn't already exist
 	firstUser, _ := apper.App().db.GetUserByID(1)
 	if isAdmin {
 		// Abort if trying to create admin user, but one already exists
 		if firstUser != nil {
 			return fmt.Errorf("Admin user already exists (%s). Create a regular user with: writefreely user create [USER]:[PASSWORD]", firstUser.Username)
 		}
 	} else {
 		// Abort if trying to create regular user, but no admin exists yet
 		if firstUser == nil {
 			return fmt.Errorf("No admin user exists yet. Create an admin first with: writefreely user create --admin [USER]:[PASSWORD]")
 		}
 	}
 
 	// Create the user
 	// Normalize and validate username
 	desiredUsername := username
 	username = getSlug(username, "")
 
 	usernameDesc := username
 	if username != desiredUsername {
 		usernameDesc += " (originally: " + desiredUsername + ")"
 	}
 
 	if !author.IsValidUsername(apper.App().cfg, username) {
 		return fmt.Errorf("Username %s is invalid, reserved, or shorter than configured minimum length (%d characters).", usernameDesc, apper.App().cfg.App.MinUsernameLen)
 	}
 
 	if len(password) > maxPassByteLen {
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Password is longer than %d characters", maxPassByteLen)}
 	}
 
 	// Hash the password
 	hashedPass, err := auth.HashPass([]byte(password))
 	if err != nil {
 		return fmt.Errorf("Unable to hash password: %v", err)
 	}
 
 	u := &User{
 		Username:   username,
 		HashedPass: hashedPass,
 		Created:    time.Now().Truncate(time.Second).UTC(),
 	}
 
 	userType := "user"
 	if isAdmin {
 		userType = "admin"
 	}
 	log.Info("Creating %s %s...", userType, usernameDesc)
 	err = apper.App().db.CreateUser(apper.App().Config(), u, desiredUsername, "")
 	if err != nil {
 		return fmt.Errorf("Unable to create user: %s", err)
 	}
 	log.Info("Done!")
 	return nil
 }
 
 //go:embed schema.sql
 var schemaSql string
 
 //go:embed sqlite.sql
 var sqliteSql string
 
 func adminInitDatabase(app *App) error {
 	var schema string
 	if app.cfg.Database.Type == driverSQLite {
 		schema = sqliteSql
 	} else {
 		schema = schemaSql
 	}
 
 	tblReg := regexp.MustCompile("CREATE TABLE (IF NOT EXISTS )?`([a-z_]+)`")
 
 	queries := strings.Split(string(schema), ";\n")
 	for _, q := range queries {
 		if strings.TrimSpace(q) == "" {
 			continue
 		}
 		parts := tblReg.FindStringSubmatch(q)
 		if len(parts) >= 3 {
 			log.Info("Creating table %s...", parts[2])
 		} else {
 			log.Info("Creating table ??? (Weird query) No match in: %v", parts)
 		}
 		_, err := app.db.Exec(q)
 		if err != nil {
 			log.Error("%s", err)
 		} else {
 			log.Info("Created.")
 		}
 	}
 
 	// Set up migrations table
 	log.Info("Initializing appmigrations table...")
 	err := migrations.SetInitialMigrations(migrations.NewDatastore(app.db.DB, app.db.driverName))
 	if err != nil {
 		return fmt.Errorf("Unable to set initial migrations: %v", err)
 	}
 
 	log.Info("Running migrations...")
 	err = migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
 	if err != nil {
 		return fmt.Errorf("migrate: %s", err)
 	}
 
 	log.Info("Done.")
 	return nil
 }
 
 // ServerUserAgent returns a User-Agent string to use in external requests. The
 // hostName parameter may be left empty.
 func ServerUserAgent(hostName string) string {
 	hostUAStr := ""
 	if hostName != "" {
 		hostUAStr = "; +" + hostName
 	}
 	return "Go (" + serverSoftware + "/" + softwareVer + hostUAStr + ")"
 }
diff --git a/cmd/writefreely/main.go b/cmd/writefreely/main.go
index cd7ed69..d445bd1 100644
--- a/cmd/writefreely/main.go
+++ b/cmd/writefreely/main.go
@@ -1,183 +1,184 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package main
 
 import (
 	"fmt"
 	"os"
 	"strings"
 
 	"github.com/gorilla/mux"
 	"github.com/urfave/cli/v2"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely"
 )
 
 func main() {
 	cli.VersionPrinter = func(c *cli.Context) {
 		fmt.Printf("%s\n", c.App.Version)
 	}
 	app := &cli.App{
 		Name:    "WriteFreely",
 		Usage:   "A beautifully pared-down blogging platform",
 		Version: writefreely.FormatVersion(),
 		Action:  legacyActions, // legacy due to use of flags for switching actions
 		Flags: []cli.Flag{
 			&cli.BoolFlag{
 				Name:   "create-config",
 				Value:  false,
 				Usage:  "Generate a basic configuration",
 				Hidden: true,
 			},
 			&cli.BoolFlag{
 				Name:   "config",
 				Value:  false,
 				Usage:  "Interactive configuration process",
 				Hidden: true,
 			},
 			&cli.StringFlag{
 				Name:  "sections",
 				Value: "server db app",
 				Usage: "Which sections of the configuration to go through (requires --config)\n" +
 					"valid values are any combination of 'server', 'db' and 'app' \n" +
 					"example: writefreely --config --sections \"db app\"",
 				Hidden: true,
 			},
 			&cli.BoolFlag{
 				Name:   "gen-keys",
 				Value:  false,
 				Usage:  "Generate encryption and authentication keys",
 				Hidden: true,
 			},
 			&cli.BoolFlag{
 				Name:   "init-db",
 				Value:  false,
 				Usage:  "Initialize app database",
 				Hidden: true,
 			},
 			&cli.BoolFlag{
 				Name:   "migrate",
 				Value:  false,
 				Usage:  "Migrate the database",
 				Hidden: true,
 			},
 			&cli.StringFlag{
 				Name:   "create-admin",
 				Usage:  "Create an admin with the given username:password",
 				Hidden: true,
 			},
 			&cli.StringFlag{
 				Name:   "create-user",
 				Usage:  "Create a regular user with the given username:password",
 				Hidden: true,
 			},
 			&cli.StringFlag{
 				Name:   "delete-user",
 				Usage:  "Delete a user with the given username",
 				Hidden: true,
 			},
 			&cli.StringFlag{
 				Name:   "reset-pass",
 				Usage:  "Reset the given user's password",
 				Hidden: true,
 			},
 		}, // legacy flags (set to hidden to eventually switch to bash-complete compatible format)
 	}
 
 	defaultFlags := []cli.Flag{
 		&cli.StringFlag{
 			Name:  "c",
 			Value: "config.ini",
 			Usage: "Load configuration from `FILE`",
 		},
 		&cli.BoolFlag{
 			Name:  "debug",
 			Value: false,
 			Usage: "Enables debug logging",
 		},
 	}
 
 	app.Flags = append(app.Flags, defaultFlags...)
 
 	app.Commands = []*cli.Command{
 		&cmdUser,
+		&cmdUsers,
 		&cmdDB,
 		&cmdConfig,
 		&cmdKeys,
 		&cmdServe,
 	}
 
 	err := app.Run(os.Args)
 	if err != nil {
 		log.Error(err.Error())
 		os.Exit(1)
 	}
 }
 
 func legacyActions(c *cli.Context) error {
 	app := writefreely.NewApp(c.String("c"))
 
 	switch true {
 	case c.IsSet("create-config"):
 		return writefreely.CreateConfig(app)
 	case c.IsSet("config"):
 		writefreely.DoConfig(app, c.String("sections"))
 		return nil
 	case c.IsSet("gen-keys"):
 		return writefreely.GenerateKeyFiles(app)
 	case c.IsSet("init-db"):
 		return writefreely.CreateSchema(app)
 	case c.IsSet("migrate"):
 		return writefreely.Migrate(app)
 	case c.IsSet("create-admin"):
 		username, password, err := parseCredentials(c.String("create-admin"))
 		if err != nil {
 			return err
 		}
 		return writefreely.CreateUser(app, username, password, true)
 	case c.IsSet("create-user"):
 		username, password, err := parseCredentials(c.String("create-user"))
 		if err != nil {
 			return err
 		}
 		return writefreely.CreateUser(app, username, password, false)
 	case c.IsSet("delete-user"):
 		return writefreely.DoDeleteAccount(app, c.String("delete-user"))
 	case c.IsSet("reset-pass"):
 		return writefreely.ResetPassword(app, c.String("reset-pass"))
 	}
 
 	// Initialize the application
 	var err error
 	log.Info("Starting %s...", writefreely.FormatVersion())
 	app, err = writefreely.Initialize(app, c.Bool("debug"))
 	if err != nil {
 		return err
 	}
 
 	// Set app routes
 	r := mux.NewRouter()
 	writefreely.InitRoutes(app, r)
 	app.InitStaticRoutes(r)
 
 	// Serve the application
 	writefreely.Serve(app, r)
 
 	return nil
 }
 
 func parseCredentials(credentialString string) (string, string, error) {
 	creds := strings.Split(credentialString, ":")
 	if len(creds) != 2 {
 		return "", "", fmt.Errorf("invalid format for passed credentials, must be username:password")
 	}
 	return creds[0], creds[1], nil
 }
diff --git a/cmd/writefreely/user.go b/cmd/writefreely/user.go
index 2efb4b9..6e4b5b2 100644
--- a/cmd/writefreely/user.go
+++ b/cmd/writefreely/user.go
@@ -1,96 +1,95 @@
 /*
  * Copyright © 2020-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package main
 
 import (
 	"fmt"
 
 	"github.com/urfave/cli/v2"
 	"github.com/writefreely/writefreely"
 )
 
 var (
 	cmdUser cli.Command = cli.Command{
 		Name:  "user",
 		Usage: "user management tools",
 		Subcommands: []*cli.Command{
 			&cmdAddUser,
 			&cmdDelUser,
 			&cmdResetPass,
-			// TODO: possibly add a user list command
 		},
 	}
 
 	cmdAddUser cli.Command = cli.Command{
 		Name:    "create",
 		Usage:   "Add new user",
 		Aliases: []string{"a", "add"},
 		Flags: []cli.Flag{
 			&cli.BoolFlag{
 				Name:  "admin",
 				Value: false,
 				Usage: "Create admin user",
 			},
 		},
 		Action: addUserAction,
 	}
 
 	cmdDelUser cli.Command = cli.Command{
 		Name:    "delete",
 		Usage:   "Delete user",
 		Aliases: []string{"del", "d"},
 		Action:  delUserAction,
 	}
 
 	cmdResetPass cli.Command = cli.Command{
 		Name:    "reset-pass",
 		Usage:   "Reset user's password",
 		Aliases: []string{"resetpass", "reset"},
 		Action:  resetPassAction,
 	}
 )
 
 func addUserAction(c *cli.Context) error {
 	credentials := ""
 	if c.NArg() > 0 {
 		credentials = c.Args().Get(0)
 	} else {
 		return fmt.Errorf("No user passed. Example: writefreely user add [USER]:[PASSWORD]")
 	}
 	username, password, err := parseCredentials(credentials)
 	if err != nil {
 		return err
 	}
 	app := writefreely.NewApp(c.String("c"))
 	return writefreely.CreateUser(app, username, password, c.Bool("admin"))
 }
 
 func delUserAction(c *cli.Context) error {
 	username := ""
 	if c.NArg() > 0 {
 		username = c.Args().Get(0)
 	} else {
 		return fmt.Errorf("No user passed. Example: writefreely user delete [USER]")
 	}
 	app := writefreely.NewApp(c.String("c"))
 	return writefreely.DoDeleteAccount(app, username)
 }
 
 func resetPassAction(c *cli.Context) error {
 	username := ""
 	if c.NArg() > 0 {
 		username = c.Args().Get(0)
 	} else {
 		return fmt.Errorf("No user passed. Example: writefreely user reset-pass [USER]")
 	}
 	app := writefreely.NewApp(c.String("c"))
 	return writefreely.ResetPassword(app, username)
 }
diff --git a/cmd/writefreely/users.go b/cmd/writefreely/users.go
new file mode 100644
index 0000000..61836bc
--- /dev/null
+++ b/cmd/writefreely/users.go
@@ -0,0 +1,130 @@
+/*
+ * Copyright © 2026 Musing Studio LLC.
+ *
+ * This file is part of WriteFreely.
+ *
+ * WriteFreely is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, included
+ * in the LICENSE file in this source code package.
+ */
+
+package main
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/urfave/cli/v2"
+	"github.com/writefreely/writefreely"
+)
+
+var (
+	cmdUsers cli.Command = cli.Command{
+		Name:  "users",
+		Usage: "mass user moderation tools",
+		Subcommands: []*cli.Command{
+			&cmdListUsers,
+			&cmdSilenceUsers,
+			&cmdDeleteUsers,
+		},
+	}
+
+	cmdListUsers cli.Command = cli.Command{
+		Name:    "list",
+		Usage:   "List users matching filters",
+		Aliases: []string{"ls"},
+		Flags:   userFilterFlags(),
+		Action:  listUsersAction,
+	}
+
+	cmdSilenceUsers cli.Command = cli.Command{
+		Name:   "silence",
+		Usage:  "Silence all users matching filters, with confirmation",
+		Flags:  userFilterFlags(),
+		Action: silenceUsersAction,
+	}
+
+	cmdDeleteUsers cli.Command = cli.Command{
+		Name:   "delete",
+		Usage:  "Delete all users matching filters and their content, with confirmation",
+		Flags:  userFilterFlags(),
+		Action: deleteUsersAction,
+	}
+)
+
+// userFilterFlags returns the shared filter flags used by the `users`
+// subcommands (list/silence/delete). A fresh slice is returned per call so the
+// same flag definition is the single source of truth without sharing flag
+// state across sibling commands.
+func userFilterFlags() []cli.Flag {
+	return []cli.Flag{
+		&cli.StringFlag{
+			Name:  "since",
+			Usage: "Only users created on/after this date (YYYY-MM-DD)",
+		},
+		&cli.StringFlag{
+			Name:  "until",
+			Usage: "Only users created before this date (YYYY-MM-DD)",
+		},
+		&cli.BoolFlag{
+			Name:  "no-invite",
+			Usage: "Only users who signed up without an invite code",
+		},
+		&cli.BoolFlag{
+			Name:  "no-oauth",
+			Usage: "Only users who did not register via an OAuth provider",
+		},
+		&cli.IntFlag{
+			Name:  "max-posts",
+			Value: -1,
+			Usage: "Only users with at most N posts (-1 = no limit)",
+		},
+	}
+}
+
+// userFilterFromContext builds a UserFilter from the shared filter flags,
+// returning a clear error on malformed dates.
+func userFilterFromContext(c *cli.Context) (writefreely.UserFilter, error) {
+	const dateFmt = "2006-01-02"
+	filter := writefreely.UserFilter{
+		NoInvite: c.Bool("no-invite"),
+		NoOAuth:  c.Bool("no-oauth"),
+		MaxPosts: c.Int("max-posts"),
+	}
+	if s := c.String("since"); s != "" {
+		t, err := time.Parse(dateFmt, s)
+		if err != nil {
+			return filter, fmt.Errorf("invalid --since date %q, expected YYYY-MM-DD", s)
+		}
+		filter.Since = &t
+	}
+	if s := c.String("until"); s != "" {
+		t, err := time.Parse(dateFmt, s)
+		if err != nil {
+			return filter, fmt.Errorf("invalid --until date %q, expected YYYY-MM-DD", s)
+		}
+		filter.Until = &t
+	}
+	return filter, nil
+}
+
+func moderateUsersAction(c *cli.Context, action writefreely.UserAction) error {
+	filter, err := userFilterFromContext(c)
+	if err != nil {
+		return err
+	}
+	app := writefreely.NewApp(c.String("c"))
+	return writefreely.ModerateUsers(app, filter, action)
+}
+
+func listUsersAction(c *cli.Context) error {
+	return moderateUsersAction(c, writefreely.ActionList)
+}
+
+func silenceUsersAction(c *cli.Context) error {
+	return moderateUsersAction(c, writefreely.ActionSilence)
+}
+
+func deleteUsersAction(c *cli.Context) error {
+	return moderateUsersAction(c, writefreely.ActionDelete)
+}
diff --git a/collections.go b/collections.go
index dc4c26d..0b4178e 100644
--- a/collections.go
+++ b/collections.go
@@ -1,1466 +1,1480 @@
 /*
  * Copyright © 2018-2022 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"math"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strconv"
 	"strings"
 	"unicode"
 
 	"github.com/gorilla/mux"
 	stripmd "github.com/writeas/go-strip-markdown/v2"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/bots"
 	"github.com/writeas/web-core/i18n"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/posts"
 	"github.com/writefreely/writefreely/author"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/page"
 	"github.com/writefreely/writefreely/spam"
 	"golang.org/x/net/idna"
 )
 
 const (
 	collAttrLetterReplyTo = "letter_reply_to"
 
 	collMaxLengthTitle       = 255
 	collMaxLengthDescription = 160
 )
 
 type (
 	// TODO: add Direction to db
 	// TODO: add Language to db
 	Collection struct {
 		ID          int64          `datastore:"id" json:"-"`
 		Alias       string         `datastore:"alias" schema:"alias" json:"alias"`
 		Title       string         `datastore:"title" schema:"title" json:"title"`
 		Description string         `datastore:"description" schema:"description" json:"description"`
 		Direction   string         `schema:"dir" json:"dir,omitempty"`
 		Language    string         `schema:"lang" json:"lang,omitempty"`
 		StyleSheet  string         `datastore:"style_sheet" schema:"style_sheet" json:"style_sheet"`
 		Script      string         `datastore:"script" schema:"script" json:"script,omitempty"`
 		Signature   string         `datastore:"post_signature" schema:"signature" json:"-"`
 		Public      bool           `datastore:"public" json:"public"`
 		Visibility  collVisibility `datastore:"private" json:"-"`
 		Format      string         `datastore:"format" json:"format,omitempty"`
 		Views       int64          `json:"views"`
 		OwnerID     int64          `datastore:"owner_id" json:"-"`
 		PublicOwner bool           `datastore:"public_owner" json:"-"`
 		URL         string         `json:"url,omitempty"`
 
 		Monetization string `json:"monetization_pointer,omitempty"`
 		Verification string `json:"verification_link"`
 
 		db       *datastore
 		hostName string
 	}
 	CollectionObj struct {
 		Collection
 		TotalPosts int           `json:"total_posts"`
 		Owner      *User         `json:"owner,omitempty"`
 		Posts      *[]PublicPost `json:"posts,omitempty"`
 		Format     *CollectionFormat
 	}
 	DisplayCollection struct {
 		*CollectionObj
 		Prefix      string
 		NavSuffix   string
 		IsTopLevel  bool
 		CurrentPage int
 		TotalPages  int
 		Silenced    bool
 	}
 
 	CollectionNav struct {
 		*Collection
 		Path       string
 		SingleUser bool
 		CanPost    bool
 	}
 
 	SubmittedCollection struct {
 		// Data used for updating a given collection
 		ID      int64
 		OwnerID uint64
 
 		// Form helpers
 		PreferURL string `schema:"prefer_url" json:"prefer_url"`
 		Privacy   int    `schema:"privacy" json:"privacy"`
 		Pass      string `schema:"password" json:"password"`
 		MathJax   bool   `schema:"mathjax" json:"mathjax"`
 		EmailSubs bool   `schema:"email_subs" json:"email_subs"`
 		Handle    string `schema:"handle" json:"handle"`
 
 		// Actual collection values updated in the DB
 		Alias        *string         `schema:"alias" json:"alias"`
 		Title        *string         `schema:"title" json:"title"`
 		Description  *string         `schema:"description" json:"description"`
 		StyleSheet   *string         `schema:"style_sheet" json:"style_sheet"`
 		Script       *string         `schema:"script" json:"script"`
 		Signature    *string         `schema:"signature" json:"signature"`
 		Monetization *string         `schema:"monetization_pointer" json:"monetization_pointer"`
 		Verification *string         `schema:"verification_link" json:"verification_link"`
 		LetterReply  *string         `schema:"letter_reply" json:"letter_reply"`
 		Visibility   *int            `schema:"visibility" json:"public"`
 		Format       *sql.NullString `schema:"format" json:"format"`
 	}
 	CollectionFormat struct {
 		Format string
 	}
 
 	collectionReq struct {
 		// Information about the collection request itself
 		prefix, alias, domain string
 		isCustomDomain        bool
 
 		// User-related fields
 		isCollOwner bool
 
 		isAuthorized bool
 	}
 )
 
 func (sc *SubmittedCollection) FediverseHandle() string {
 	if sc.Handle == "" {
 		return apCustomHandleDefault
 	}
 	return getSlug(sc.Handle, "")
 }
 
 // collVisibility represents the visibility level for the collection.
 type collVisibility int
 
 // Visibility levels. Values are bitmasks, stored in the database as
 // decimal numbers. If adding types, append them to this list. If removing,
 // replace the desired visibility with a new value.
 const CollUnlisted collVisibility = 0
 const (
 	CollPublic collVisibility = 1 << iota
 	CollPrivate
 	CollProtected
 )
 
 var collVisibilityStrings = map[string]collVisibility{
 	"unlisted":  CollUnlisted,
 	"public":    CollPublic,
 	"private":   CollPrivate,
 	"protected": CollProtected,
 }
 
 func defaultVisibility(cfg *config.Config) collVisibility {
 	vis, ok := collVisibilityStrings[cfg.App.DefaultVisibility]
 	if !ok {
 		vis = CollUnlisted
 	}
 	return vis
 }
 
 func (cf *CollectionFormat) Ascending() bool {
 	return cf.Format == "novel"
 }
 func (cf *CollectionFormat) ShowDates() bool {
 	return cf.Format == "blog"
 }
 func (cf *CollectionFormat) PostsPerPage() int {
 	if cf.Format == "novel" {
 		return postsPerPage
 	}
 	return postsPerPage
 }
 
 // Valid returns whether or not a format value is valid.
 func (cf *CollectionFormat) Valid() bool {
 	return cf.Format == "blog" ||
 		cf.Format == "novel" ||
 		cf.Format == "notebook"
 }
 
 // NewFormat creates a new CollectionFormat object from the Collection.
 func (c *Collection) NewFormat() *CollectionFormat {
 	cf := &CollectionFormat{Format: c.Format}
 
 	// Fill in default format
 	if cf.Format == "" {
 		cf.Format = "blog"
 	}
 
 	return cf
 }
 
 func (c *Collection) IsInstanceColl() bool {
 	ur, _ := url.Parse(c.hostName)
 	return c.Alias == ur.Host
 }
 
 func (c *Collection) IsUnlisted() bool {
 	return c.Visibility == 0
 }
 
 func (c *Collection) IsPrivate() bool {
 	return c.Visibility&CollPrivate != 0
 }
 
 func (c *Collection) IsProtected() bool {
 	return c.Visibility&CollProtected != 0
 }
 
 func (c *Collection) IsPublic() bool {
 	return c.Visibility&CollPublic != 0
 }
 
 func (c *Collection) FriendlyVisibility() string {
 	if c.IsPrivate() {
 		return "Private"
 	}
 	if c.IsPublic() {
 		return "Public"
 	}
 	if c.IsProtected() {
 		return "Password-protected"
 	}
 	return "Unlisted"
 }
 
 func (c *Collection) ShowFooterBranding() bool {
 	// TODO: implement this setting
 	return true
 }
 
 // CanonicalURL returns a fully-qualified URL to the collection.
 func (c *Collection) CanonicalURL() string {
 	return c.RedirectingCanonicalURL(false)
 }
 
 func (c *Collection) DisplayCanonicalURL() string {
 	us := c.CanonicalURL()
 	u, err := url.Parse(us)
 	if err != nil {
 		return us
 	}
 	p := u.Path
 	if p == "/" {
 		p = ""
 	}
 	d := u.Hostname()
 	d, _ = idna.ToUnicode(d)
 	return d + p
 }
 
 // RedirectingCanonicalURL returns the fully-qualified canonical URL for the Collection, with a trailing slash. The
 // hostName field needs to be populated for this to work correctly.
 func (c *Collection) RedirectingCanonicalURL(isRedir bool) string {
 	if c.hostName == "" {
 		// If this is true, the human programmers screwed up. So ask for a bug report and fail, fail, fail
 		log.Error("[PROGRAMMER ERROR] WARNING: Collection.hostName is empty! Federation and many other things will fail! If you're seeing this in the wild, please report this bug and let us know what you were doing just before this: https://github.com/writefreely/writefreely/issues/new?template=bug_report.md")
 	}
 	if isSingleUser {
 		return c.hostName + "/"
 	}
 
 	return fmt.Sprintf("%s/%s/", c.hostName, c.Alias)
 }
 
 // PrevPageURL provides a full URL for the previous page of collection posts,
 // returning a /page/N result for pages >1
 func (c *Collection) PrevPageURL(prefix, navSuffix string, n int, tl bool) string {
 	u := ""
 	if n == 2 {
 		// Previous page is 1; no need for /page/ prefix
 		if prefix == "" {
 			u = navSuffix + "/"
 		}
 		// Else leave off trailing slash
 	} else {
 		u = fmt.Sprintf("%s/page/%d", navSuffix, n-1)
 	}
 
 	if tl {
 		return u
 	}
 	return "/" + prefix + c.Alias + u
 }
 
 // NextPageURL provides a full URL for the next page of collection posts
 func (c *Collection) NextPageURL(prefix, navSuffix string, n int, tl bool) string {
 
 	if tl {
 		return fmt.Sprintf("%s/page/%d", navSuffix, n+1)
 	}
 	return fmt.Sprintf("/%s%s%s/page/%d", prefix, c.Alias, navSuffix, n+1)
 }
 
 func (c *Collection) DisplayTitle() string {
 	if c.Title != "" {
 		return c.Title
 	}
 	return c.Alias
 }
 
 func (c *Collection) StyleSheetDisplay() template.CSS {
 	return template.CSS(c.StyleSheet)
 }
 
 // ForPublic modifies the Collection for public consumption, such as via
 // the API.
 func (c *Collection) ForPublic() {
 	c.URL = c.CanonicalURL()
 }
 
 var isAvatarChar = regexp.MustCompile("[a-z0-9]").MatchString
 
 func (c *Collection) PersonObject(ids ...int64) *activitystreams.Person {
 	accountRoot := c.FederatedAccount()
 	p := activitystreams.NewPerson(accountRoot)
 	p.URL = c.CanonicalURL()
 	uname := c.Alias
 	p.PreferredUsername = uname
 	p.Name = c.DisplayTitle()
 	p.Summary = c.Description
 	if p.Name != "" {
 		if av := c.AvatarURL(); av != "" {
 			p.Icon = activitystreams.Image{
 				Type:      "Image",
 				MediaType: "image/png",
 				URL:       av,
 			}
 		}
 	}
 
 	if c.Monetization != "" {
 		p.AddWebMonetization(c.Monetization)
 	}
 
 	collID := c.ID
 	if len(ids) > 0 {
 		collID = ids[0]
 	}
 	pub, priv := c.db.GetAPActorKeys(collID)
 	if pub != nil {
 		p.AddPubKey(pub)
 		p.SetPrivKey(priv)
 	}
 
 	return p
 }
 
 func (c *Collection) AvatarURL() string {
 	fl := string(unicode.ToLower([]rune(c.DisplayTitle())[0]))
 	if !isAvatarChar(fl) {
 		return ""
 	}
 	return c.hostName + "/img/avatars/" + fl + ".png"
 }
 
 func (c *Collection) FederatedAPIBase() string {
 	return c.hostName + "/"
 }
 
 func (c *Collection) FederatedAccount() string {
 	accountUser := c.Alias
 	return c.FederatedAPIBase() + "api/collections/" + accountUser
 }
 
 func (c *Collection) RenderMathJax() bool {
 	return c.db.CollectionHasAttribute(c.ID, "render_mathjax")
 }
 
 func (c *Collection) EmailSubsEnabled() bool {
 	return c.db.CollectionHasAttribute(c.ID, "email_subs")
 }
 
 func (c *Collection) MonetizationURL() string {
 	if c.Monetization == "" {
 		return ""
 	}
 	return strings.Replace(c.Monetization, "$", "https://", 1)
 }
 
 // DisplayDescription returns the description with rendered Markdown and HTML.
 func (c *Collection) DisplayDescription() *template.HTML {
 	if c.Description == "" {
 		s := template.HTML("")
 		return &s
 	}
 	t := template.HTML(posts.ApplyBasicAccessibleMarkdown([]byte(c.Description)))
 	return &t
 }
 
 // PlainDescription returns the description with all Markdown and HTML removed.
 func (c *Collection) PlainDescription() string {
 	if c.Description == "" {
 		return ""
 	}
 	desc := stripHTMLWithoutEscaping(c.Description)
 	desc = stripmd.Strip(desc)
 	return desc
 }
 
 func (c CollectionPage) DisplayMonetization() string {
 	return displayMonetization(c.Monetization, c.Alias)
 }
 
+// UserPage provides the fields expected by the shared "user-navigation"
+// template, which otherwise assumes it's rendering for a page that embeds
+// *UserPage (e.g. the "me" backend pages).
+func (c CollectionPage) UserPage() *UserPage {
+	return &UserPage{
+		StaticPage: c.StaticPage,
+		IsAdmin:    c.IsAdmin,
+		CanInvite:  c.CanInvite,
+		CollAlias:  c.CollAlias,
+	}
+}
+
 func (c *DisplayCollection) Direction() string {
 	if c.Language == "" {
 		return "auto"
 	}
 	if i18n.LangIsRTL(c.Language) {
 		return "rtl"
 	}
 	return "ltr"
 }
 
 func newCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	alias := r.FormValue("alias")
 	title := r.FormValue("title")
 
 	var missingParams, accessToken string
 	var u *User
 	c := struct {
 		Alias string `json:"alias" schema:"alias"`
 		Title string `json:"title" schema:"title"`
 		Web   bool   `json:"web" schema:"web"`
 	}{}
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&c)
 		if err != nil {
 			log.Error("Couldn't parse post update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		// TODO: move form parsing to formDecoder
 		c.Alias = alias
 		c.Title = title
 	}
 
 	if c.Alias == "" {
 		if c.Title != "" {
 			// If only a title was given, just use it to generate the alias.
 			c.Alias = getSlug(c.Title, "")
 		} else {
 			missingParams += "`alias` "
 		}
 	}
 	if c.Title == "" {
 		missingParams += "`title` "
 	}
 	if missingParams != "" {
 		return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Parameter(s) %srequired.", missingParams)}
 	}
 
 	var userID int64
 	var err error
 	if reqJSON && !c.Web {
 		accessToken = r.Header.Get("Authorization")
 		if accessToken == "" {
 			return ErrNoAccessToken
 		}
 		userID = app.db.GetUserID(accessToken)
 		if userID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		userID = u.ID
 	}
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("new collection: %v", err)
 		return ErrInternalGeneral
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	if !author.IsValidUsername(app.cfg, c.Alias) {
 		return impart.HTTPError{http.StatusPreconditionFailed, "Collection alias isn't valid."}
 	}
 
 	coll, err := app.db.CreateCollection(app.cfg, c.Alias, c.Title, userID)
 	if err != nil {
 		// TODO: handle this
 		return err
 	}
 
 	res := &CollectionObj{Collection: *coll}
 
 	if reqJSON {
 		return impart.WriteSuccess(w, res, http.StatusCreated)
 	}
 	redirectTo := "/me/c/"
 	// TODO: redirect to pad when necessary
 	return impart.HTTPError{http.StatusFound, redirectTo}
 }
 
 func apiCheckCollectionPermissions(app *App, r *http.Request, c *Collection) (int64, error) {
 	accessToken := r.Header.Get("Authorization")
 	var userID int64 = -1
 	if accessToken != "" {
 		userID = app.db.GetUserID(accessToken)
 	}
 	isCollOwner := userID == c.OwnerID
 	if c.IsPrivate() && !isCollOwner {
 		// Collection is private, but user isn't authenticated
 		return -1, ErrCollectionNotFound
 	}
 	if c.IsProtected() {
 		// TODO: check access token
 		return -1, ErrCollectionUnauthorizedRead
 	}
 
 	return userID, nil
 }
 
 // fetchCollection handles the API endpoint for retrieving collection data.
 func fetchCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	if IsActivityPubRequest(r) {
 		return handleFetchCollectionActivities(app, w, r)
 	}
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
 	// TODO: move this logic into a common getCollection function
 	// Get base Collection data
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Redirect users who aren't requesting JSON
 	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return impart.HTTPError{http.StatusFound, c.CanonicalURL()}
 	}
 
 	// Check permissions
 	userID, err := apiCheckCollectionPermissions(app, r, c)
 	if err != nil {
 		return err
 	}
 	isCollOwner := userID == c.OwnerID
 
 	// Fetch extra data about the Collection
 	res := &CollectionObj{Collection: *c}
 	if c.PublicOwner {
 		u, err := app.db.GetUserByID(res.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		} else {
 			res.Owner = u
 		}
 	}
 	// TODO: check status for silenced
 	app.db.GetPostsCount(res, isCollOwner)
 	// Strip non-public information
 	res.Collection.ForPublic()
 
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 // fetchCollectionPosts handles an API endpoint for retrieving a collection's
 // posts.
 func fetchCollectionPosts(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Check permissions
 	userID, err := apiCheckCollectionPermissions(app, r, c)
 	if err != nil {
 		return err
 	}
 	isCollOwner := userID == c.OwnerID
 
 	// Get page
 	page := 1
 	if p := r.FormValue("page"); p != "" {
 		pInt, _ := strconv.Atoi(p)
 		if pInt > 0 {
 			page = pInt
 		}
 	}
 
 	ps, err := app.db.GetPosts(app.cfg, c, page, isCollOwner, false, false, "")
 	if err != nil {
 		return err
 	}
 	coll := &CollectionObj{Collection: *c, Posts: ps}
 	app.db.GetPostsCount(coll, isCollOwner)
 	// Strip non-public information
 	coll.Collection.ForPublic()
 
 	// Transform post bodies if needed
 	if r.FormValue("body") == "html" {
 		for _, p := range *coll.Posts {
 			p.Content = posts.ApplyMarkdown([]byte(p.Content))
 		}
 	}
 
 	return impart.WriteSuccess(w, coll, http.StatusOK)
 }
 
 type CollectionPage struct {
 	page.StaticPage
 	*DisplayCollection
 	IsCustomDomain  bool
 	IsWelcome       bool
 	IsOwner         bool
 	IsCollLoggedIn  bool
 	Honeypot        string
 	IsSubscriber    bool
 	CanPin          bool
 	Username        string
 	Monetization    string
 	FediverseAuthor string
 	Flash           template.HTML
 	Collections     *[]Collection
 	PinnedPosts     *[]PublicPost
 
 	IsAdmin   bool
 	CanInvite bool
 
 	// Helper field for Chorus mode
 	CollAlias string
 }
 
 type TagCollectionPage struct {
 	CollectionPage
 	Tag string
 }
 
 func (tcp TagCollectionPage) PrevPageURL(prefix string, n int, tl bool) string {
 	u := fmt.Sprintf("/tag:%s", tcp.Tag)
 	if n > 2 {
 		u += fmt.Sprintf("/page/%d", n-1)
 	}
 	if tl {
 		return u
 	}
 	return "/" + prefix + tcp.Alias + u
 
 }
 
 func (tcp TagCollectionPage) NextPageURL(prefix string, n int, tl bool) string {
 	if tl {
 		return fmt.Sprintf("/tag:%s/page/%d", tcp.Tag, n+1)
 	}
 	return fmt.Sprintf("/%s%s/tag:%s/page/%d", prefix, tcp.Alias, tcp.Tag, n+1)
 }
 
 func NewCollectionObj(c *Collection) *CollectionObj {
 	return &CollectionObj{
 		Collection: *c,
 		Format:     c.NewFormat(),
 	}
 }
 
 func (c *CollectionObj) ScriptDisplay() template.JS {
 	return template.JS(c.Script)
 }
 
 var jsSourceCommentReg = regexp.MustCompile("(?m)^// src:(.+)$")
 
 func (c *CollectionObj) ExternalScripts() []template.URL {
 	scripts := []template.URL{}
 	if c.Script == "" {
 		return scripts
 	}
 
 	matches := jsSourceCommentReg.FindAllStringSubmatch(c.Script, -1)
 	for _, m := range matches {
 		scripts = append(scripts, template.URL(strings.TrimSpace(m[1])))
 	}
 	return scripts
 }
 
 func (c *CollectionObj) CanShowScript() bool {
 	return false
 }
 
 func processCollectionRequest(cr *collectionReq, vars map[string]string, w http.ResponseWriter, r *http.Request) error {
 	cr.prefix = vars["prefix"]
 	cr.alias = vars["collection"]
 	// Normalize the URL, redirecting user to consistent post URL
 	if cr.alias != strings.ToLower(cr.alias) {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", strings.ToLower(cr.alias))}
 	}
 
 	return nil
 }
 
 // processCollectionPermissions checks the permissions for the given
 // collectionReq, returning a Collection if access is granted; otherwise this
 // renders any necessary collection pages, for example, if requesting a custom
 // domain that doesn't yet have a collection associated, or if a collection
 // requires a password. In either case, this will return nil, nil -- thus both
 // values should ALWAYS be checked to determine whether or not to continue.
 func processCollectionPermissions(app *App, cr *collectionReq, u *User, w http.ResponseWriter, r *http.Request) (*Collection, error) {
 	// Display collection if this is a collection
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(cr.alias)
 	}
 	// TODO: verify we don't reveal the existence of a private collection with redirection
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if err.Status == http.StatusNotFound {
 				if cr.isCustomDomain {
 					// User is on the site from a custom domain
 					//tErr := pages["404-domain.tmpl"].ExecuteTemplate(w, "base", pageForHost(page.StaticPage{}, r))
 					//if tErr != nil {
 					//log.Error("Unable to render 404-domain page: %v", err)
 					//}
 					return nil, nil
 				}
 				if len(cr.alias) >= minIDLen && len(cr.alias) <= maxIDLen {
 					// Alias is within post ID range, so just be sure this isn't a post
 					if app.db.PostIDExists(cr.alias) {
 						// TODO: use StatusFound for vanity post URLs when we implement them
 						return nil, impart.HTTPError{http.StatusMovedPermanently, "/" + cr.alias}
 					}
 				}
 				// Redirect if necessary
 				newAlias := app.db.GetCollectionRedirect(cr.alias)
 				if newAlias != "" {
 					return nil, impart.HTTPError{http.StatusFound, "/" + newAlias + "/"}
 				}
 			}
 		}
 		return nil, err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Update CollectionRequest to reflect owner status
 	cr.isCollOwner = u != nil && u.ID == c.OwnerID
 
 	// Check permissions
 	if !cr.isCollOwner {
 		if c.IsPrivate() {
 			return nil, ErrCollectionNotFound
 		} else if c.IsProtected() {
 			uname := ""
 			if u != nil {
 				uname = u.Username
 			}
 
 			// TODO: move this to all permission checks?
 			suspended, err := app.db.IsUserSilenced(c.OwnerID)
 			if err != nil {
 				log.Error("process protected collection permissions: %v", err)
 				return nil, err
 			}
 			if suspended {
 				return nil, ErrCollectionNotFound
 			}
 
 			// See if we've authorized this collection
 			cr.isAuthorized = isAuthorizedForCollection(app, c.Alias, r)
 
 			if !cr.isAuthorized {
 				p := struct {
 					page.StaticPage
 					*CollectionObj
 					Username string
 					Next     string
 					Flashes  []template.HTML
 				}{
 					StaticPage:    pageForReq(app, r),
 					CollectionObj: &CollectionObj{Collection: *c},
 					Username:      uname,
 					Next:          r.FormValue("g"),
 					Flashes:       []template.HTML{},
 				}
 				// Get owner information
 				p.CollectionObj.Owner, err = app.db.GetUserByID(c.OwnerID)
 				if err != nil {
 					// Log the error and just continue
 					log.Error("Error getting user for collection: %v", err)
 				}
 
 				flashes, _ := getSessionFlashes(app, w, r, nil)
 				for _, flash := range flashes {
 					p.Flashes = append(p.Flashes, template.HTML(flash))
 				}
 				err = templates["password-collection"].ExecuteTemplate(w, "password-collection", p)
 				if err != nil {
 					log.Error("Unable to render password-collection: %v", err)
 					return nil, err
 				}
 				return nil, nil
 			}
 		}
 	}
 	return c, nil
 }
 
 func checkUserForCollection(app *App, cr *collectionReq, r *http.Request, isPostReq bool) (*User, error) {
 	u := getUserSession(app, r)
 	return u, nil
 }
 
 func newDisplayCollection(c *Collection, cr *collectionReq, page int) (*DisplayCollection, error) {
 	coll := &DisplayCollection{
 		CollectionObj: NewCollectionObj(c),
 		CurrentPage:   page,
 		Prefix:        cr.prefix,
 		IsTopLevel:    isSingleUser,
 	}
 	err := c.db.GetPostsCount(coll.CollectionObj, cr.isCollOwner)
 	if err != nil {
 		return nil, err
 	}
 	return coll, nil
 }
 
 // getCollectionPage returns the collection page as an int. If the parsed page value is not
 // greater than 0 then the default value of 1 is returned.
 func getCollectionPage(vars map[string]string) int {
 	if p, _ := strconv.Atoi(vars["page"]); p > 0 {
 		return p
 	}
 
 	return 1
 }
 
 // handleViewCollection displays the requested Collection
 func handleViewCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	cr := &collectionReq{}
 
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("view collection: %v", err)
 		return ErrInternalGeneral
 	}
 
 	// Serve ActivityStreams data now, if requested
 	if IsActivityPubRequest(r) {
 		ac := c.PersonObject()
 		setCacheControl(w, apCacheTime)
 		return impart.RenderActivityJSON(w, ac, http.StatusOK)
 	}
 
 	// Fetch extra data about the Collection
 	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
 	coll, err := newDisplayCollection(c, cr, page)
 	if err != nil {
 		return err
 	}
 
 	var ct PostType
 	if isArchiveView(r) {
 		ct = postArch
 	}
 
 	// FIXME: this number will be off when user has pinned posts but isn't a Pro user
 	ppp := coll.Format.PostsPerPage()
 	if ct == postArch {
 		ppp = postsPerArchPage
 	}
 
 	coll.TotalPages = int(math.Ceil(float64(coll.TotalPosts) / float64(ppp)))
 	if coll.TotalPages > 0 && page > coll.TotalPages {
 		redirURL := fmt.Sprintf("/page/%d", coll.TotalPages)
 		if !app.cfg.App.SingleUser {
 			redirURL = fmt.Sprintf("/%s%s%s", cr.prefix, coll.Alias, redirURL)
 		}
 		return impart.HTTPError{http.StatusFound, redirURL}
 	}
 
 	coll.Posts, _ = app.db.GetPosts(app.cfg, c, page, cr.isCollOwner, false, false, "")
 
 	// Serve collection
 	displayPage := CollectionPage{
 		DisplayCollection: coll,
 		IsCollLoggedIn:    cr.isAuthorized,
 		StaticPage:        pageForReq(app, r),
 		IsCustomDomain:    cr.isCustomDomain,
 		IsWelcome:         r.FormValue("greeting") != "",
 		Honeypot:          spam.HoneypotFieldName(),
 		CollAlias:         c.Alias,
 	}
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	for _, f := range flashes {
 		displayPage.Flash = template.HTML(f)
 	}
 	displayPage.IsAdmin = u != nil && u.IsAdmin()
 	displayPage.CanInvite = canUserInvite(app.cfg, displayPage.IsAdmin)
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		displayPage.IsSubscriber = u.IsEmailSubscriber(app, coll.ID)
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner, app.cfg.App.Host)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	isOwner := owner != nil
 	if !isOwner {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 	}
 	if !isOwner && silenced {
 		return ErrCollectionNotFound
 	}
 	displayPage.Silenced = isOwner && silenced
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj, isOwner)
 	displayPage.Monetization = app.db.GetCollectionAttribute(coll.ID, "monetization_pointer")
 
 	collTmpl := "collection"
 	if app.cfg.App.Chorus {
 		collTmpl = "chorus-collection"
 	} else if isArchiveView(r) {
 		displayPage.NavSuffix = "/archive/"
 		collTmpl = "collection-archive"
 	}
 	err = templates[collTmpl].ExecuteTemplate(w, "collection", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection index: %v", err)
 	}
 
 	// Update collection view count
 	go func() {
 		// Don't update if owner is viewing the collection.
 		if u != nil && u.ID == coll.OwnerID {
 			return
 		}
 		// Only update for human views
 		if r.Method == "HEAD" || bots.IsBot(r.UserAgent()) {
 			return
 		}
 
 		_, err := app.db.Exec("UPDATE collections SET view_count = view_count + 1 WHERE id = ?", coll.ID)
 		if err != nil {
 			log.Error("Unable to update collections count: %v", err)
 		}
 	}()
 
 	return err
 }
 
 func isArchiveView(r *http.Request) bool {
 	return strings.HasSuffix(r.RequestURI, "/archive/") || mux.Vars(r)["archive"] == "archive"
 }
 
 func handleViewMention(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	handle := vars["handle"]
 
 	remoteUser, err := app.db.GetProfilePageFromHandle(app, handle)
 	if err != nil || remoteUser == "" {
 		log.Error("Couldn't find user %s: %v", handle, err)
 		return ErrRemoteUserNotFound
 	}
 
 	return impart.HTTPError{Status: http.StatusFound, Message: remoteUser}
 }
 
 func handleViewCollectionTag(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	tag := vars["tag"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 
 	coll, _ := newDisplayCollection(c, cr, page)
 
 	taggedPostIDs, err := app.db.GetAllPostsTaggedIDs(c, tag, cr.isCollOwner)
 	if err != nil {
 		return err
 	}
 
 	ttlPosts := len(taggedPostIDs)
 	pagePosts := coll.Format.PostsPerPage()
 	coll.TotalPages = int(math.Ceil(float64(ttlPosts) / float64(pagePosts)))
 	if coll.TotalPages > 0 && page > coll.TotalPages {
 		redirURL := fmt.Sprintf("/page/%d", coll.TotalPages)
 		if !app.cfg.App.SingleUser {
 			redirURL = fmt.Sprintf("/%s%s%s", cr.prefix, coll.Alias, redirURL)
 		}
 		return impart.HTTPError{http.StatusFound, redirURL}
 	}
 
 	coll.Posts, _ = app.db.GetPostsTagged(app.cfg, c, tag, page, cr.isCollOwner)
 	if coll.Posts != nil && len(*coll.Posts) == 0 {
 		return ErrCollectionPageNotFound
 	}
 
 	// Serve collection
 	displayPage := TagCollectionPage{
 		CollectionPage: CollectionPage{
 			DisplayCollection: coll,
 			StaticPage:        pageForReq(app, r),
 			IsCustomDomain:    cr.isCustomDomain,
 		},
 		Tag: tag,
 	}
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner, app.cfg.App.Host)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	isOwner := owner != nil
 	if !isOwner {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 		if owner.IsSilenced() {
 			return ErrCollectionNotFound
 		}
 	}
 	displayPage.Silenced = owner != nil && owner.IsSilenced()
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj, isOwner)
 	displayPage.Monetization = app.db.GetCollectionAttribute(coll.ID, "monetization_pointer")
 
 	err = templates["collection-tags"].ExecuteTemplate(w, "collection-tags", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection tag page: %v", err)
 	}
 
 	return nil
 }
 
 func handleViewCollectionLang(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	lang := vars["lang"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 
 	coll, _ := newDisplayCollection(c, cr, page)
 	coll.Language = lang
 	coll.NavSuffix = fmt.Sprintf("/lang:%s", lang)
 
 	ttlPosts, err := app.db.GetCollLangTotalPosts(coll.ID, lang)
 	if err != nil {
 		log.Error("Unable to getCollLangTotalPosts: %s", err)
 	}
 	pagePosts := coll.Format.PostsPerPage()
 	coll.TotalPages = int(math.Ceil(float64(ttlPosts) / float64(pagePosts)))
 	if coll.TotalPages > 0 && page > coll.TotalPages {
 		redirURL := fmt.Sprintf("/lang:%s/page/%d", lang, coll.TotalPages)
 		if !app.cfg.App.SingleUser {
 			redirURL = fmt.Sprintf("/%s%s%s", cr.prefix, coll.Alias, redirURL)
 		}
 		return impart.HTTPError{http.StatusFound, redirURL}
 	}
 
 	coll.Posts, _ = app.db.GetLangPosts(app.cfg, c, lang, page, cr.isCollOwner)
 	if err != nil {
 		return ErrCollectionPageNotFound
 	}
 
 	// Serve collection
 	displayPage := struct {
 		CollectionPage
 		Tag string
 	}{
 		CollectionPage: CollectionPage{
 			DisplayCollection: coll,
 			StaticPage:        pageForReq(app, r),
 			IsCustomDomain:    cr.isCustomDomain,
 		},
 		Tag: lang,
 	}
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner, app.cfg.App.Host)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	isOwner := owner != nil
 	if !isOwner {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 		if owner.IsSilenced() {
 			return ErrCollectionNotFound
 		}
 	}
 	displayPage.Silenced = owner != nil && owner.IsSilenced()
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj, isOwner)
 	displayPage.Monetization = app.db.GetCollectionAttribute(coll.ID, "monetization_pointer")
 
 	collTmpl := "collection"
 	if app.cfg.App.Chorus {
 		collTmpl = "chorus-collection"
 	}
 	err = templates[collTmpl].ExecuteTemplate(w, "collection", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection lang page: %v", err)
 	}
 
 	return nil
 }
 
 func handleCollectionPostRedirect(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	loc := fmt.Sprintf("/%s", slug)
 	if !app.cfg.App.SingleUser {
 		loc = fmt.Sprintf("/%s/%s", cr.alias, slug)
 	}
 	return impart.HTTPError{http.StatusFound, loc}
 }
 
 func existingCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 	isWeb := r.FormValue("web") == "1"
 
 	u := &User{}
 	if reqJSON && !isWeb {
 		// Ensure an access token was given
 		accessToken := r.Header.Get("Authorization")
 		u.ID = app.db.GetUserID(accessToken)
 		if u.ID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		log.Error("existing collection: %v", err)
 		return ErrInternalGeneral
 	}
 
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	if r.Method == "DELETE" {
 		err := app.db.DeleteCollection(collAlias, u.ID)
 		if err != nil {
 			// TODO: if not HTTPError, report error to admin
 			log.Error("Unable to delete collection: %s", err)
 			return err
 		}
 		addSessionFlash(app, w, r, "Deleted your blog, "+collAlias+".", nil)
 		return impart.HTTPError{Status: http.StatusNoContent}
 	}
 
 	c := SubmittedCollection{OwnerID: uint64(u.ID)}
 
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&c)
 		if err != nil {
 			log.Error("Couldn't parse collection update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse collection update form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&c, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode collection update form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	err = app.db.UpdateCollection(app, &c, collAlias)
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if reqJSON {
 				return err
 			}
 			addSessionFlash(app, w, r, err.Message, nil)
 			return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
 		} else {
 			log.Error("Couldn't update collection: %v\n", err)
 			return err
 		}
 	}
 
 	if reqJSON {
 		return impart.WriteSuccess(w, struct {
 		}{}, http.StatusOK)
 	}
 
 	addSessionFlash(app, w, r, "Blog updated!", nil)
 	return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
 }
 
 // collectionAliasFromReq takes a request and returns the collection alias
 // if it can be ascertained, as well as whether or not the collection uses a
 // custom domain.
 func collectionAliasFromReq(r *http.Request) string {
 	vars := mux.Vars(r)
 	alias := vars["subdomain"]
 	isSubdomain := alias != ""
 	if !isSubdomain {
 		// Fall back to write.as/{collection} since this isn't a custom domain
 		alias = vars["collection"]
 	}
 	return alias
 }
 
 func handleWebCollectionUnlock(app *App, w http.ResponseWriter, r *http.Request) error {
 	var readReq struct {
 		Alias string `schema:"alias" json:"alias"`
 		Pass  string `schema:"password" json:"password"`
 		Next  string `schema:"to" json:"to"`
 	}
 
 	// Get params
 	if impart.ReqJSON(r) {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&readReq)
 		if err != nil {
 			log.Error("Couldn't parse readReq JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse readReq form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&readReq, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode readReq form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	if readReq.Alias == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Need a collection `alias` to read."}
 	}
 	if readReq.Pass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Please supply a password."}
 	}
 
 	var collHashedPass []byte
 	err := app.db.QueryRow("SELECT password FROM collectionpasswords INNER JOIN collections ON id = collection_id WHERE alias = ?", readReq.Alias).Scan(&collHashedPass)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			log.Error("No collectionpassword found when trying to read collection %s", readReq.Alias)
 			return impart.HTTPError{http.StatusInternalServerError, "Something went very wrong. The humans have been alerted."}
 		}
 		return err
 	}
 
 	if !auth.Authenticated(collHashedPass, []byte(readReq.Pass)) {
 		return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 	}
 
 	// Success; set cookie
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
-	if err == nil {
-		session.Values[readReq.Alias] = true
-		err = session.Save(r, w)
-		if err != nil {
-			log.Error("Didn't save unlocked blog '%s': %v", readReq.Alias, err)
-		}
+	if err != nil {
+		// The cookie should still save, even if there's an error.
+		log.Error("Getting blog password cookie for '%s': %v; ignoring", readReq.Alias, err)
+	}
+	session.Values[readReq.Alias] = true
+	err = session.Save(r, w)
+	if err != nil {
+		log.Error("Didn't save unlocked blog '%s': %v", readReq.Alias, err)
 	}
 
 	next := "/" + readReq.Next
 	if !app.cfg.App.SingleUser {
 		next = "/" + readReq.Alias + next
 	}
 	return impart.HTTPError{http.StatusFound, next}
 }
 
 func isAuthorizedForCollection(app *App, alias string, r *http.Request) bool {
 	authd := false
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
 	if err == nil {
 		_, authd = session.Values[alias]
 	}
 	return authd
 }
 
 func logOutCollection(app *App, alias string, w http.ResponseWriter, r *http.Request) error {
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
 	if err != nil {
 		return err
 	}
 
 	// Remove this from map of blogs logged into
 	delete(session.Values, alias)
 
 	// If not auth'd with any blog, delete entire cookie
 	if len(session.Values) == 0 {
 		session.Options.MaxAge = -1
 	}
 	return session.Save(r, w)
 }
 
 func handleLogOutCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	alias := collectionAliasFromReq(r)
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		return err
 	}
 	if !c.IsProtected() {
 		// Invalid to log out of this collection
 		return ErrCollectionPageNotFound
 	}
 
 	err = logOutCollection(app, c.Alias, w, r)
 	if err != nil {
 		addSessionFlash(app, w, r, "Logging out failed. Try clearing cookies for this site, instead.", nil)
 	}
 	return impart.HTTPError{http.StatusFound, c.CanonicalURL()}
 }
diff --git a/config/config.go b/config/config.go
index 67200b6..c85cb72 100644
--- a/config/config.go
+++ b/config/config.go
@@ -1,320 +1,321 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 // Package config holds and assists in the configuration of a writefreely instance.
 package config
 
 import (
 	"net/url"
 	"os"
 	"strings"
 
 	"github.com/go-ini/ini"
 	"github.com/writeas/web-core/log"
 	"golang.org/x/net/idna"
 )
 
 const (
 	// FileName is the default configuration file name
 	FileName = "config.ini"
 
 	UserNormal UserType = "user"
 	UserAdmin           = "admin"
 )
 
 type (
 	UserType string
 
 	// ServerCfg holds values that affect how the HTTP server runs
 	ServerCfg struct {
 		HiddenHost string `ini:"hidden_host"`
 		Port       int    `ini:"port"`
 		Bind       string `ini:"bind"`
 
 		TLSCertPath string `ini:"tls_cert_path"`
 		TLSKeyPath  string `ini:"tls_key_path"`
 		Autocert    bool   `ini:"autocert"`
 
 		TemplatesParentDir string `ini:"templates_parent_dir"`
 		StaticParentDir    string `ini:"static_parent_dir"`
 		PagesParentDir     string `ini:"pages_parent_dir"`
 		KeysParentDir      string `ini:"keys_parent_dir"`
 
 		HashSeed string `ini:"hash_seed"`
 
 		GopherPort int `ini:"gopher_port"`
 
 		Dev bool `ini:"-"`
 	}
 
 	// DatabaseCfg holds values that determine how the application connects to a datastore
 	DatabaseCfg struct {
 		Type     string `ini:"type"`
 		FileName string `ini:"filename"`
 		User     string `ini:"username"`
 		Password string `ini:"password"`
 		Database string `ini:"database"`
 		Host     string `ini:"host"`
 		Port     int    `ini:"port"`
 		TLS      bool   `ini:"tls"`
 	}
 
 	WriteAsOauthCfg struct {
 		ClientID         string `ini:"client_id"`
 		ClientSecret     string `ini:"client_secret"`
 		AuthLocation     string `ini:"auth_location"`
 		TokenLocation    string `ini:"token_location"`
 		InspectLocation  string `ini:"inspect_location"`
 		CallbackProxy    string `ini:"callback_proxy"`
 		CallbackProxyAPI string `ini:"callback_proxy_api"`
 	}
 
 	GitlabOauthCfg struct {
 		ClientID         string `ini:"client_id"`
 		ClientSecret     string `ini:"client_secret"`
 		Host             string `ini:"host"`
 		DisplayName      string `ini:"display_name"`
 		CallbackProxy    string `ini:"callback_proxy"`
 		CallbackProxyAPI string `ini:"callback_proxy_api"`
 	}
 
 	GiteaOauthCfg struct {
 		ClientID         string `ini:"client_id"`
 		ClientSecret     string `ini:"client_secret"`
 		Host             string `ini:"host"`
 		DisplayName      string `ini:"display_name"`
 		CallbackProxy    string `ini:"callback_proxy"`
 		CallbackProxyAPI string `ini:"callback_proxy_api"`
 	}
 
 	SlackOauthCfg struct {
 		ClientID         string `ini:"client_id"`
 		ClientSecret     string `ini:"client_secret"`
 		TeamID           string `ini:"team_id"`
 		CallbackProxy    string `ini:"callback_proxy"`
 		CallbackProxyAPI string `ini:"callback_proxy_api"`
 	}
 
 	GenericOauthCfg struct {
-		ClientID         string `ini:"client_id"`
-		ClientSecret     string `ini:"client_secret"`
-		Host             string `ini:"host"`
-		DisplayName      string `ini:"display_name"`
-		CallbackProxy    string `ini:"callback_proxy"`
-		CallbackProxyAPI string `ini:"callback_proxy_api"`
-		TokenEndpoint    string `ini:"token_endpoint"`
-		InspectEndpoint  string `ini:"inspect_endpoint"`
-		AuthEndpoint     string `ini:"auth_endpoint"`
-		Scope            string `ini:"scope"`
-		AllowDisconnect  bool   `ini:"allow_disconnect"`
-		MapUserID        string `ini:"map_user_id"`
-		MapUsername      string `ini:"map_username"`
-		MapDisplayName   string `ini:"map_display_name"`
-		MapEmail         string `ini:"map_email"`
+		ClientID           string `ini:"client_id"`
+		ClientSecret       string `ini:"client_secret"`
+		Host               string `ini:"host"`
+		DisplayName        string `ini:"display_name"`
+		CallbackProxy      string `ini:"callback_proxy"`
+		CallbackProxyAPI   string `ini:"callback_proxy_api"`
+		TokenEndpoint      string `ini:"token_endpoint"`
+		InspectEndpoint    string `ini:"inspect_endpoint"`
+		AuthEndpoint       string `ini:"auth_endpoint"`
+		AuthUseRequestBody bool   `ini:"auth_use_basic_auth"`
+		Scope              string `ini:"scope"`
+		AllowDisconnect    bool   `ini:"allow_disconnect"`
+		MapUserID          string `ini:"map_user_id"`
+		MapUsername        string `ini:"map_username"`
+		MapDisplayName     string `ini:"map_display_name"`
+		MapEmail           string `ini:"map_email"`
 	}
 
 	// AppCfg holds values that affect how the application functions
 	AppCfg struct {
 		SiteName string `ini:"site_name"`
 		SiteDesc string `ini:"site_description"`
 		Host     string `ini:"host"`
 
 		// Site appearance
 		Theme      string `ini:"theme"`
 		Editor     string `ini:"editor"`
 		JSDisabled bool   `ini:"disable_js"`
 		WebFonts   bool   `ini:"webfonts"`
 		Landing    string `ini:"landing"`
 		SimpleNav  bool   `ini:"simple_nav"`
 		WFModesty  bool   `ini:"wf_modesty"`
 
 		// Site functionality
 		Chorus        bool `ini:"chorus"`
 		Forest        bool `ini:"forest"` // The admin cares about the forest, not the trees. Hide unnecessary technical info.
 		DisableDrafts bool `ini:"disable_drafts"`
 
 		// Users
 		SingleUser       bool `ini:"single_user"`
 		OpenRegistration bool `ini:"open_registration"`
 		OpenDeletion     bool `ini:"open_deletion"`
 		MinUsernameLen   int  `ini:"min_username_len"`
 		MaxBlogs         int  `ini:"max_blogs"`
 
 		// Options for public instances
 		// Federation
 		Federation   bool `ini:"federation"`
 		PublicStats  bool `ini:"public_stats"`
 		Monetization bool `ini:"monetization"`
 		NotesOnly    bool `ini:"notes_only"`
 
 		// Access
 		Private bool `ini:"private"`
 
 		// Additional functions
 		LocalTimeline bool   `ini:"local_timeline"`
 		UserInvites   string `ini:"user_invites"`
 
 		// Defaults
 		DefaultVisibility string `ini:"default_visibility"`
 
 		// Check for Updates
 		UpdateChecks bool `ini:"update_checks"`
 
 		// Disable password authentication if use only Oauth
 		DisablePasswordAuth bool `ini:"disable_password_auth"`
 	}
 
 	EmailCfg struct {
 		// SMTP configuration values
 		Host           string `ini:"smtp_host"`
 		Port           int    `ini:"smtp_port"`
 		Username       string `ini:"smtp_username"`
 		Password       string `ini:"smtp_password"`
 		EnableStartTLS bool   `ini:"smtp_enable_start_tls"`
 
 		// Mailgun configuration values
 		Domain         string `ini:"domain"`
 		MailgunPrivate string `ini:"mailgun_private"`
 		MailgunEurope  bool   `ini:"mailgun_europe"`
 	}
 
 	// Config holds the complete configuration for running a writefreely instance
 	Config struct {
 		Server       ServerCfg       `ini:"server"`
 		Database     DatabaseCfg     `ini:"database"`
 		App          AppCfg          `ini:"app"`
 		Email        EmailCfg        `ini:"email"`
 		SlackOauth   SlackOauthCfg   `ini:"oauth.slack"`
 		WriteAsOauth WriteAsOauthCfg `ini:"oauth.writeas"`
 		GitlabOauth  GitlabOauthCfg  `ini:"oauth.gitlab"`
 		GiteaOauth   GiteaOauthCfg   `ini:"oauth.gitea"`
 		GenericOauth GenericOauthCfg `ini:"oauth.generic"`
 	}
 )
 
 // New creates a new Config with sane defaults
 func New() *Config {
 	c := &Config{
 		Server: ServerCfg{
 			Port: 8080,
 			Bind: "localhost", /* IPV6 support when not using localhost? */
 		},
 		App: AppCfg{
 			Host:           "http://localhost:8080",
 			Theme:          "write",
 			WebFonts:       true,
 			SingleUser:     true,
 			MinUsernameLen: 3,
 			MaxBlogs:       1,
 			Federation:     true,
 			PublicStats:    true,
 		},
 	}
 	c.UseMySQL(true)
 	return c
 }
 
 // UseMySQL resets the Config's Database to use default values for a MySQL setup.
 func (cfg *Config) UseMySQL(fresh bool) {
 	cfg.Database.Type = "mysql"
 	if fresh {
 		cfg.Database.Host = "localhost"
 		cfg.Database.Port = 3306
 	}
 }
 
 // UseSQLite resets the Config's Database to use default values for a SQLite setup.
 func (cfg *Config) UseSQLite(fresh bool) {
 	cfg.Database.Type = "sqlite3"
 	if fresh {
 		cfg.Database.FileName = "writefreely.db"
 	}
 }
 
 // IsSecureStandalone returns whether or not the application is running as a
 // standalone server with TLS enabled.
 func (cfg *Config) IsSecureStandalone() bool {
 	return cfg.Server.Port == 443 && cfg.Server.TLSCertPath != "" && cfg.Server.TLSKeyPath != ""
 }
 
 func (ac *AppCfg) LandingPath() string {
 	if !strings.HasPrefix(ac.Landing, "/") {
 		return "/" + ac.Landing
 	}
 	return ac.Landing
 }
 
 func (lc EmailCfg) Enabled() bool {
 	return (lc.Domain != "" && lc.MailgunPrivate != "") ||
 		lc.Username != "" && lc.Password != "" && lc.Host != "" && lc.Port > 0
 }
 
 func (ac AppCfg) SignupPath() string {
 	if !ac.OpenRegistration {
 		return ""
 	}
 	if ac.Chorus || ac.Private || (ac.Landing != "" && ac.Landing != "/") {
 		return "/signup"
 	}
 	return "/"
 }
 
 // Load reads the given configuration file, then parses and returns it as a Config.
 func Load(fname string) (*Config, error) {
 	if fname == "" {
 		fname = FileName
 	}
 	cfg, err := ini.Load(fname)
 	if err != nil {
 		return nil, err
 	}
 
 	// Parse INI file
 	uc := &Config{}
 	err = cfg.MapTo(uc)
 	if err != nil {
 		return nil, err
 	}
 
 	// Do any transformations
 	u, err := url.Parse(uc.App.Host)
 	if err != nil {
 		return nil, err
 	}
 	d, err := idna.ToASCII(u.Hostname())
 	if err != nil {
 		log.Error("idna.ToASCII for %s: %s", u.Hostname(), err)
 		return nil, err
 	}
 	uc.App.Host = u.Scheme + "://" + d
 	if u.Port() != "" {
 		uc.App.Host += ":" + u.Port()
 	}
 
 	return uc, nil
 }
 
 // Save writes the given Config to the given file.
 func Save(uc *Config, fname string) error {
 	cfg := ini.Empty()
 	err := ini.ReflectFrom(cfg, uc)
 	if err != nil {
 		return err
 	}
 
 	if fname == "" {
 		fname = FileName
 	}
 	err = cfg.SaveTo(fname)
 	if err != nil {
 		return err
 	}
 	return os.Chmod(fname, 0600)
 }
diff --git a/config/setup.go b/config/setup.go
index 4beef13..1e4c422 100644
--- a/config/setup.go
+++ b/config/setup.go
@@ -1,396 +1,407 @@
 /*
  * Copyright © 2018 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package config
 
 import (
 	"fmt"
 	"os"
 	"strconv"
 	"strings"
 
 	"github.com/fatih/color"
 	"github.com/manifoldco/promptui"
 	"github.com/mitchellh/go-wordwrap"
 	"github.com/writeas/web-core/auth"
 )
 
 type SetupData struct {
 	User   *UserCreation
 	Config *Config
 }
 
 func Configure(fname string, configSections string) (*SetupData, error) {
 	data := &SetupData{}
 	var err error
 	if fname == "" {
 		fname = FileName
 	}
 
 	data.Config, err = Load(fname)
 	var action string
 	isNewCfg := false
 	if err != nil {
 		fmt.Printf("No %s configuration yet. Creating new.\n", fname)
 		data.Config = New()
 		action = "generate"
 		isNewCfg = true
 	} else {
 		fmt.Printf("Loaded configuration %s.\n", fname)
 		action = "update"
 	}
 	title := color.New(color.Bold, color.BgGreen).PrintFunc()
 
 	intro := color.New(color.Bold, color.FgWhite).PrintlnFunc()
 	fmt.Println()
 	intro("  ✍ WriteFreely Configuration ✍")
 	fmt.Println()
 	fmt.Println(wordwrap.WrapString("  This quick configuration process will "+action+" the application's config file, "+fname+".\n\n  It validates your input along the way, so you can be sure any future errors aren't caused by a bad configuration. If you'd rather configure your server manually, instead run: writefreely --create-config and edit that file.", 75))
 	fmt.Println()
 
 	tmpls := &promptui.PromptTemplates{
 		Success: "{{ . | bold | faint }}: ",
 	}
 	selTmpls := &promptui.SelectTemplates{
 		Selected: `{{.Label}} {{ . | faint }}`,
 	}
 
 	var selPrompt promptui.Select
 	var prompt promptui.Prompt
 
 	if strings.Contains(configSections, "server") {
 		title(" Server setup ")
 		fmt.Println()
 
 		// Environment selection
 		selPrompt = promptui.Select{
 			Templates: selTmpls,
 			Label:     "Environment",
 			Items:     []string{"Development", "Production, standalone", "Production, behind reverse proxy"},
 		}
 		_, envType, err := selPrompt.Run()
 		if err != nil {
 			return data, err
 		}
 		isDevEnv := envType == "Development"
 		isStandalone := envType == "Production, standalone"
 
 		_, isDocker := os.LookupEnv("WRITEFREELY_DOCKER")
 
 		data.Config.Server.Dev = isDevEnv
 
 		if isDevEnv || !isStandalone {
 			// Running in dev environment or behind reverse proxy; ask for port
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Local port",
 				Validate:  validatePort,
 				Default:   fmt.Sprintf("%d", data.Config.Server.Port),
 			}
 			port, err := prompt.Run()
 			if err != nil {
 				return data, err
 			}
 			data.Config.Server.Port, _ = strconv.Atoi(port) // Ignore error, as we've already validated number
 		}
 
 		if isStandalone {
 			selPrompt = promptui.Select{
 				Templates: selTmpls,
 				Label:     "Web server mode",
 				Items:     []string{"Insecure (port 80)", "Secure (port 443), manual certificate", "Secure (port 443), auto certificate"},
 			}
 			sel, _, err := selPrompt.Run()
 			if err != nil {
 				return data, err
 			}
 			if sel == 0 {
 				data.Config.Server.Autocert = false
 				data.Config.Server.Port = 80
 				data.Config.Server.TLSCertPath = ""
 				data.Config.Server.TLSKeyPath = ""
 			} else if sel == 1 || sel == 2 {
 				data.Config.Server.Port = 443
 				data.Config.Server.Autocert = sel == 2
 
 				if sel == 1 {
 					// Manual certificate configuration
 					prompt = promptui.Prompt{
 						Templates: tmpls,
 						Label:     "Certificate path",
 						Validate:  validateNonEmpty,
 						Default:   data.Config.Server.TLSCertPath,
 					}
 					data.Config.Server.TLSCertPath, err = prompt.Run()
 					if err != nil {
 						return data, err
 					}
 
 					prompt = promptui.Prompt{
 						Templates: tmpls,
 						Label:     "Key path",
 						Validate:  validateNonEmpty,
 						Default:   data.Config.Server.TLSKeyPath,
 					}
 					data.Config.Server.TLSKeyPath, err = prompt.Run()
 					if err != nil {
 						return data, err
 					}
 				} else {
 					// Automatic certificate
 					data.Config.Server.TLSCertPath = "certs"
 					data.Config.Server.TLSKeyPath = "certs"
 				}
 			}
 		} else {
 			data.Config.Server.TLSCertPath = ""
 			data.Config.Server.TLSKeyPath = ""
 		}
 
 		// If running in docker:
 		// 1. always bind to 0.0.0.0 instead of localhost
 		// 2. set paths of static files in UNIX manners
 		if !isDevEnv && isDocker {
 			data.Config.Server.TemplatesParentDir = "/usr/share/writefreely"
 			data.Config.Server.StaticParentDir = "/usr/share/writefreely"
 			data.Config.Server.PagesParentDir = "/usr/share/writefreely"
 			data.Config.Server.Bind = "0.0.0.0"
 		}
 
 		fmt.Println()
 	}
 
 	if strings.Contains(configSections, "db") {
 		title(" Database setup ")
 		fmt.Println()
 
 		selPrompt = promptui.Select{
 			Templates: selTmpls,
 			Label:     "Database driver",
 			Items:     []string{"MySQL", "SQLite"},
 		}
 		sel, _, err := selPrompt.Run()
 		if err != nil {
 			return data, err
 		}
 
 		if sel == 0 {
 			// Configure for MySQL
 			data.Config.UseMySQL(isNewCfg)
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Username",
 				Validate:  validateNonEmpty,
 				Default:   data.Config.Database.User,
 			}
 			data.Config.Database.User, err = prompt.Run()
 			if err != nil {
 				return data, err
 			}
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Password",
 				Validate:  validateNonEmpty,
 				Default:   data.Config.Database.Password,
 				Mask:      '*',
 			}
 			data.Config.Database.Password, err = prompt.Run()
 			if err != nil {
 				return data, err
 			}
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Database name",
 				Validate:  validateNonEmpty,
 				Default:   data.Config.Database.Database,
 			}
 			data.Config.Database.Database, err = prompt.Run()
 			if err != nil {
 				return data, err
 			}
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Host",
 				Validate:  validateNonEmpty,
 				Default:   data.Config.Database.Host,
 			}
 			data.Config.Database.Host, err = prompt.Run()
 			if err != nil {
 				return data, err
 			}
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Port",
 				Validate:  validatePort,
 				Default:   fmt.Sprintf("%d", data.Config.Database.Port),
 			}
 			dbPort, err := prompt.Run()
 			if err != nil {
 				return data, err
 			}
 			data.Config.Database.Port, _ = strconv.Atoi(dbPort) // Ignore error, as we've already validated number
 		} else if sel == 1 {
 			// Configure for SQLite
 			data.Config.UseSQLite(isNewCfg)
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Filename",
 				Validate:  validateNonEmpty,
 				Default:   data.Config.Database.FileName,
 			}
 			data.Config.Database.FileName, err = prompt.Run()
 			if err != nil {
 				return data, err
 			}
 		}
 
 		fmt.Println()
 	}
 
 	if strings.Contains(configSections, "app") {
 		title(" App setup ")
 		fmt.Println()
 
 		selPrompt = promptui.Select{
 			Templates: selTmpls,
 			Label:     "Site type",
 			Items:     []string{"Single user blog", "Multi-user instance"},
 		}
 		_, usersType, err := selPrompt.Run()
 		if err != nil {
 			return data, err
 		}
 		data.Config.App.SingleUser = usersType == "Single user blog"
 
 		if data.Config.App.SingleUser {
 			data.User = &UserCreation{}
 
 			//   prompt for username
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Admin username",
 				Validate:  validateNonEmpty,
 			}
 			data.User.Username, err = prompt.Run()
 			if err != nil {
 				return data, err
 			}
 
 			//   prompt for password
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Admin password",
 				Validate:  validateNonEmpty,
 			}
 			newUserPass, err := prompt.Run()
 			if err != nil {
 				return data, err
 			}
 
 			data.User.HashedPass, err = auth.HashPass([]byte(newUserPass))
 			if err != nil {
 				return data, err
 			}
 		}
 
 		siteNameLabel := "Instance name"
 		if data.Config.App.SingleUser {
 			siteNameLabel = "Blog name"
 		}
 		prompt = promptui.Prompt{
 			Templates: tmpls,
 			Label:     siteNameLabel,
 			Validate:  validateNonEmpty,
 			Default:   data.Config.App.SiteName,
 		}
 		data.Config.App.SiteName, err = prompt.Run()
 		if err != nil {
 			return data, err
 		}
 
 		prompt = promptui.Prompt{
 			Templates: tmpls,
 			Label:     "Public URL",
 			Validate:  validateDomain,
 			Default:   data.Config.App.Host,
 		}
 		data.Config.App.Host, err = prompt.Run()
 		if err != nil {
 			return data, err
 		}
 
 		if !data.Config.App.SingleUser {
 			selPrompt = promptui.Select{
 				Templates: selTmpls,
 				Label:     "Registration",
 				Items:     []string{"Open", "Closed"},
 			}
 			_, regType, err := selPrompt.Run()
 			if err != nil {
 				return data, err
 			}
 			data.Config.App.OpenRegistration = regType == "Open"
 
 			prompt = promptui.Prompt{
 				Templates: tmpls,
 				Label:     "Max blogs per user",
 				Default:   fmt.Sprintf("%d", data.Config.App.MaxBlogs),
 			}
 			maxBlogs, err := prompt.Run()
 			if err != nil {
 				return data, err
 			}
 			data.Config.App.MaxBlogs, _ = strconv.Atoi(maxBlogs) // Ignore error, as we've already validated number
 		}
 
 		selPrompt = promptui.Select{
 			Templates: selTmpls,
 			Label:     "Federation",
 			Items:     []string{"Enabled", "Disabled"},
 		}
 		_, fedType, err := selPrompt.Run()
 		if err != nil {
 			return data, err
 		}
 		data.Config.App.Federation = fedType == "Enabled"
 
 		if data.Config.App.Federation {
 			selPrompt = promptui.Select{
 				Templates: selTmpls,
 				Label:     "Usage stats (active users, posts)",
 				Items:     []string{"Public", "Private"},
 			}
 			_, fedStatsType, err := selPrompt.Run()
 			if err != nil {
 				return data, err
 			}
 			data.Config.App.PublicStats = fedStatsType == "Public"
 
 			selPrompt = promptui.Select{
 				Templates: selTmpls,
 				Label:     "Instance metadata privacy",
 				Items:     []string{"Public", "Private"},
 			}
 			_, fedStatsType, err = selPrompt.Run()
 			if err != nil {
 				return data, err
 			}
 			data.Config.App.Private = fedStatsType == "Private"
 		}
+
+		selPrompt = promptui.Select{
+			Templates: selTmpls,
+			Label:     "Automatically check for updates",
+			Items:     []string{"Yes", "No"},
+		}
+		_, updateCheckType, err := selPrompt.Run()
+		if err != nil {
+			return data, err
+		}
+		data.Config.App.UpdateChecks = updateCheckType == "Yes"
 	}
 
 	return data, Save(data.Config, fname)
 }
diff --git a/database.go b/database.go
index b7e8d1a..9f8cb5e 100644
--- a/database.go
+++ b/database.go
@@ -1,3374 +1,3458 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"context"
 	"database/sql"
 	"fmt"
 	"net/http"
 	"net/url"
 	"strings"
 	"time"
 
 	"github.com/writeas/monday"
 
 	"github.com/go-sql-driver/mysql"
 	"github.com/writeas/web-core/silobridge"
 	wf_db "github.com/writefreely/writefreely/db"
 	"github.com/writefreely/writefreely/parse"
 
 	"github.com/guregu/null"
 	"github.com/guregu/null/zero"
 	uuid "github.com/nu7hatch/gouuid"
 	"github.com/writeas/activityserve"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/activitypub"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/id"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/query"
 	"github.com/writefreely/writefreely/author"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/key"
 )
 
 const (
 	mySQLErrDuplicateKey = 1062
 	mySQLErrCollationMix = 1267
 	mySQLErrTooManyConns = 1040
 	mySQLErrMaxUserConns = 1203
 
 	driverMySQL  = "mysql"
 	driverSQLite = "sqlite3"
 )
 
 var (
 	SQLiteEnabled bool
 )
 
 type writestore interface {
 	CreateUser(*config.Config, *User, string, string) error
 	UpdateUserEmail(keys *key.Keychain, userID int64, email string) error
 	UpdateEncryptedUserEmail(int64, []byte) error
 	GetUserByID(int64) (*User, error)
 	GetUserForAuth(string) (*User, error)
 	GetUserForAuthByID(int64) (*User, error)
 	GetUserNameFromToken(string) (string, error)
 	GetUserDataFromToken(string) (int64, string, error)
 	GetAPIUser(header string) (*User, error)
 	GetUserID(accessToken string) int64
 	GetUserIDPrivilege(accessToken string) (userID int64, sudo bool)
 	DeleteToken(accessToken []byte) error
 	FetchLastAccessToken(userID int64) string
 	GetAccessToken(userID int64) (string, error)
 	GetTemporaryAccessToken(userID int64, validSecs int) (string, error)
 	GetTemporaryOneTimeAccessToken(userID int64, validSecs int, oneTime bool) (string, error)
 	DeleteAccount(userID int64) error
 	ChangeSettings(app *App, u *User, s *userSettings) error
 	ChangePassphrase(userID int64, sudo bool, curPass string, hashedPass []byte) error
 
 	GetCollections(u *User, hostName string) (*[]Collection, error)
 	GetPublishableCollections(u *User, hostName string) (*[]Collection, error)
 	GetMeStats(u *User) userMeStats
 	GetTotalCollections() (int64, error)
 	GetTotalPosts() (int64, error)
 	GetTopPosts(u *User, alias string, hostName string) (*[]PublicPost, error)
 	GetAnonymousPosts(u *User, page int) (*[]PublicPost, error)
 	GetUserPosts(u *User) (*[]PublicPost, error)
 
 	CreateOwnedPost(post *SubmittedPost, accessToken, collAlias, hostName string) (*PublicPost, error)
 	CreatePost(userID, collID int64, post *SubmittedPost) (*Post, error)
 	UpdateOwnedPost(post *AuthenticatedPost, userID int64) error
 	GetEditablePost(id, editToken string) (*PublicPost, error)
 	PostIDExists(id string) bool
 	GetPost(id string, collectionID int64) (*PublicPost, error)
 	GetOwnedPost(id string, ownerID int64) (*PublicPost, error)
 	GetPostProperty(id string, collectionID int64, property string) (interface{}, error)
 
 	CreateCollectionFromToken(*config.Config, string, string, string) (*Collection, error)
 	CreateCollection(*config.Config, string, string, int64) (*Collection, error)
 	GetCollectionBy(condition string, value interface{}) (*Collection, error)
 	GetCollection(alias string) (*Collection, error)
 	GetCollectionForPad(alias string) (*Collection, error)
 	GetCollectionByID(id int64) (*Collection, error)
 	UpdateCollection(app *App, c *SubmittedCollection, alias string) error
 	DeleteCollection(alias string, userID int64) error
 
 	UpdatePostPinState(pinned bool, postID string, collID, ownerID, pos int64) error
 	GetLastPinnedPostPos(collID int64) int64
 	GetPinnedPosts(coll *CollectionObj, includeFuture bool) (*[]PublicPost, error)
 	RemoveCollectionRedirect(t *sql.Tx, alias string) error
 	GetCollectionRedirect(alias string) (new string)
 	IsCollectionAttributeOn(id int64, attr string) bool
 	CollectionHasAttribute(id int64, attr string) bool
 
 	CanCollect(cpr *ClaimPostRequest, userID int64) bool
 	AttemptClaim(p *ClaimPostRequest, query string, params []interface{}, slugIdx int) (sql.Result, error)
 	DispersePosts(userID int64, postIDs []string) (*[]ClaimPostResult, error)
 	ClaimPosts(cfg *config.Config, userID int64, collAlias string, posts *[]ClaimPostRequest) (*[]ClaimPostResult, error)
 
 	GetPostLikeCounts(postID string) (int64, error)
 	GetPostsCount(c *CollectionObj, includeFuture bool) error
 	GetPosts(cfg *config.Config, c *Collection, page int, includeFuture, forceRecentFirst, includePinned bool, contentType PostType) (*[]PublicPost, error)
 	GetAllPostsTaggedIDs(c *Collection, tag string, includeFuture bool) ([]string, error)
 	GetPostsTagged(cfg *config.Config, c *Collection, tag string, page int, includeFuture bool) (*[]PublicPost, error)
 
 	GetAPFollowers(c *Collection) (*[]RemoteUser, error)
 	GetAPActorKeys(collectionID int64) ([]byte, []byte)
 	CreateUserInvite(id string, userID int64, maxUses int, expires *time.Time) error
 	GetUserInvites(userID int64) (*[]Invite, error)
 	GetUserInvite(id string) (*Invite, error)
 	GetUsersInvitedCount(id string) int64
 	CreateInvitedUser(inviteID string, userID int64) error
 
 	GetDynamicContent(id string) (*instanceContent, error)
 	UpdateDynamicContent(id, title, content, contentType string) error
 	GetAllUsers(page uint) (*[]User, error)
 	GetAllUsersCount() int64
+	GetUsersFiltered(f UserFilter) ([]FilteredUser, error)
 	GetUserLastPostTime(id int64) (*time.Time, error)
 	GetCollectionLastPostTime(id int64) (*time.Time, error)
 
 	GetIDForRemoteUser(context.Context, string, string, string) (int64, error)
 	RecordRemoteUserID(context.Context, int64, string, string, string, string) error
 	ValidateOAuthState(context.Context, string) (string, string, int64, string, error)
 	GenerateOAuthState(context.Context, string, string, int64, string) (string, error)
 	GetOauthAccounts(ctx context.Context, userID int64) ([]oauthAccountInfo, error)
 	RemoveOauth(ctx context.Context, userID int64, provider string, clientID string, remoteUserID string) error
 
 	DatabaseInitialized() bool
 }
 
 type datastore struct {
 	*sql.DB
 	driverName string
 
 	useSpencerRegex bool
 }
 
 var _ writestore = &datastore{}
 
 func (db *datastore) now() string {
 	if db.driverName == driverSQLite {
 		return "strftime('%Y-%m-%d %H:%M:%S','now')"
 	}
 	return "NOW()"
 }
 
 func (db *datastore) clip(field string, l int) string {
 	if db.driverName == driverSQLite {
 		return fmt.Sprintf("SUBSTR(%s, 0, %d)", field, l)
 	}
 	return fmt.Sprintf("LEFT(%s, %d)", field, l)
 }
 
 func (db *datastore) upsert(indexedCols ...string) string {
 	if db.driverName == driverSQLite {
 		// NOTE: SQLite UPSERT syntax only works in v3.24.0 (2018-06-04) or later
 		// Leaving this for whenever we can upgrade and include it in our binary
 		cc := strings.Join(indexedCols, ", ")
 		return "ON CONFLICT(" + cc + ") DO UPDATE SET"
 	}
 	return "ON DUPLICATE KEY UPDATE"
 }
 
 func (db *datastore) dateAdd(l int, unit string) string {
 	if db.driverName == driverSQLite {
 		return fmt.Sprintf("DATETIME('now', '%d %s')", l, unit)
 	}
 	return fmt.Sprintf("DATE_ADD(NOW(), INTERVAL %d %s)", l, unit)
 }
 
 func (db *datastore) dateSub(l int, unit string) string {
 	if db.driverName == driverSQLite {
 		return fmt.Sprintf("DATETIME('now', '-%d %s')", l, unit)
 	}
 	return fmt.Sprintf("DATE_SUB(NOW(), INTERVAL %d %s)", l, unit)
 }
 
 func (db *datastore) version() (string, error) {
 	var v string
 	var err error
 	if db.driverName == driverSQLite {
 		err = db.QueryRow("SELECT sqlite_version()").Scan(&v)
 	} else {
 		err = db.QueryRow("SELECT version()").Scan(&v)
 	}
 	if err != nil {
 		return "", err
 	}
 	return v, nil
 }
 
 // CreateUser creates a new user in the database from the given User, UPDATING it in the process with the user's ID.
 func (db *datastore) CreateUser(cfg *config.Config, u *User, collectionTitle string, collectionDesc string) error {
 	if db.PostIDExists(u.Username) {
 		return impart.HTTPError{http.StatusConflict, "Invalid collection name."}
 	}
 
 	// New users get a `users` and `collections` row.
 	t, err := db.Begin()
 	if err != nil {
 		return err
 	}
 
 	// 1. Add to `users` table
 	// NOTE: Assumes User's Password is already hashed!
 	res, err := t.Exec("INSERT INTO users (username, password, email) VALUES (?, ?, ?)", u.Username, u.HashedPass, u.Email)
 	if err != nil {
 		t.Rollback()
 		if db.isDuplicateKeyErr(err) {
 			return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 		}
 
 		log.Error("Rolling back users INSERT: %v\n", err)
 		return err
 	}
 	u.ID, err = res.LastInsertId()
 	if err != nil {
 		t.Rollback()
 		log.Error("Rolling back after LastInsertId: %v\n", err)
 		return err
 	}
 
 	// 2. Create user's Collection
 	if collectionTitle == "" {
 		collectionTitle = u.Username
 	}
 	res, err = t.Exec("INSERT INTO collections (alias, title, description, privacy, owner_id, view_count) VALUES (?, ?, ?, ?, ?, ?)", u.Username, collectionTitle, collectionDesc, defaultVisibility(cfg), u.ID, 0)
 	if err != nil {
 		t.Rollback()
 		if db.isDuplicateKeyErr(err) {
 			return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 		}
 		log.Error("Rolling back collections INSERT: %v\n", err)
 		return err
 	}
 
 	db.RemoveCollectionRedirect(t, u.Username)
 
 	err = t.Commit()
 	if err != nil {
 		t.Rollback()
 		log.Error("Rolling back after Commit(): %v\n", err)
 		return err
 	}
 
 	return nil
 }
 
 // FIXME: We're returning errors inconsistently in this file. Do we use Errorf
 // for returned value, or impart?
 func (db *datastore) UpdateUserEmail(keys *key.Keychain, userID int64, email string) error {
 	encEmail, err := data.Encrypt(keys.EmailKey, email)
 	if err != nil {
 		return fmt.Errorf("Couldn't encrypt email %s: %s\n", email, err)
 	}
 
 	return db.UpdateEncryptedUserEmail(userID, encEmail)
 }
 
 func (db *datastore) UpdateEncryptedUserEmail(userID int64, encEmail []byte) error {
 	_, err := db.Exec("UPDATE users SET email = ? WHERE id = ?", encEmail, userID)
 	if err != nil {
 		return fmt.Errorf("Unable to update user email: %s", err)
 	}
 
 	return nil
 }
 
 func (db *datastore) CreateCollectionFromToken(cfg *config.Config, alias, title, accessToken string) (*Collection, error) {
 	userID := db.GetUserID(accessToken)
 	if userID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return db.CreateCollection(cfg, alias, title, userID)
 }
 
 func (db *datastore) GetUserCollectionCount(userID int64) (uint64, error) {
 	var collCount uint64
 	err := db.QueryRow("SELECT COUNT(*) FROM collections WHERE owner_id = ?", userID).Scan(&collCount)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user from database."}
 	case err != nil:
 		log.Error("Couldn't get collections count for user %d: %v", userID, err)
 		return 0, err
 	}
 
 	return collCount, nil
 }
 
 func (db *datastore) CreateCollection(cfg *config.Config, alias, title string, userID int64) (*Collection, error) {
 	if db.PostIDExists(alias) {
 		return nil, impart.HTTPError{http.StatusConflict, "Invalid collection name."}
 	}
 
+	collCount, err := db.GetUserCollectionCount(userID)
+	if err != nil {
+		return nil, err
+	}
+	if !cfg.App.CanCreateBlogs(collCount) {
+		return nil, impart.HTTPError{http.StatusForbidden, "You've reached the maximum number of blogs."}
+	}
+
 	// All good, so create new collection
 	res, err := db.Exec("INSERT INTO collections (alias, title, description, privacy, owner_id, view_count) VALUES (?, ?, ?, ?, ?, ?)", alias, title, "", defaultVisibility(cfg), userID, 0)
 	if err != nil {
 		if db.isDuplicateKeyErr(err) {
 			return nil, impart.HTTPError{http.StatusConflict, "Collection already exists."}
 		}
 		log.Error("Couldn't add to collections: %v\n", err)
 		return nil, err
 	}
 
 	c := &Collection{
 		Alias:       alias,
 		Title:       title,
 		OwnerID:     userID,
 		PublicOwner: false,
 		Public:      defaultVisibility(cfg) == CollPublic,
 	}
 
 	c.ID, err = res.LastInsertId()
 	if err != nil {
 		log.Error("Couldn't get collection LastInsertId: %v\n", err)
 	}
 
 	return c, nil
 }
 
 func (db *datastore) GetUserByID(id int64) (*User, error) {
 	u := &User{ID: id}
 
 	err := db.QueryRow("SELECT username, password, email, created, status FROM users WHERE id = ?", id).Scan(&u.Username, &u.HashedPass, &u.Email, &u.Created, &u.Status)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user password: %v", err)
 		return nil, err
 	}
 
 	return u, nil
 }
 
 // IsUserSilenced returns true if the user account associated with id is
 // currently silenced.
 func (db *datastore) IsUserSilenced(id int64) (bool, error) {
 	u := &User{ID: id}
 
 	err := db.QueryRow("SELECT status FROM users WHERE id = ?", id).Scan(&u.Status)
 	switch {
 	case err == sql.ErrNoRows:
 		return false, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user status: %v", err)
 		return false, fmt.Errorf("is user silenced: %v", err)
 	}
 
 	return u.IsSilenced(), nil
 }
 
 // DoesUserNeedAuth returns true if the user hasn't provided any methods for
 // authenticating with the account, such a passphrase or email address.
 // Any errors are reported to admin and silently quashed, returning false as the
 // result.
 func (db *datastore) DoesUserNeedAuth(id int64) bool {
 	var pass, email []byte
 
 	// Find out if user has an email set first
 	err := db.QueryRow("SELECT password, email FROM users WHERE id = ?", id).Scan(&pass, &email)
 	switch {
 	case err == sql.ErrNoRows:
 		// ERROR. Don't give false positives on needing auth methods
 		return false
 	case err != nil:
 		// ERROR. Don't give false positives on needing auth methods
 		log.Error("Couldn't SELECT user %d from users: %v", id, err)
 		return false
 	}
 	// User doesn't need auth if there's an email
 	return len(email) == 0 && len(pass) == 0
 }
 
 func (db *datastore) IsUserPassSet(id int64) (bool, error) {
 	var pass []byte
 	err := db.QueryRow("SELECT password FROM users WHERE id = ?", id).Scan(&pass)
 	switch {
 	case err == sql.ErrNoRows:
 		return false, nil
 	case err != nil:
 		log.Error("Couldn't SELECT user %d from users: %v", id, err)
 		return false, err
 	}
 
 	return len(pass) > 0, nil
 }
 
 func (db *datastore) GetUserForAuth(username string) (*User, error) {
 	u := &User{Username: username}
 
 	err := db.QueryRow("SELECT id, password, email, created, status FROM users WHERE username = ?", username).Scan(&u.ID, &u.HashedPass, &u.Email, &u.Created, &u.Status)
 	switch {
 	case err == sql.ErrNoRows:
 		// Check if they've entered the wrong, unnormalized username
 		username = getSlug(username, "")
 		if username != u.Username {
 			err = db.QueryRow("SELECT id FROM users WHERE username = ? LIMIT 1", username).Scan(&u.ID)
 			if err == nil {
 				return db.GetUserForAuth(username)
 			}
 		}
 		return nil, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user password: %v", err)
 		return nil, err
 	}
 
 	return u, nil
 }
 
 func (db *datastore) GetUserForAuthByID(userID int64) (*User, error) {
 	u := &User{ID: userID}
 
 	err := db.QueryRow("SELECT id, password, email, created, status FROM users WHERE id = ?", u.ID).Scan(&u.ID, &u.HashedPass, &u.Email, &u.Created, &u.Status)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT userForAuthByID: %v", err)
 		return nil, err
 	}
 
 	return u, nil
 }
 
 func (db *datastore) GetUserNameFromToken(accessToken string) (string, error) {
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return "", ErrNoAccessToken
 	}
 
 	var oneTime bool
 	var username string
-	err := db.QueryRow("SELECT username, one_time FROM accesstokens LEFT JOIN users ON user_id = id WHERE token LIKE ? AND (expires IS NULL OR expires > "+db.now()+")", t).Scan(&username, &oneTime)
+	err := db.QueryRow("SELECT username, one_time FROM accesstokens LEFT JOIN users ON user_id = id WHERE token = ? AND (expires IS NULL OR expires > "+db.now()+")", string(t)).Scan(&username, &oneTime)
 	switch {
 	case err == sql.ErrNoRows:
 		return "", ErrBadAccessToken
 	case err != nil:
 		return "", ErrInternalGeneral
 	}
 
 	// Delete token if it was one-time
 	if oneTime {
 		db.DeleteToken(t[:])
 	}
 
 	return username, nil
 }
 
 func (db *datastore) GetUserDataFromToken(accessToken string) (int64, string, error) {
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return 0, "", ErrNoAccessToken
 	}
 
 	var userID int64
 	var oneTime bool
 	var username string
-	err := db.QueryRow("SELECT user_id, username, one_time FROM accesstokens LEFT JOIN users ON user_id = id WHERE token LIKE ? AND (expires IS NULL OR expires > "+db.now()+")", t).Scan(&userID, &username, &oneTime)
+	err := db.QueryRow("SELECT user_id, username, one_time FROM accesstokens LEFT JOIN users ON user_id = id WHERE token = ? AND (expires IS NULL OR expires > "+db.now()+")", string(t)).Scan(&userID, &username, &oneTime)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0, "", ErrBadAccessToken
 	case err != nil:
 		return 0, "", ErrInternalGeneral
 	}
 
 	// Delete token if it was one-time
 	if oneTime {
 		db.DeleteToken(t[:])
 	}
 
 	return userID, username, nil
 }
 
 func (db *datastore) GetAPIUser(header string) (*User, error) {
 	uID := db.GetUserID(header)
 	if uID == -1 {
 		return nil, fmt.Errorf(ErrUserNotFound.Error())
 	}
 	return db.GetUserByID(uID)
 }
 
 // GetUserID takes a hexadecimal accessToken, parses it into its binary
 // representation, and gets any user ID associated with the token. If no user
 // is associated, -1 is returned.
 func (db *datastore) GetUserID(accessToken string) int64 {
 	i, _ := db.GetUserIDPrivilege(accessToken)
 	return i
 }
 
 func (db *datastore) GetUserIDPrivilege(accessToken string) (userID int64, sudo bool) {
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return -1, false
 	}
 
 	var oneTime bool
-	err := db.QueryRow("SELECT user_id, sudo, one_time FROM accesstokens WHERE token LIKE ? AND (expires IS NULL OR expires > "+db.now()+")", t).Scan(&userID, &sudo, &oneTime)
+	err := db.QueryRow("SELECT user_id, sudo, one_time FROM accesstokens WHERE token = ? AND (expires IS NULL OR expires > "+db.now()+")", string(t)).Scan(&userID, &sudo, &oneTime)
 	switch {
 	case err == sql.ErrNoRows:
 		return -1, false
 	case err != nil:
 		return -1, false
 	}
 
 	// Delete token if it was one-time
 	if oneTime {
 		db.DeleteToken(t[:])
 	}
 
 	return
 }
 
 func (db *datastore) DeleteToken(accessToken []byte) error {
-	res, err := db.Exec("DELETE FROM accesstokens WHERE token LIKE ?", accessToken)
+	res, err := db.Exec("DELETE FROM accesstokens WHERE token = ?", string(accessToken))
 	if err != nil {
 		return err
 	}
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		return impart.HTTPError{http.StatusNotFound, "Token is invalid or doesn't exist"}
 	}
 	return nil
 }
 
 // FetchLastAccessToken creates a new non-expiring, valid access token for the given
 // userID.
 func (db *datastore) FetchLastAccessToken(userID int64) string {
 	var t []byte
 	err := db.QueryRow("SELECT token FROM accesstokens WHERE user_id = ? AND (expires IS NULL OR expires > "+db.now()+") ORDER BY created DESC LIMIT 1", userID).Scan(&t)
 	switch {
 	case err == sql.ErrNoRows:
 		return ""
 	case err != nil:
 		log.Error("Failed selecting from accesstoken: %v", err)
 		return ""
 	}
 
 	u, err := uuid.Parse(t)
 	if err != nil {
 		return ""
 	}
 	return u.String()
 }
 
 // GetAccessToken creates a new non-expiring, valid access token for the given
 // userID.
 func (db *datastore) GetAccessToken(userID int64) (string, error) {
 	return db.GetTemporaryOneTimeAccessToken(userID, 0, false)
 }
 
 // GetTemporaryAccessToken creates a new valid access token for the given
 // userID that remains valid for the given time in seconds. If validSecs is 0,
 // the access token doesn't automatically expire.
 func (db *datastore) GetTemporaryAccessToken(userID int64, validSecs int) (string, error) {
 	return db.GetTemporaryOneTimeAccessToken(userID, validSecs, false)
 }
 
 // GetTemporaryOneTimeAccessToken creates a new valid access token for the given
 // userID that remains valid for the given time in seconds and can only be used
 // once if oneTime is true. If validSecs is 0, the access token doesn't
 // automatically expire.
 func (db *datastore) GetTemporaryOneTimeAccessToken(userID int64, validSecs int, oneTime bool) (string, error) {
 	u, err := uuid.NewV4()
 	if err != nil {
 		log.Error("Unable to generate token: %v", err)
 		return "", err
 	}
 
 	// Insert UUID to `accesstokens`
 	binTok := u[:]
 
 	expirationVal := "NULL"
 	if validSecs > 0 {
 		expirationVal = db.dateAdd(validSecs, "SECOND")
 	}
 
 	_, err = db.Exec("INSERT INTO accesstokens (token, user_id, one_time, expires) VALUES (?, ?, ?, "+expirationVal+")", string(binTok), userID, oneTime)
 	if err != nil {
 		log.Error("Couldn't INSERT accesstoken: %v", err)
 		return "", err
 	}
 
 	return u.String(), nil
 }
 
 func (db *datastore) CreatePasswordResetToken(userID int64) (string, error) {
 	t := id.Generate62RandomString(32)
 
 	_, err := db.Exec("INSERT INTO password_resets (user_id, token, used, created) VALUES (?, ?, 0, "+db.now()+")", userID, t)
 	if err != nil {
 		log.Error("Couldn't INSERT password_resets: %v", err)
 		return "", err
 	}
 
 	return t, nil
 }
 
 func (db *datastore) GetUserFromPasswordReset(token string) int64 {
 	var userID int64
 	err := db.QueryRow("SELECT user_id FROM password_resets WHERE token = ? AND used = 0 AND created > "+db.dateSub(3, "HOUR"), token).Scan(&userID)
 	if err != nil {
 		return 0
 	}
 	return userID
 }
 
 func (db *datastore) ConsumePasswordResetToken(t string) error {
 	_, err := db.Exec("UPDATE password_resets SET used = 1 WHERE token = ?", t)
 	if err != nil {
 		log.Error("Couldn't UPDATE password_resets: %v", err)
 		return err
 	}
 
 	return nil
 }
 
 func (db *datastore) CreateOwnedPost(post *SubmittedPost, accessToken, collAlias, hostName string) (*PublicPost, error) {
 	var userID, collID int64 = -1, -1
 	var coll *Collection
 	var err error
 	if accessToken != "" {
 		userID = db.GetUserID(accessToken)
 		if userID == -1 {
 			return nil, ErrBadAccessToken
 		}
 		if collAlias != "" {
 			coll, err = db.GetCollection(collAlias)
 			if err != nil {
 				return nil, err
 			}
 			coll.hostName = hostName
 			if coll.OwnerID != userID {
 				return nil, ErrForbiddenCollection
 			}
 			collID = coll.ID
 		}
 	}
 
 	rp := &PublicPost{}
 	rp.Post, err = db.CreatePost(userID, collID, post)
 	if err != nil {
 		return rp, err
 	}
 	if coll != nil {
 		coll.ForPublic()
 		rp.Collection = &CollectionObj{Collection: *coll}
 	}
 	return rp, nil
 }
 
 func (db *datastore) CreatePost(userID, collID int64, post *SubmittedPost) (*Post, error) {
 	idLen := postIDLen
 	friendlyID := id.GenerateFriendlyRandomString(idLen)
 
 	// Handle appearance / font face
 	appearance := post.Font
 	if !post.isFontValid() {
 		appearance = "norm"
 	}
 
 	var err error
 	ownerID := sql.NullInt64{
 		Valid: false,
 	}
 	ownerCollID := sql.NullInt64{
 		Valid: false,
 	}
 	slug := sql.NullString{"", false}
 
 	// If an alias was supplied, we'll add this to the collection as well.
 	if userID > 0 {
 		ownerID.Int64 = userID
 		ownerID.Valid = true
 		if collID > 0 {
 			ownerCollID.Int64 = collID
 			ownerCollID.Valid = true
 			var slugVal string
 			if post.Slug != nil && *post.Slug != "" {
-				slugVal = *post.Slug
+				slugVal = getSlug(*post.Slug, post.Language.String)
 			} else {
 				if post.Title != nil && *post.Title != "" {
 					slugVal = getSlug(*post.Title, post.Language.String)
 					if slugVal == "" {
 						slugVal = getSlug(*post.Content, post.Language.String)
 					}
 				} else {
 					slugVal = getSlug(*post.Content, post.Language.String)
 				}
 			}
 			if slugVal == "" {
 				slugVal = friendlyID
 			}
 			slug = sql.NullString{slugVal, true}
 		}
 	}
 
 	created := time.Now()
 	if db.driverName == driverSQLite {
 		// SQLite stores datetimes in UTC, so convert time.Now() to it here
 		created = created.UTC()
 	}
 	if post.Created != nil && *post.Created != "" {
 		created, err = time.Parse("2006-01-02T15:04:05Z", *post.Created)
 		if err != nil {
 			log.Error("Unable to parse Created time '%s': %v", *post.Created, err)
 			created = time.Now()
 			if db.driverName == driverSQLite {
 				// SQLite stores datetimes in UTC, so convert time.Now() to it here
 				created = created.UTC()
 			}
 		}
 	}
 
 	stmt, err := db.Prepare("INSERT INTO posts (id, slug, title, content, text_appearance, language, rtl, privacy, owner_id, collection_id, created, updated, view_count) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, " + db.now() + ", ?)")
 	if err != nil {
 		return nil, err
 	}
 	defer stmt.Close()
 	_, err = stmt.Exec(friendlyID, slug, post.Title, post.Content, appearance, post.Language, post.IsRTL, 0, ownerID, ownerCollID, created, 0)
 	if err != nil {
 		if db.isDuplicateKeyErr(err) {
 			// Duplicate entry error; try a new slug
 			// TODO: make this a little more robust
 			slug = sql.NullString{id.GenSafeUniqueSlug(slug.String), true}
 			_, err = stmt.Exec(friendlyID, slug, post.Title, post.Content, appearance, post.Language, post.IsRTL, 0, ownerID, ownerCollID, created, 0)
 			if err != nil {
 				return nil, handleFailedPostInsert(fmt.Errorf("Retried slug generation, still failed: %v", err))
 			}
 		} else {
 			return nil, handleFailedPostInsert(err)
 		}
 	}
 
 	// TODO: return Created field in proper format
 	return &Post{
 		ID:           friendlyID,
 		Slug:         null.NewString(slug.String, slug.Valid),
 		Font:         appearance,
 		Language:     zero.NewString(post.Language.String, post.Language.Valid),
 		RTL:          zero.NewBool(post.IsRTL.Bool, post.IsRTL.Valid),
 		OwnerID:      null.NewInt(userID, true),
 		CollectionID: null.NewInt(userID, true),
 		Created:      created.Truncate(time.Second).UTC(),
 		Updated:      time.Now().Truncate(time.Second).UTC(),
 		Title:        zero.NewString(*(post.Title), true),
 		Content:      *(post.Content),
 	}, nil
 }
 
 // UpdateOwnedPost updates an existing post with only the given fields in the
 // supplied AuthenticatedPost.
 func (db *datastore) UpdateOwnedPost(post *AuthenticatedPost, userID int64) error {
 	params := []interface{}{}
 	var queryUpdates, sep, authCondition string
 	if post.Slug != nil && *post.Slug != "" {
 		queryUpdates += sep + "slug = ?"
 		sep = ", "
 		params = append(params, getSlug(*post.Slug, ""))
 	}
 	if post.Content != nil {
 		queryUpdates += sep + "content = ?"
 		sep = ", "
 		params = append(params, post.Content)
 	}
 	if post.Title != nil {
 		queryUpdates += sep + "title = ?"
 		sep = ", "
 		params = append(params, post.Title)
 	}
 	if post.Language.Valid {
 		queryUpdates += sep + "language = ?"
 		sep = ", "
 		params = append(params, post.Language.String)
 	}
 	if post.IsRTL.Valid {
 		queryUpdates += sep + "rtl = ?"
 		sep = ", "
 		params = append(params, post.IsRTL.Bool)
 	}
 	if post.Font != "" {
 		queryUpdates += sep + "text_appearance = ?"
 		sep = ", "
 		params = append(params, post.Font)
 	}
 	if post.Created != nil {
 		createTime, err := time.Parse(postMetaDateFormat, *post.Created)
 		if err != nil {
 			log.Error("Unable to parse Created date: %v", err)
 			return fmt.Errorf("That's the incorrect format for Created date.")
 		}
 		queryUpdates += sep + "created = ?"
 		sep = ", "
 		params = append(params, createTime)
 	}
 
 	// WHERE parameters...
 	// id = ?
 	params = append(params, post.ID)
 	// AND owner_id = ?
 	authCondition = "(owner_id = ?)"
 	params = append(params, userID)
 
 	if queryUpdates == "" {
 		return ErrPostNoUpdatableVals
 	}
 
 	queryUpdates += sep + "updated = " + db.now()
 
 	res, err := db.Exec("UPDATE posts SET "+queryUpdates+" WHERE id = ? AND "+authCondition, params...)
 	if err != nil {
 		log.Error("Unable to update owned post: %v", err)
 		return err
 	}
 
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		// Show the correct error message if nothing was updated
 		var dummy int
 		err := db.QueryRow("SELECT 1 FROM posts WHERE id = ? AND "+authCondition, post.ID, params[len(params)-1]).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return ErrUnauthorizedEditPost
 		case err != nil:
 			log.Error("Failed selecting from posts: %v", err)
 		}
 		return nil
 	}
 
 	return nil
 }
 
 func (db *datastore) GetCollectionBy(condition string, value interface{}) (*Collection, error) {
 	c := &Collection{}
 
 	// FIXME: change Collection to reflect database values. Add helper functions to get actual values
 	var styleSheet, script, signature, format zero.String
 	row := db.QueryRow("SELECT id, alias, title, description, style_sheet, script, post_signature, format, owner_id, privacy, view_count FROM collections WHERE "+condition, value)
 
 	err := row.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &styleSheet, &script, &signature, &format, &c.OwnerID, &c.Visibility, &c.Views)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, impart.HTTPError{http.StatusNotFound, "Collection doesn't exist."}
 	case db.isHighLoadError(err):
 		return nil, ErrUnavailable
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 	c.StyleSheet = styleSheet.String
 	c.Script = script.String
 	c.Signature = signature.String
 	c.Format = format.String
 	c.Public = c.IsPublic()
 	c.Monetization = db.GetCollectionAttribute(c.ID, "monetization_pointer")
 	c.Verification = db.GetCollectionAttribute(c.ID, "verification_link")
 
 	c.db = db
 
 	return c, nil
 }
 
 func (db *datastore) GetCollection(alias string) (*Collection, error) {
 	return db.GetCollectionBy("alias = ?", alias)
 }
 
 func (db *datastore) GetCollectionForPad(alias string) (*Collection, error) {
 	c := &Collection{Alias: alias}
 
 	row := db.QueryRow("SELECT id, alias, title, description, privacy FROM collections WHERE alias = ?", alias)
 
 	err := row.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &c.Visibility)
 	switch {
 	case err == sql.ErrNoRows:
 		return c, impart.HTTPError{http.StatusNotFound, "Collection doesn't exist."}
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return c, ErrInternalGeneral
 	}
 	c.Public = c.IsPublic()
 
 	return c, nil
 }
 
 func (db *datastore) GetCollectionByID(id int64) (*Collection, error) {
 	return db.GetCollectionBy("id = ?", id)
 }
 
 func (db *datastore) GetCollectionFromDomain(host string) (*Collection, error) {
 	return db.GetCollectionBy("host = ?", host)
 }
 
 func (db *datastore) UpdateCollection(app *App, c *SubmittedCollection, alias string) error {
 	// Truncate fields correctly, so we don't get "Data too long for column" errors in MySQL (writefreely#600)
 	if c.Title != nil {
 		*c.Title = parse.Truncate(*c.Title, collMaxLengthTitle)
 	}
 	if c.Description != nil {
 		*c.Description = parse.Truncate(*c.Description, collMaxLengthDescription)
 	}
 
 	q := query.NewUpdate().
 		SetStringPtr(c.Title, "title").
 		SetStringPtr(c.Description, "description").
 		SetStringPtr(c.StyleSheet, "style_sheet").
 		SetStringPtr(c.Script, "script").
 		SetStringPtr(c.Signature, "post_signature")
 
 	if c.Format != nil {
 		cf := &CollectionFormat{Format: c.Format.String}
 		if cf.Valid() {
 			q.SetNullString(c.Format, "format")
 		}
 	}
 
 	var updatePass bool
 	if c.Visibility != nil && (collVisibility(*c.Visibility)&CollProtected == 0 || c.Pass != "") {
 		q.SetIntPtr(c.Visibility, "privacy")
 		if c.Pass != "" {
 			updatePass = true
 		}
 	}
 
 	// WHERE values
 	q.Where("alias = ? AND owner_id = ?", alias, c.OwnerID)
 
 	if q.Updates == "" && c.Monetization == nil {
 		return ErrPostNoUpdatableVals
 	}
 
 	// Find any current domain
 	var collID int64
 	var rowsAffected int64
 	var changed bool
 	var res sql.Result
-	err := db.QueryRow("SELECT id FROM collections WHERE alias = ?", alias).Scan(&collID)
-	if err != nil {
+	err := db.QueryRow("SELECT id FROM collections WHERE alias = ? AND owner_id = ?", alias, c.OwnerID).Scan(&collID)
+	if err == sql.ErrNoRows {
+		return ErrUnauthorizedEditPost
+	} else if err != nil {
 		log.Error("Failed selecting from collections: %v. Some things won't work.", err)
+		return err
 	}
 
 	// Update MathJax value
 	if c.MathJax {
 		if db.driverName == driverSQLite {
 			_, err = db.Exec("INSERT OR REPLACE INTO collectionattributes (collection_id, attribute, value) VALUES (?, ?, ?)", collID, "render_mathjax", "1")
 		} else {
 			_, err = db.Exec("INSERT INTO collectionattributes (collection_id, attribute, value) VALUES (?, ?, ?) "+db.upsert("collection_id", "attribute")+" value = ?", collID, "render_mathjax", "1", "1")
 		}
 		if err != nil {
 			log.Error("Unable to insert render_mathjax value: %v", err)
 			return err
 		}
 	} else {
 		_, err = db.Exec("DELETE FROM collectionattributes WHERE collection_id = ? AND attribute = ?", collID, "render_mathjax")
 		if err != nil {
 			log.Error("Unable to delete render_mathjax value: %v", err)
 			return err
 		}
 	}
 
 	// Update Verification link value
 	if c.Verification != nil {
 		skipUpdate := false
 		if *c.Verification != "" {
 			// Strip away any excess spaces
 			trimmed := strings.TrimSpace(*c.Verification)
 			if strings.HasPrefix(trimmed, "@") && strings.Count(trimmed, "@") == 2 {
 				// This looks like a fediverse handle, so resolve profile URL
 				profileURL, err := GetProfileURLFromHandle(app, trimmed)
 				if err != nil || profileURL == "" {
 					log.Error("Couldn't find user %s: %v", trimmed, err)
 					skipUpdate = true
 				} else {
 					c.Verification = &profileURL
 				}
 			} else {
 				if !strings.HasPrefix(trimmed, "http") {
 					trimmed = "https://" + trimmed
 				}
 				vu, err := url.Parse(trimmed)
 				if err != nil {
 					// Value appears invalid, so don't update
 					skipUpdate = true
 				} else {
 					s := vu.String()
 					c.Verification = &s
 				}
 			}
 		}
 		if !skipUpdate {
 			err = db.SetCollectionAttribute(collID, "verification_link", *c.Verification)
 			if err != nil {
 				log.Error("Unable to insert verification_link value: %v", err)
 				return err
 			}
 		}
 	}
 
 	// Update Monetization value
 	if c.Monetization != nil {
 		skipUpdate := false
 		if *c.Monetization != "" {
 			// Strip away any excess spaces
 			trimmed := strings.TrimSpace(*c.Monetization)
 			// Only update value when it starts with "$" or "https" URL, per spec: https://paymentpointers.org
 			if strings.HasPrefix(trimmed, "$") || strings.HasPrefix(trimmed, "https://") {
 				if strings.HasPrefix(trimmed, "https://") {
 					// Standardize to pointer that begins with "$"
 					trimmed = strings.Replace(trimmed, "https://", "$", 1)
 				}
 				c.Monetization = &trimmed
 			} else {
 				// Value appears invalid, so don't update
 				skipUpdate = true
 			}
 		}
 		if !skipUpdate {
 			_, err = db.Exec("INSERT INTO collectionattributes (collection_id, attribute, value) VALUES (?, ?, ?) "+db.upsert("collection_id", "attribute")+" value = ?", collID, "monetization_pointer", *c.Monetization, *c.Monetization)
 			if err != nil {
 				log.Error("Unable to insert monetization_pointer value: %v", err)
 				return err
 			}
 		}
 	}
 
 	// Update EmailSub value
 	if c.EmailSubs {
 		err = db.SetCollectionAttribute(collID, "email_subs", "1")
 		if err != nil {
 			log.Error("Unable to insert email_subs value: %v", err)
 			return err
 		}
 		skipUpdate := false
 		if c.LetterReply != nil {
 			// Strip away any excess spaces
 			trimmed := strings.TrimSpace(*c.LetterReply)
 			// Only update value when it contains "@"
 			if strings.IndexRune(trimmed, '@') > 0 {
 				c.LetterReply = &trimmed
 			} else {
 				// Value appears invalid, so don't update
 				skipUpdate = true
 			}
 			if !skipUpdate {
 				err = db.SetCollectionAttribute(collID, collAttrLetterReplyTo, *c.LetterReply)
 				if err != nil {
 					log.Error("Unable to insert %s value: %v", collAttrLetterReplyTo, err)
 					return err
 				}
 			}
 		}
 	} else {
 		_, err = db.Exec("DELETE FROM collectionattributes WHERE collection_id = ? AND attribute = ?", collID, "email_subs")
 		if err != nil {
 			log.Error("Unable to delete email_subs value: %v", err)
 			return err
 		}
 	}
 
 	// Update rest of the collection data
 	if q.Updates != "" {
 		res, err = db.Exec("UPDATE collections SET "+q.Updates+" WHERE "+q.Conditions, q.Params...)
 		if err != nil {
 			log.Error("Unable to update collection: %v", err)
 			return err
 		}
 	}
 
 	rowsAffected, _ = res.RowsAffected()
 	if !changed || rowsAffected == 0 {
 		// Show the correct error message if nothing was updated
 		var dummy int
 		err := db.QueryRow("SELECT 1 FROM collections WHERE alias = ? AND owner_id = ?", alias, c.OwnerID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return ErrUnauthorizedEditPost
 		case err != nil:
 			log.Error("Failed selecting from collections: %v", err)
 		}
 		if !updatePass {
 			return nil
 		}
 	}
 
 	if updatePass {
 		hashedPass, err := auth.HashPass([]byte(c.Pass))
 		if err != nil {
 			log.Error("Unable to create hash: %s", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 		}
 		if db.driverName == driverSQLite {
 			_, err = db.Exec("INSERT OR REPLACE INTO collectionpasswords (collection_id, password) VALUES ((SELECT id FROM collections WHERE alias = ?), ?)", alias, hashedPass)
 		} else {
 			_, err = db.Exec("INSERT INTO collectionpasswords (collection_id, password) VALUES ((SELECT id FROM collections WHERE alias = ?), ?) "+db.upsert("collection_id")+" password = ?", alias, hashedPass, hashedPass)
 		}
 		if err != nil {
 			return err
 		}
 	}
 
 	return nil
 }
 
 const postCols = "id, slug, text_appearance, language, rtl, privacy, owner_id, collection_id, pinned_position, created, updated, view_count, title, content"
 
 // getEditablePost returns a PublicPost with the given ID only if the given
 // edit token is valid for the post.
 func (db *datastore) GetEditablePost(id, editToken string) (*PublicPost, error) {
 	// FIXME: code duplicated from getPost()
 	// TODO: add slight logic difference to getPost / one func
 	var ownerName sql.NullString
 	p := &Post{}
 
 	row := db.QueryRow("SELECT "+postCols+", (SELECT username FROM users WHERE users.id = posts.owner_id) AS username FROM posts WHERE id = ? LIMIT 1", id)
 	err := row.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content, &ownerName)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrPostNotFound
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 
 	if p.Content == "" && p.Title.String == "" {
 		return nil, ErrPostUnpublished
 	}
 
 	res := p.processPost()
 	if ownerName.Valid {
 		res.Owner = &PublicUser{Username: ownerName.String}
 	}
 
 	return &res, nil
 }
 
 func (db *datastore) PostIDExists(id string) bool {
 	var dummy bool
 	err := db.QueryRow("SELECT 1 FROM posts WHERE id = ?", id).Scan(&dummy)
 	return err == nil && dummy
 }
 
 // GetPost gets a public-facing post object from the database. If collectionID
 // is > 0, the post will be retrieved by slug and collection ID, rather than
 // post ID.
 // TODO: break this into two functions:
 //   - GetPost(id string)
 //   - GetCollectionPost(slug string, collectionID int64)
 func (db *datastore) GetPost(id string, collectionID int64) (*PublicPost, error) {
 	var ownerName sql.NullString
 	p := &Post{}
 
 	var row *sql.Row
 	var where string
 	params := []interface{}{id}
 	if collectionID > 0 {
 		where = "slug = ? AND collection_id = ?"
 		params = append(params, collectionID)
 	} else {
 		where = "id = ?"
 	}
 	row = db.QueryRow("SELECT "+postCols+", (SELECT username FROM users WHERE users.id = posts.owner_id) AS username FROM posts WHERE "+where+" LIMIT 1", params...)
 	err := row.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content, &ownerName)
 	switch {
 	case err == sql.ErrNoRows:
 		if collectionID > 0 {
 			return nil, ErrCollectionPageNotFound
 		}
 		return nil, ErrPostNotFound
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 
 	if p.Content == "" && p.Title.String == "" {
 		return nil, ErrPostUnpublished
 	}
 
 	// Get additional information needed before processing post data
 	p.LikeCount, err = db.GetPostLikeCounts(p.ID)
 	if err != nil {
 		return nil, err
 	}
 
 	res := p.processPost()
 	if ownerName.Valid {
 		res.Owner = &PublicUser{Username: ownerName.String}
 	}
 
 	return &res, nil
 }
 
 // TODO: don't duplicate getPost() functionality
 func (db *datastore) GetOwnedPost(id string, ownerID int64) (*PublicPost, error) {
 	p := &Post{}
 
 	var row *sql.Row
 	where := "id = ? AND owner_id = ?"
 	params := []interface{}{id, ownerID}
 	row = db.QueryRow("SELECT "+postCols+" FROM posts WHERE "+where+" LIMIT 1", params...)
 	err := row.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrPostNotFound
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 
 	if p.Content == "" && p.Title.String == "" {
 		return nil, ErrPostUnpublished
 	}
 
 	res := p.processPost()
 
 	return &res, nil
 }
 
 func (db *datastore) GetPostProperty(id string, collectionID int64, property string) (interface{}, error) {
 	propSelects := map[string]string{
 		"views": "view_count AS views",
 	}
 	selectQuery, ok := propSelects[property]
 	if !ok {
 		return nil, impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Invalid property: %s.", property)}
 	}
 
 	var res interface{}
 	var row *sql.Row
 	if collectionID != 0 {
 		row = db.QueryRow("SELECT "+selectQuery+" FROM posts WHERE slug = ? AND collection_id = ? LIMIT 1", id, collectionID)
 	} else {
 		row = db.QueryRow("SELECT "+selectQuery+" FROM posts WHERE id = ? LIMIT 1", id)
 	}
 	err := row.Scan(&res)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, impart.HTTPError{http.StatusNotFound, "Post not found."}
 	case err != nil:
 		log.Error("Failed selecting post: %v", err)
 		return nil, err
 	}
 
 	return res, nil
 }
 
 func (db *datastore) GetPostLikeCounts(postID string) (int64, error) {
 	var count int64
 	err := db.QueryRow("SELECT COUNT(*) FROM remote_likes WHERE post_id = ?", postID).Scan(&count)
 	switch {
 	case err == sql.ErrNoRows:
 		count = 0
 	case err != nil:
 		return 0, err
 	}
 	return count, nil
 }
 
 // GetPostsCount modifies the CollectionObj to include the correct number of
 // standard (non-pinned) posts. It will return future posts if `includeFuture`
 // is true.
 func (db *datastore) GetPostsCount(c *CollectionObj, includeFuture bool) error {
 	var count int64
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= " + db.now()
 	}
 	err := db.QueryRow("SELECT COUNT(*) FROM posts WHERE collection_id = ? AND pinned_position IS NULL "+timeCondition, c.ID).Scan(&count)
 	switch {
 	case err == sql.ErrNoRows:
 		c.TotalPosts = 0
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		c.TotalPosts = 0
 		return err
 	}
 
 	c.TotalPosts = int(count)
 	return nil
 }
 
 // GetPosts retrieves all posts for the given Collection.
 // It will return future posts if `includeFuture` is true.
 // It will include only standard (non-pinned) posts unless `includePinned` is true.
 // TODO: change includeFuture to isOwner, since that's how it's used
 func (db *datastore) GetPosts(cfg *config.Config, c *Collection, page int, includeFuture, forceRecentFirst, includePinned bool, contentType PostType) (*[]PublicPost, error) {
 	collID := c.ID
 
 	cf := c.NewFormat()
 	order := "DESC"
 	if cf.Ascending() && !forceRecentFirst {
 		order = "ASC"
 	}
 
 	pagePosts := cf.PostsPerPage()
 	start := page*pagePosts - pagePosts
 	if page == 0 {
 		start = 0
 		pagePosts = 1000
 	} else if contentType == postArch {
 		pagePosts = postsPerArchPage
 		start = page*pagePosts - pagePosts
 	}
 
 	limitStr := ""
 	if page > 0 {
 		limitStr = fmt.Sprintf(" LIMIT %d, %d", start, pagePosts)
 	}
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= " + db.now()
 	}
 	pinnedCondition := ""
 	if !includePinned {
 		pinnedCondition = "AND pinned_position IS NULL"
 	}
 	// FUTURE: handle different post contentType's here
 	rows, err := db.Query("SELECT "+postCols+" FROM posts WHERE collection_id = ? "+pinnedCondition+" "+timeCondition+" ORDER BY created "+order+limitStr, collID)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve collection posts."}
 	}
 	defer rows.Close()
 
 	// TODO: extract this common row scanning logic for queries using `postCols`
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 		p.augmentContent(c)
 		p.formatContent(cfg, c, includeFuture, false)
 
 		pubPost := p.processPost()
 		if contentType == postArch {
 			// Overwrite DisplayDate with special Archive page version
 			loc := monday.FuzzyLocale(pubPost.Language.String)
 			pubPost.DisplayDate = monday.Format(pubPost.Created, monday.LongNoYrFormatsByLocale[loc], loc)
 		}
 		posts = append(posts, pubPost)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetAllPostsTaggedIDs(c *Collection, tag string, includeFuture bool) ([]string, error) {
 	collID := c.ID
 
 	cf := c.NewFormat()
 	order := "DESC"
 	if cf.Ascending() {
 		order = "ASC"
 	}
 
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= " + db.now()
 	}
 	var rows *sql.Rows
 	var err error
 	if db.driverName == driverSQLite {
 		rows, err = db.Query("SELECT id FROM posts WHERE collection_id = ? AND LOWER(content) regexp ? "+timeCondition+" ORDER BY created "+order, collID, `.*#`+strings.ToLower(tag)+`\b.*`)
 	} else {
 		rows, err = db.Query("SELECT id FROM posts WHERE collection_id = ? AND LOWER(content) RLIKE ? "+timeCondition+" ORDER BY created "+order, collID, "#"+strings.ToLower(tag)+"[[:>:]]")
 	}
 	if err != nil {
 		log.Error("Failed selecting tagged posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve tagged collection posts."}
 	}
 	defer rows.Close()
 
 	ids := []string{}
 	for rows.Next() {
 		var id string
 		err = rows.Scan(&id)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 
 		ids = append(ids, id)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return ids, nil
 }
 
 // GetPostsTagged retrieves all posts on the given Collection that contain the
 // given tag.
 // It will return future posts if `includeFuture` is true.
 // TODO: change includeFuture to isOwner, since that's how it's used
 func (db *datastore) GetPostsTagged(cfg *config.Config, c *Collection, tag string, page int, includeFuture bool) (*[]PublicPost, error) {
 	collID := c.ID
 
 	cf := c.NewFormat()
 	order := "DESC"
 	if cf.Ascending() {
 		order = "ASC"
 	}
 
 	pagePosts := cf.PostsPerPage()
 	start := page*pagePosts - pagePosts
 	if page == 0 {
 		start = 0
 		pagePosts = 1000
 	}
 
 	limitStr := ""
 	if page > 0 {
 		limitStr = fmt.Sprintf(" LIMIT %d, %d", start, pagePosts)
 	}
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= " + db.now()
 	}
 
 	var rows *sql.Rows
 	var err error
 	if db.driverName == driverSQLite {
 		rows, err = db.Query("SELECT "+postCols+" FROM posts WHERE collection_id = ? AND LOWER(content) regexp ? "+timeCondition+" ORDER BY created "+order+limitStr, collID, `.*#`+strings.ToLower(tag)+`\b.*`)
 	} else {
 		var boundaryRegex string
 		if db.useSpencerRegex {
 			// MySQL earlier than 8.0.4, Henry Spencer's regex implementation
 			boundaryRegex = "[[:>:]]"
 		} else {
 			// MySQL 8.0.4+, International Components for Unicode (ICU) syntax
 			boundaryRegex = "\\b"
 		}
 		rows, err = db.Query("SELECT "+postCols+" FROM posts WHERE collection_id = ? AND LOWER(content) RLIKE ? "+timeCondition+" ORDER BY created "+order+limitStr, collID, "#"+strings.ToLower(tag)+boundaryRegex)
 	}
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve collection posts."}
 	}
 	defer rows.Close()
 
 	// TODO: extract this common row scanning logic for queries using `postCols`
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 		p.augmentContent(c)
 		p.formatContent(cfg, c, includeFuture, false)
 
 		posts = append(posts, p.processPost())
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetCollLangTotalPosts(collID int64, lang string) (uint64, error) {
 	var articles uint64
 	err := db.QueryRow("SELECT COUNT(*) FROM posts WHERE collection_id = ? AND language = ? AND created <= "+db.now(), collID, lang).Scan(&articles)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Couldn't get total lang posts count for collection %d: %v", collID, err)
 		return 0, err
 	}
 	return articles, nil
 }
 
 func (db *datastore) GetLangPosts(cfg *config.Config, c *Collection, lang string, page int, includeFuture bool) (*[]PublicPost, error) {
 	collID := c.ID
 
 	cf := c.NewFormat()
 	order := "DESC"
 	if cf.Ascending() {
 		order = "ASC"
 	}
 
 	pagePosts := cf.PostsPerPage()
 	start := page*pagePosts - pagePosts
 	if page == 0 {
 		start = 0
 		pagePosts = 1000
 	}
 
 	limitStr := ""
 	if page > 0 {
 		limitStr = fmt.Sprintf(" LIMIT %d, %d", start, pagePosts)
 	}
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= " + db.now()
 	}
 
 	rows, err := db.Query(`SELECT `+postCols+`
 FROM posts
 WHERE collection_id = ? AND language = ? `+timeCondition+`
 ORDER BY created `+order+limitStr, collID, lang)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve collection posts."}
 	}
 	defer rows.Close()
 
 	// TODO: extract this common row scanning logic for queries using `postCols`
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 		p.augmentContent(c)
 		p.formatContent(cfg, c, includeFuture, false)
 
 		posts = append(posts, p.processPost())
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetAPFollowers(c *Collection) (*[]RemoteUser, error) {
 	rows, err := db.Query(`SELECT actor_id, inbox, shared_inbox, f.created
 FROM remotefollows f
 INNER JOIN remoteusers u
   ON f.remote_user_id = u.id
 WHERE collection_id = ?
 ORDER BY created DESC`, c.ID)
 	if err != nil {
 		log.Error("Failed selecting from followers: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve followers."}
 	}
 	defer rows.Close()
 
 	followers := []RemoteUser{}
 	for rows.Next() {
 		f := RemoteUser{}
 		err = rows.Scan(&f.ActorID, &f.Inbox, &f.SharedInbox, &f.Created)
 		followers = append(followers, f)
 	}
 	return &followers, nil
 }
 
 // CanCollect returns whether or not the given user can add the given post to a
 // collection. This is true when a post is already owned by the user.
 // NOTE: this is currently only used to potentially add owned posts to a
 // collection. This has the SIDE EFFECT of also generating a slug for the post.
 // FIXME: make this side effect more explicit (or extract it)
 func (db *datastore) CanCollect(cpr *ClaimPostRequest, userID int64) bool {
 	var title, content string
 	var lang sql.NullString
 	err := db.QueryRow("SELECT title, content, language FROM posts WHERE id = ? AND owner_id = ?", cpr.ID, userID).Scan(&title, &content, &lang)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Failed on post CanCollect(%s, %d): %v", cpr.ID, userID, err)
 		return false
 	}
 
 	// Since we have the post content and the post is collectable, generate the
 	// post's slug now.
 	cpr.Slug = getSlugFromPost(title, content, lang.String)
 
 	return true
 }
 
 func (db *datastore) AttemptClaim(p *ClaimPostRequest, query string, params []interface{}, slugIdx int) (sql.Result, error) {
 	qRes, err := db.Exec(query, params...)
 	if err != nil {
 		if db.isDuplicateKeyErr(err) && slugIdx > -1 {
 			s := id.GenSafeUniqueSlug(p.Slug)
 			if s == p.Slug {
 				// Sanity check to prevent infinite recursion
 				return qRes, fmt.Errorf("GenSafeUniqueSlug generated nothing unique: %s", s)
 			}
 			p.Slug = s
 			params[slugIdx] = p.Slug
 			return db.AttemptClaim(p, query, params, slugIdx)
 		}
 		return qRes, fmt.Errorf("attemptClaim: %s", err)
 	}
 	return qRes, nil
 }
 
 func (db *datastore) DispersePosts(userID int64, postIDs []string) (*[]ClaimPostResult, error) {
 	postClaimReqs := map[string]bool{}
 	res := []ClaimPostResult{}
 	for i := range postIDs {
 		postID := postIDs[i]
 
 		r := ClaimPostResult{Code: 0, ErrorMessage: ""}
 
 		// Perform post validation
 		if postID == "" {
 			r.ErrorMessage = "Missing post ID. "
 		}
 		if _, ok := postClaimReqs[postID]; ok {
 			r.Code = 429
 			r.ErrorMessage = "You've already tried anonymizing this post."
 			r.ID = postID
 			res = append(res, r)
 			continue
 		}
 		postClaimReqs[postID] = true
 
 		var err error
 		// Get full post information to return
 		var fullPost *PublicPost
 		fullPost, err = db.GetPost(postID, 0)
 		if err != nil {
 			if err, ok := err.(impart.HTTPError); ok {
 				r.Code = err.Status
 				r.ErrorMessage = err.Message
 				r.ID = postID
 				res = append(res, r)
 				continue
 			} else {
 				log.Error("Error getting post in dispersePosts: %v", err)
 			}
 		}
 		if fullPost.OwnerID.Int64 != userID {
 			r.Code = http.StatusConflict
 			r.ErrorMessage = "Post is already owned by someone else."
 			r.ID = postID
 			res = append(res, r)
 			continue
 		}
 
 		var qRes sql.Result
 		var query string
 		var params []interface{}
 		// Do AND owner_id = ? for sanity.
 		// This should've been caught and returned with a good error message
 		// just above.
 		query = "UPDATE posts SET collection_id = NULL WHERE id = ? AND owner_id = ?"
 		params = []interface{}{postID, userID}
 		qRes, err = db.Exec(query, params...)
 		if err != nil {
 			r.Code = http.StatusInternalServerError
 			r.ErrorMessage = "A glitch happened on our end."
 			r.ID = postID
 			res = append(res, r)
 			log.Error("dispersePosts (post %s): %v", postID, err)
 			continue
 		}
 
 		// Post was successfully dispersed
 		r.Code = http.StatusOK
 		r.Post = fullPost
 
 		rowsAffected, _ := qRes.RowsAffected()
 		if rowsAffected == 0 {
 			// This was already claimed, but return 200
 			r.Code = http.StatusOK
 		}
 		res = append(res, r)
 	}
 
 	return &res, nil
 }
 
 func (db *datastore) ClaimPosts(cfg *config.Config, userID int64, collAlias string, posts *[]ClaimPostRequest) (*[]ClaimPostResult, error) {
 	postClaimReqs := map[string]bool{}
 	res := []ClaimPostResult{}
 	postCollAlias := collAlias
 	for i := range *posts {
 		p := (*posts)[i]
 		if &p == nil {
 			continue
 		}
 
 		r := ClaimPostResult{Code: 0, ErrorMessage: ""}
 
 		// Perform post validation
 		if p.ID == "" {
 			r.ErrorMessage = "Missing post ID `id`. "
 		}
 		if _, ok := postClaimReqs[p.ID]; ok {
 			r.Code = 429
 			r.ErrorMessage = "You've already tried claiming this post."
 			r.ID = p.ID
 			res = append(res, r)
 			continue
 		}
 		postClaimReqs[p.ID] = true
 
 		canCollect := db.CanCollect(&p, userID)
 		if !canCollect && p.Token == "" {
 			// TODO: ensure post isn't owned by anyone else when a valid modify
 			// token is given.
 			r.ErrorMessage += "Missing post Edit Token `token`."
 		}
 		if r.ErrorMessage != "" {
 			// Post validate failed
 			r.Code = http.StatusBadRequest
 			r.ID = p.ID
 			res = append(res, r)
 			continue
 		}
 
 		var err error
 		var qRes sql.Result
 		var query string
 		var params []interface{}
 		var slugIdx int = -1
 		var coll *Collection
 		if collAlias == "" {
 			// Posts are being claimed at /posts/claim, not
 			// /collections/{alias}/collect, so use given individual collection
 			// to associate post with.
 			postCollAlias = p.CollectionAlias
 		}
 		if postCollAlias != "" {
 			// Associate this post with a collection
 			if p.CreateCollection {
 				// This is a new collection
 				// TODO: consider removing this. This seriously complicates this
 				// method and adds another (unnecessary?) logic path.
 				coll, err = db.CreateCollection(cfg, postCollAlias, "", userID)
 				if err != nil {
 					if err, ok := err.(impart.HTTPError); ok {
 						r.Code = err.Status
 						r.ErrorMessage = err.Message
 					} else {
 						r.Code = http.StatusInternalServerError
 						r.ErrorMessage = "Unknown error occurred creating collection"
 					}
 					r.ID = p.ID
 					res = append(res, r)
 					continue
 				}
 			} else {
 				// Attempt to add to existing collection
 				coll, err = db.GetCollection(postCollAlias)
 				if err != nil {
 					if err, ok := err.(impart.HTTPError); ok {
 						if err.Status == http.StatusNotFound {
 							// Show obfuscated "forbidden" response, as if attempting to add to an
 							// unowned blog.
 							r.Code = ErrForbiddenCollection.Status
 							r.ErrorMessage = ErrForbiddenCollection.Message
 						} else {
 							r.Code = err.Status
 							r.ErrorMessage = err.Message
 						}
 					} else {
 						r.Code = http.StatusInternalServerError
 						r.ErrorMessage = "Unknown error occurred claiming post with collection"
 					}
 					r.ID = p.ID
 					res = append(res, r)
 					continue
 				}
 				if coll.OwnerID != userID {
 					r.Code = ErrForbiddenCollection.Status
 					r.ErrorMessage = ErrForbiddenCollection.Message
 					r.ID = p.ID
 					res = append(res, r)
 					continue
 				}
 			}
 			if p.Slug == "" {
 				p.Slug = p.ID
 			}
 			if canCollect {
 				// User already owns this post, so just add it to the given
 				// collection.
 				query = "UPDATE posts SET collection_id = ?, slug = ? WHERE id = ? AND owner_id = ?"
 				params = []interface{}{coll.ID, p.Slug, p.ID, userID}
 				slugIdx = 1
 			} else {
 				query = "UPDATE posts SET owner_id = ?, collection_id = ?, slug = ? WHERE id = ? AND modify_token = ? AND owner_id IS NULL"
 				params = []interface{}{userID, coll.ID, p.Slug, p.ID, p.Token}
 				slugIdx = 2
 			}
 		} else {
 			query = "UPDATE posts SET owner_id = ? WHERE id = ? AND modify_token = ? AND owner_id IS NULL"
 			params = []interface{}{userID, p.ID, p.Token}
 		}
 		qRes, err = db.AttemptClaim(&p, query, params, slugIdx)
 		if err != nil {
 			r.Code = http.StatusInternalServerError
 			r.ErrorMessage = "An unknown error occurred."
 			r.ID = p.ID
 			res = append(res, r)
 			log.Error("claimPosts (post %s): %v", p.ID, err)
 			continue
 		}
 
 		// Get full post information to return
 		var fullPost *PublicPost
 		if p.Token != "" {
 			fullPost, err = db.GetEditablePost(p.ID, p.Token)
 		} else {
 			fullPost, err = db.GetPost(p.ID, 0)
 		}
 		if err != nil {
 			if err, ok := err.(impart.HTTPError); ok {
 				r.Code = err.Status
 				r.ErrorMessage = err.Message
 				r.ID = p.ID
 				res = append(res, r)
 				continue
 			}
 		}
 		if fullPost.OwnerID.Int64 != userID {
 			r.Code = http.StatusConflict
 			r.ErrorMessage = "Post is already owned by someone else."
 			r.ID = p.ID
 			res = append(res, r)
 			continue
 		}
 
 		// Post was successfully claimed
 		r.Code = http.StatusOK
 		r.Post = fullPost
 		if coll != nil {
 			r.Post.Collection = &CollectionObj{Collection: *coll}
 		}
 
 		rowsAffected, _ := qRes.RowsAffected()
 		if rowsAffected == 0 {
 			// This was already claimed, but return 200
 			r.Code = http.StatusOK
 		}
 		res = append(res, r)
 	}
 
 	return &res, nil
 }
 
 func (db *datastore) UpdatePostPinState(pinned bool, postID string, collID, ownerID, pos int64) error {
 	if pos <= 0 || pos > 20 {
 		pos = db.GetLastPinnedPostPos(collID) + 1
 		if pos == -1 {
 			pos = 1
 		}
 	}
+	var res sql.Result
 	var err error
 	if pinned {
-		_, err = db.Exec("UPDATE posts SET pinned_position = ? WHERE id = ?", pos, postID)
+		res, err = db.Exec("UPDATE posts SET pinned_position = ? WHERE id = ? AND collection_id = ? AND owner_id = ?", pos, postID, collID, ownerID)
 	} else {
-		_, err = db.Exec("UPDATE posts SET pinned_position = NULL WHERE id = ?", postID)
+		res, err = db.Exec("UPDATE posts SET pinned_position = NULL WHERE id = ? AND collection_id = ? AND owner_id = ?", postID, collID, ownerID)
 	}
 	if err != nil {
 		log.Error("Unable to update pinned post: %v", err)
 		return err
 	}
+	rowsAffected, err := res.RowsAffected()
+	if err != nil {
+		log.Error("Unable to determine rows affected updating pinned post: %v", err)
+		return err
+	}
+	if rowsAffected == 0 {
+		return ErrForbiddenCollection
+	}
 	return nil
 }
 
 func (db *datastore) GetLastPinnedPostPos(collID int64) int64 {
 	var lastPos sql.NullInt64
 	err := db.QueryRow("SELECT MAX(pinned_position) FROM posts WHERE collection_id = ? AND pinned_position IS NOT NULL", collID).Scan(&lastPos)
 	switch {
 	case err == sql.ErrNoRows:
 		return -1
 	case err != nil:
 		log.Error("Failed selecting from posts: %v", err)
 		return -1
 	}
 	if !lastPos.Valid {
 		return -1
 	}
 	return lastPos.Int64
 }
 
 func (db *datastore) GetPinnedPosts(coll *CollectionObj, includeFuture bool) (*[]PublicPost, error) {
 	// FIXME: sqlite-backed instances don't include ellipsis on truncated titles
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= " + db.now()
 	}
 	rows, err := db.Query("SELECT id, slug, title, "+db.clip("content", 80)+", pinned_position FROM posts WHERE collection_id = ? AND pinned_position IS NOT NULL "+timeCondition+" ORDER BY pinned_position ASC", coll.ID)
 	if err != nil {
 		log.Error("Failed selecting pinned posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve pinned posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Title, &p.Content, &p.PinnedPosition)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 		p.augmentContent(&coll.Collection)
 
 		pp := p.processPost()
 		pp.Collection = coll
 		posts = append(posts, pp)
 	}
 	return &posts, nil
 }
 
 func (db *datastore) GetCollections(u *User, hostName string) (*[]Collection, error) {
-	rows, err := db.Query("SELECT id, alias, title, description, privacy, view_count FROM collections WHERE owner_id = ? ORDER BY id ASC", u.ID)
+	rows, err := db.Query("SELECT id, alias, title, description, style_sheet, script, privacy, view_count FROM collections WHERE owner_id = ? ORDER BY id ASC", u.ID)
 	if err != nil {
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user collections."}
 	}
 	defer rows.Close()
 
+	var styleVal, scriptVal sql.NullString
 	colls := []Collection{}
 	for rows.Next() {
 		c := Collection{}
-		err = rows.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &c.Visibility, &c.Views)
+		err = rows.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &styleVal, &scriptVal, &c.Visibility, &c.Views)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		c.hostName = hostName
 		c.URL = c.CanonicalURL()
 		c.Public = c.IsPublic()
+		c.StyleSheet = styleVal.String
+		c.Script = scriptVal.String
 
 		/*
 			// NOTE: future functionality
 			if visibility != nil { // TODO: && visibility == CollPublic {
 				// Add Monetization info when retrieving all public collections
 				c.Monetization = db.GetCollectionAttribute(c.ID, "monetization_pointer")
 			}
 		*/
 
 		colls = append(colls, c)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &colls, nil
 }
 
 func (db *datastore) GetPublishableCollections(u *User, hostName string) (*[]Collection, error) {
 	c, err := db.GetCollections(u, hostName)
 	if err != nil {
 		return nil, err
 	}
 
 	if len(*c) == 0 {
 		return nil, impart.HTTPError{http.StatusInternalServerError, "You don't seem to have any blogs; they might've moved to another account. Try logging out and logging into your other account."}
 	}
 	return c, nil
 }
 
 func (db *datastore) GetPublicCollections(hostName string) (*[]Collection, error) {
 	rows, err := db.Query(`SELECT c.id, alias, title, description, privacy, view_count
 	FROM collections c
 	LEFT JOIN users u ON u.id = c.owner_id
 	WHERE c.privacy = 1 AND u.status = 0
 	ORDER BY title ASC`)
 	if err != nil {
 		log.Error("Failed selecting public collections: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve public collections."}
 	}
 	defer rows.Close()
 
 	colls := []Collection{}
 	for rows.Next() {
 		c := Collection{}
 		err = rows.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &c.Visibility, &c.Views)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		c.hostName = hostName
 		c.URL = c.CanonicalURL()
 		c.Public = c.IsPublic()
 
 		// Add Monetization information
 		c.Monetization = db.GetCollectionAttribute(c.ID, "monetization_pointer")
 
 		colls = append(colls, c)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &colls, nil
 }
 
 func (db *datastore) GetMeStats(u *User) userMeStats {
 	s := userMeStats{}
 
 	// User counts
 	colls, _ := db.GetUserCollectionCount(u.ID)
 	s.TotalCollections = colls
 
 	var articles, collPosts uint64
 	err := db.QueryRow("SELECT COUNT(*) FROM posts WHERE owner_id = ? AND collection_id IS NULL", u.ID).Scan(&articles)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Couldn't get articles count for user %d: %v", u.ID, err)
 	}
 	s.TotalArticles = articles
 
 	err = db.QueryRow("SELECT COUNT(*) FROM posts WHERE owner_id = ? AND collection_id IS NOT NULL", u.ID).Scan(&collPosts)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Couldn't get coll posts count for user %d: %v", u.ID, err)
 	}
 	s.CollectionPosts = collPosts
 
 	return s
 }
 
 func (db *datastore) GetTotalCollections() (collCount int64, err error) {
 	err = db.QueryRow(`
 	SELECT COUNT(*)
 	FROM collections c
 	LEFT JOIN users u ON u.id = c.owner_id
 	WHERE u.status = 0`).Scan(&collCount)
 	if err != nil {
 		log.Error("Unable to fetch collections count: %v", err)
 	}
 	return
 }
 
 func (db *datastore) GetTotalPosts() (postCount int64, err error) {
 	err = db.QueryRow(`
 	SELECT COUNT(*)
 	FROM posts p
 	LEFT JOIN users u ON u.id = p.owner_id
 	WHERE u.status = 0`).Scan(&postCount)
 	if err != nil {
 		log.Error("Unable to fetch posts count: %v", err)
 	}
 	return
 }
 
 func (db *datastore) GetTopPosts(u *User, alias string, hostName string) (*[]PublicPost, error) {
 	params := []interface{}{u.ID}
 	where := ""
 	if alias != "" {
 		where = " AND alias = ?"
 		params = append(params, alias)
 	}
 	rows, err := db.Query("SELECT p.id, p.slug, p.view_count, p.title, p.content, c.alias, c.title, c.description, c.view_count FROM posts p LEFT JOIN collections c ON p.collection_id = c.id WHERE p.owner_id = ?"+where+" ORDER BY p.view_count DESC, created DESC LIMIT 25", params...)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user top posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	var gotErr bool
 	for rows.Next() {
 		p := Post{}
 		c := Collection{}
 		var alias, title, description sql.NullString
 		var views sql.NullInt64
 		err = rows.Scan(&p.ID, &p.Slug, &p.ViewCount, &p.Title, &p.Content, &alias, &title, &description, &views)
 		if err != nil {
 			log.Error("Failed scanning User.getPosts() row: %v", err)
 			gotErr = true
 			break
 		}
 		p.extractData()
 		pubPost := p.processPost()
 
 		if alias.Valid && alias.String != "" {
 			c.Alias = alias.String
 			c.Title = title.String
 			c.Description = description.String
 			c.Views = views.Int64
 			c.hostName = hostName
 			pubPost.Collection = &CollectionObj{Collection: c}
 		}
 		p.LikeCount, err = db.GetPostLikeCounts(p.ID)
 		if err != nil {
 			log.Error("Failed GetPostLikeCounts(%s): %v", p.ID, err)
 			gotErr = true
 			break
 		}
 
 		posts = append(posts, pubPost)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	if gotErr && len(posts) == 0 {
 		// There were a lot of errors
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Unable to get data."}
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetAnonymousPosts(u *User, page int) (*[]PublicPost, error) {
 	pagePosts := 10
 	start := page*pagePosts - pagePosts
 	if page == 0 {
 		start = 0
 		pagePosts = 1000
 	}
 
 	limitStr := ""
 	if page > 0 {
 		limitStr = fmt.Sprintf(" LIMIT %d, %d", start, pagePosts)
 	}
 	rows, err := db.Query("SELECT id, view_count, title, language, created, updated, content FROM posts WHERE owner_id = ? AND collection_id IS NULL ORDER BY created DESC"+limitStr, u.ID)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user anonymous posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := Post{}
 		err = rows.Scan(&p.ID, &p.ViewCount, &p.Title, &p.Language, &p.Created, &p.Updated, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 
 		posts = append(posts, p.processPost())
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetUserPosts(u *User) (*[]PublicPost, error) {
 	rows, err := db.Query("SELECT p.id, p.slug, p.view_count, p.title, p.created, p.updated, p.content, p.text_appearance, p.language, p.rtl, c.alias, c.title, c.description, c.view_count FROM posts p LEFT JOIN collections c ON collection_id = c.id WHERE p.owner_id = ? ORDER BY created ASC", u.ID)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	var gotErr bool
 	for rows.Next() {
 		p := Post{}
 		c := Collection{}
 		var alias, title, description sql.NullString
 		var views sql.NullInt64
 		err = rows.Scan(&p.ID, &p.Slug, &p.ViewCount, &p.Title, &p.Created, &p.Updated, &p.Content, &p.Font, &p.Language, &p.RTL, &alias, &title, &description, &views)
 		if err != nil {
 			log.Error("Failed scanning User.getPosts() row: %v", err)
 			gotErr = true
 			break
 		}
 		p.extractData()
 		pubPost := p.processPost()
 
 		if alias.Valid && alias.String != "" {
 			c.Alias = alias.String
 			c.Title = title.String
 			c.Description = description.String
 			c.Views = views.Int64
 			pubPost.Collection = &CollectionObj{Collection: c}
 		}
 
 		posts = append(posts, pubPost)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	if gotErr && len(posts) == 0 {
 		// There were a lot of errors
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Unable to get data."}
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetUserPostsCount(userID int64) int64 {
 	var count int64
 	err := db.QueryRow("SELECT COUNT(*) FROM posts WHERE owner_id = ?", userID).Scan(&count)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0
 	case err != nil:
 		log.Error("Failed selecting posts count for user %d: %v", userID, err)
 		return 0
 	}
 
 	return count
 }
 
 // ChangeSettings takes a User and applies the changes in the given
 // userSettings, MODIFYING THE USER with successful changes.
 func (db *datastore) ChangeSettings(app *App, u *User, s *userSettings) error {
 	var errPass error
 	q := query.NewUpdate()
 
 	// Update email if given
 	if s.Email != "" {
 		encEmail, err := data.Encrypt(app.keys.EmailKey, s.Email)
 		if err != nil {
 			log.Error("Couldn't encrypt email %s: %s\n", s.Email, err)
 			return impart.HTTPError{http.StatusInternalServerError, "Unable to encrypt email address."}
 		}
 		q.SetBytes(encEmail, "email")
 
 		// Update the email if something goes awry updating the password
 		defer func() {
 			if errPass != nil {
 				db.UpdateEncryptedUserEmail(u.ID, encEmail)
 			}
 		}()
 		u.Email = zero.StringFrom(s.Email)
 	}
 
 	// Update username if given
 	var newUsername string
 	if s.Username != "" {
 		var ie *impart.HTTPError
 		newUsername, ie = getValidUsername(app, s.Username, u.Username)
 		if ie != nil {
 			// Username is invalid
 			return *ie
 		}
 		if !author.IsValidUsername(app.cfg, newUsername) {
 			// Ensure the username is syntactically correct.
 			return impart.HTTPError{http.StatusPreconditionFailed, "Username isn't valid."}
 		}
 
 		t, err := db.Begin()
 		if err != nil {
 			log.Error("Couldn't start username change transaction: %v", err)
 			return err
 		}
 
 		_, err = t.Exec("UPDATE users SET username = ? WHERE id = ?", newUsername, u.ID)
 		if err != nil {
 			t.Rollback()
 			if db.isDuplicateKeyErr(err) {
 				return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 			}
 			log.Error("Unable to update users table: %v", err)
 			return ErrInternalGeneral
 		}
 
 		_, err = t.Exec("UPDATE collections SET alias = ? WHERE alias = ? AND owner_id = ?", newUsername, u.Username, u.ID)
 		if err != nil {
 			t.Rollback()
 			if db.isDuplicateKeyErr(err) {
 				return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 			}
 			log.Error("Unable to update collection: %v", err)
 			return ErrInternalGeneral
 		}
 
 		// Keep track of name changes for redirection
 		db.RemoveCollectionRedirect(t, newUsername)
 		_, err = t.Exec("UPDATE collectionredirects SET new_alias = ? WHERE new_alias = ?", newUsername, u.Username)
 		if err != nil {
 			log.Error("Unable to update collectionredirects: %v", err)
 		}
 		_, err = t.Exec("INSERT INTO collectionredirects (prev_alias, new_alias) VALUES (?, ?)", u.Username, newUsername)
 		if err != nil {
 			log.Error("Unable to add new collectionredirect: %v", err)
 		}
 
 		err = t.Commit()
 		if err != nil {
 			t.Rollback()
 			log.Error("Rolling back after Commit(): %v\n", err)
 			return err
 		}
 
 		u.Username = newUsername
 	}
 
 	// Update passphrase if given
 	if s.NewPass != "" {
 		// Check if user has already set a password
 		var err error
 		u.HasPass, err = db.IsUserPassSet(u.ID)
 		if err != nil {
 			errPass = impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data."}
 			return errPass
 		}
 
 		if len(s.NewPass) > maxPassByteLen {
 			errPass = impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Password is longer than %d characters", maxPassByteLen)}
 			return errPass
 		}
 
 		if u.HasPass {
 			// Check if currently-set password is correct
 			hashedPass := u.HashedPass
 			if len(hashedPass) == 0 {
 				authUser, err := db.GetUserForAuthByID(u.ID)
 				if err != nil {
 					errPass = err
 					return errPass
 				}
 				hashedPass = authUser.HashedPass
 			}
 			if !auth.Authenticated(hashedPass, []byte(s.OldPass)) {
 				errPass = impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 				return errPass
 			}
 		}
 		hashedPass, err := auth.HashPass([]byte(s.NewPass))
 		if err != nil {
 			errPass = impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 			return errPass
 		}
 		q.SetBytes(hashedPass, "password")
 	}
 
 	// WHERE values
 	q.Append(u.ID)
 
 	if q.Updates == "" {
 		if s.Username == "" {
 			return ErrPostNoUpdatableVals
 		}
 
 		// Nothing to update except username. That was successful, so return now.
 		return nil
 	}
 
 	res, err := db.Exec("UPDATE users SET "+q.Updates+" WHERE id = ?", q.Params...)
 	if err != nil {
 		log.Error("Unable to update collection: %v", err)
 		return err
 	}
 
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		// Show the correct error message if nothing was updated
 		var dummy int
 		err := db.QueryRow("SELECT 1 FROM users WHERE id = ?", u.ID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return ErrUnauthorizedGeneral
 		case err != nil:
 			log.Error("Failed selecting from users: %v", err)
 		}
 		return nil
 	}
 
 	if s.NewPass != "" && !u.HasPass {
 		u.HasPass = true
 	}
 
 	return nil
 }
 
 func (db *datastore) ChangePassphrase(userID int64, sudo bool, curPass string, hashedPass []byte) error {
 	var dbPass []byte
 	err := db.QueryRow("SELECT password FROM users WHERE id = ?", userID).Scan(&dbPass)
 	switch {
 	case err == sql.ErrNoRows:
 		return ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user password for change: %v", err)
 		return err
 	}
 
 	if !sudo && !auth.Authenticated(dbPass, []byte(curPass)) {
 		return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 	}
 
 	_, err = db.Exec("UPDATE users SET password = ? WHERE id = ?", hashedPass, userID)
 	if err != nil {
 		log.Error("Could not update passphrase: %v", err)
 		return err
 	}
 
 	return nil
 }
 
 func (db *datastore) RemoveCollectionRedirect(t *sql.Tx, alias string) error {
 	_, err := t.Exec("DELETE FROM collectionredirects WHERE prev_alias = ?", alias)
 	if err != nil {
 		log.Error("Unable to delete from collectionredirects: %v", err)
 		return err
 	}
 	return nil
 }
 
 func (db *datastore) GetCollectionRedirect(alias string) (new string) {
 	row := db.QueryRow("SELECT new_alias FROM collectionredirects WHERE prev_alias = ?", alias)
 	err := row.Scan(&new)
 	if err != nil && err != sql.ErrNoRows && !db.isIgnorableError(err) {
 		log.Error("Failed selecting from collectionredirects: %v", err)
 	}
 	return
 }
 
 func (db *datastore) DeleteCollection(alias string, userID int64) error {
 	c := &Collection{Alias: alias}
 	var username string
 
 	row := db.QueryRow("SELECT username FROM users WHERE id = ?", userID)
 	err := row.Scan(&username)
 	if err != nil {
 		return err
 	}
 
 	// Ensure user isn't deleting their main blog
 	if alias == username {
 		return impart.HTTPError{http.StatusForbidden, "You cannot currently delete your primary blog."}
 	}
 
 	row = db.QueryRow("SELECT id FROM collections WHERE alias = ? AND owner_id = ?", alias, userID)
 	err = row.Scan(&c.ID)
 	switch {
 	case err == sql.ErrNoRows:
 		return impart.HTTPError{http.StatusNotFound, "Collection doesn't exist or you're not allowed to delete it."}
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return ErrInternalGeneral
 	}
 
 	t, err := db.Begin()
 	if err != nil {
 		return err
 	}
 
 	// Float all collection's posts
 	_, err = t.Exec("UPDATE posts SET collection_id = NULL WHERE collection_id = ? AND owner_id = ?", c.ID, userID)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	// Remove redirects to or from this collection
 	_, err = t.Exec("DELETE FROM collectionredirects WHERE prev_alias = ? OR new_alias = ?", alias, alias)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	// Remove any optional collection password
 	_, err = t.Exec("DELETE FROM collectionpasswords WHERE collection_id = ?", c.ID)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	// Finally, delete collection itself
 	_, err = t.Exec("DELETE FROM collections WHERE id = ?", c.ID)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	err = t.Commit()
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	return nil
 }
 
 func (db *datastore) IsCollectionAttributeOn(id int64, attr string) bool {
 	var v string
 	err := db.QueryRow("SELECT value FROM collectionattributes WHERE collection_id = ? AND attribute = ?", id, attr).Scan(&v)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Couldn't SELECT value in isCollectionAttributeOn for attribute '%s': %v", attr, err)
 		return false
 	}
 	return v == "1"
 }
 
 func (db *datastore) CollectionHasAttribute(id int64, attr string) bool {
 	var dummy string
 	err := db.QueryRow("SELECT value FROM collectionattributes WHERE collection_id = ? AND attribute = ?", id, attr).Scan(&dummy)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Couldn't SELECT value in collectionHasAttribute for attribute '%s': %v", attr, err)
 		return false
 	}
 	return true
 }
 
 func (db *datastore) GetCollectionAttribute(id int64, attr string) string {
 	var v string
 	err := db.QueryRow("SELECT value FROM collectionattributes WHERE collection_id = ? AND attribute = ?", id, attr).Scan(&v)
 	switch {
 	case err == sql.ErrNoRows:
 		return ""
 	case err != nil:
 		log.Error("Couldn't SELECT value in getCollectionAttribute for attribute '%s': %v", attr, err)
 		return ""
 	}
 	return v
 }
 
 func (db *datastore) SetCollectionAttribute(id int64, attr, v string) error {
 	_, err := db.Exec("INSERT INTO collectionattributes (collection_id, attribute, value) VALUES (?, ?, ?) "+db.upsert("collection_id", "attribute")+" value = ?", id, attr, v, v)
 	if err != nil {
 		log.Error("Unable to INSERT into collectionattributes: %v", err)
 		return err
 	}
 	return nil
 }
 
 // DeleteAccount will delete the entire account for userID
 func (db *datastore) DeleteAccount(userID int64) error {
 	// Get all collections
 	rows, err := db.Query("SELECT id, alias FROM collections WHERE owner_id = ?", userID)
 	if err != nil {
 		log.Error("Unable to get collections: %v", err)
 		return err
 	}
 	defer rows.Close()
 	colls := []Collection{}
 	var c Collection
 	for rows.Next() {
 		err = rows.Scan(&c.ID, &c.Alias)
 		if err != nil {
 			log.Error("Unable to scan collection cols: %v", err)
 			return err
 		}
 		colls = append(colls, c)
 	}
 
 	// Start transaction
 	t, err := db.Begin()
 	if err != nil {
 		log.Error("Unable to begin: %v", err)
 		return err
 	}
 
 	// Clean up all collection related information
 	var res sql.Result
 	for _, c := range colls {
 		// Delete tokens
 		res, err = t.Exec("DELETE FROM collectionattributes WHERE collection_id = ?", c.ID)
 		if err != nil {
 			t.Rollback()
 			log.Error("Unable to delete attributes on %s: %v", c.Alias, err)
 			return err
 		}
 		rs, _ := res.RowsAffected()
 		log.Info("Deleted %d for %s from collectionattributes", rs, c.Alias)
 
 		// Remove any optional collection password
 		res, err = t.Exec("DELETE FROM collectionpasswords WHERE collection_id = ?", c.ID)
 		if err != nil {
 			t.Rollback()
 			log.Error("Unable to delete passwords on %s: %v", c.Alias, err)
 			return err
 		}
 		rs, _ = res.RowsAffected()
 		log.Info("Deleted %d for %s from collectionpasswords", rs, c.Alias)
 
 		// Remove redirects to this collection
 		res, err = t.Exec("DELETE FROM collectionredirects WHERE new_alias = ?", c.Alias)
 		if err != nil {
 			t.Rollback()
 			log.Error("Unable to delete redirects on %s: %v", c.Alias, err)
 			return err
 		}
 		rs, _ = res.RowsAffected()
 		log.Info("Deleted %d for %s from collectionredirects", rs, c.Alias)
 
 		// Remove any collection keys
 		res, err = t.Exec("DELETE FROM collectionkeys WHERE collection_id = ?", c.ID)
 		if err != nil {
 			t.Rollback()
 			log.Error("Unable to delete keys on %s: %v", c.Alias, err)
 			return err
 		}
 		rs, _ = res.RowsAffected()
 		log.Info("Deleted %d for %s from collectionkeys", rs, c.Alias)
 
 		// TODO: federate delete collection
 
 		// Remove remote follows
 		res, err = t.Exec("DELETE FROM remotefollows WHERE collection_id = ?", c.ID)
 		if err != nil {
 			t.Rollback()
 			log.Error("Unable to delete remote follows on %s: %v", c.Alias, err)
 			return err
 		}
 		rs, _ = res.RowsAffected()
 		log.Info("Deleted %d for %s from remotefollows", rs, c.Alias)
 	}
 
 	// Delete collections
 	res, err = t.Exec("DELETE FROM collections WHERE owner_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete collections: %v", err)
 		return err
 	}
 	rs, _ := res.RowsAffected()
 	log.Info("Deleted %d from collections", rs)
 
 	// Delete tokens
 	res, err = t.Exec("DELETE FROM accesstokens WHERE user_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete access tokens: %v", err)
 		return err
 	}
 	rs, _ = res.RowsAffected()
 	log.Info("Deleted %d from accesstokens", rs)
 
 	// Delete user attributes
 	res, err = t.Exec("DELETE FROM oauth_users WHERE user_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete oauth_users: %v", err)
 		return err
 	}
 	rs, _ = res.RowsAffected()
 	log.Info("Deleted %d from oauth_users", rs)
 
 	// Delete posts
 	// TODO: should maybe get each row so we can federate a delete
 	// if so needs to be outside of transaction like collections
 	res, err = t.Exec("DELETE FROM posts WHERE owner_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete posts: %v", err)
 		return err
 	}
 	rs, _ = res.RowsAffected()
 	log.Info("Deleted %d from posts", rs)
 
 	// Delete user attributes
 	res, err = t.Exec("DELETE FROM userattributes WHERE user_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete attributes: %v", err)
 		return err
 	}
 	rs, _ = res.RowsAffected()
 	log.Info("Deleted %d from userattributes", rs)
 
 	// Delete user invites
 	res, err = t.Exec("DELETE FROM userinvites WHERE owner_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete invites: %v", err)
 		return err
 	}
 	rs, _ = res.RowsAffected()
 	log.Info("Deleted %d from userinvites", rs)
 
 	// Delete the user
 	res, err = t.Exec("DELETE FROM users WHERE id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to delete user: %v", err)
 		return err
 	}
 	rs, _ = res.RowsAffected()
 	log.Info("Deleted %d from users", rs)
 
 	// Commit all changes to the database
 	err = t.Commit()
 	if err != nil {
 		t.Rollback()
 		log.Error("Unable to commit: %v", err)
 		return err
 	}
 
 	// TODO: federate delete actor
 
 	return nil
 }
 
 func (db *datastore) GetAPActorKeys(collectionID int64) ([]byte, []byte) {
 	var pub, priv []byte
 	err := db.QueryRow("SELECT public_key, private_key FROM collectionkeys WHERE collection_id = ?", collectionID).Scan(&pub, &priv)
 	switch {
 	case err == sql.ErrNoRows:
 		// Generate keys
 		pub, priv = activitypub.GenerateKeys()
 		_, err = db.Exec("INSERT INTO collectionkeys (collection_id, public_key, private_key) VALUES (?, ?, ?)", collectionID, pub, priv)
 		if err != nil {
 			log.Error("Unable to INSERT new activitypub keypair: %v", err)
 			return nil, nil
 		}
 	case err != nil:
 		log.Error("Couldn't SELECT collectionkeys: %v", err)
 		return nil, nil
 	}
 
 	return pub, priv
 }
 
 func (db *datastore) CreateUserInvite(id string, userID int64, maxUses int, expires *time.Time) error {
 	_, err := db.Exec("INSERT INTO userinvites (id, owner_id, max_uses, created, expires, inactive) VALUES (?, ?, ?, "+db.now()+", ?, 0)", id, userID, maxUses, expires)
 	return err
 }
 
 func (db *datastore) GetUserInvites(userID int64) (*[]Invite, error) {
 	rows, err := db.Query("SELECT id, max_uses, created, expires, inactive FROM userinvites WHERE owner_id = ? ORDER BY created DESC", userID)
 	if err != nil {
 		log.Error("Failed selecting from userinvites: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user invites."}
 	}
 	defer rows.Close()
 
 	is := []Invite{}
 	for rows.Next() {
 		i := Invite{}
 		err = rows.Scan(&i.ID, &i.MaxUses, &i.Created, &i.Expires, &i.Inactive)
 		is = append(is, i)
 	}
 	return &is, nil
 }
 
 func (db *datastore) GetUserInvite(id string) (*Invite, error) {
 	var i Invite
 	err := db.QueryRow("SELECT id, max_uses, created, expires, inactive FROM userinvites WHERE id = ?", id).Scan(&i.ID, &i.MaxUses, &i.Created, &i.Expires, &i.Inactive)
 	switch {
 	case err == sql.ErrNoRows, db.isIgnorableError(err):
 		return nil, impart.HTTPError{http.StatusNotFound, "Invite doesn't exist."}
 	case err != nil:
 		log.Error("Failed selecting invite: %v", err)
 		return nil, err
 	}
 
 	return &i, nil
 }
 
 // IsUsersInvite returns true if the user with ID created the invite with code
 // and an error other than sql no rows, if any. Will return false in the event
 // of an error.
 func (db *datastore) IsUsersInvite(code string, userID int64) (bool, error) {
 	var id string
 	err := db.QueryRow("SELECT id FROM userinvites WHERE id = ? AND owner_id = ?", code, userID).Scan(&id)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Failed selecting invite: %v", err)
 		return false, err
 	}
 	return id != "", nil
 }
 
 func (db *datastore) GetUsersInvitedCount(id string) int64 {
 	var count int64
 	err := db.QueryRow("SELECT COUNT(*) FROM usersinvited WHERE invite_id = ?", id).Scan(&count)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0
 	case err != nil:
 		log.Error("Failed selecting users invited count: %v", err)
 		return 0
 	}
 
 	return count
 }
 
 func (db *datastore) CreateInvitedUser(inviteID string, userID int64) error {
 	_, err := db.Exec("INSERT INTO usersinvited (invite_id, user_id) VALUES (?, ?)", inviteID, userID)
 	return err
 }
 
 func (db *datastore) GetInstancePages() ([]*instanceContent, error) {
 	return db.GetAllDynamicContent("page")
 }
 
 func (db *datastore) GetAllDynamicContent(t string) ([]*instanceContent, error) {
 	where := ""
 	params := []interface{}{}
 	if t != "" {
 		where = " WHERE content_type = ?"
 		params = append(params, t)
 	}
 	rows, err := db.Query("SELECT id, title, content, updated, content_type FROM appcontent"+where, params...)
 	if err != nil {
 		log.Error("Failed selecting from appcontent: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve instance pages."}
 	}
 	defer rows.Close()
 
 	pages := []*instanceContent{}
 	for rows.Next() {
 		c := &instanceContent{}
 		err = rows.Scan(&c.ID, &c.Title, &c.Content, &c.Updated, &c.Type)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		pages = append(pages, c)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return pages, nil
 }
 
 func (db *datastore) GetDynamicContent(id string) (*instanceContent, error) {
 	c := &instanceContent{
 		ID: id,
 	}
 	err := db.QueryRow("SELECT title, content, updated, content_type FROM appcontent WHERE id = ?", id).Scan(&c.Title, &c.Content, &c.Updated, &c.Type)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, nil
 	case err != nil:
 		log.Error("Couldn't SELECT FROM appcontent for id '%s': %v", id, err)
 		return nil, err
 	}
 	return c, nil
 }
 
 func (db *datastore) UpdateDynamicContent(id, title, content, contentType string) error {
 	var err error
 	if db.driverName == driverSQLite {
 		_, err = db.Exec("INSERT OR REPLACE INTO appcontent (id, title, content, updated, content_type) VALUES (?, ?, ?, "+db.now()+", ?)", id, title, content, contentType)
 	} else {
 		_, err = db.Exec("INSERT INTO appcontent (id, title, content, updated, content_type) VALUES (?, ?, ?, "+db.now()+", ?) "+db.upsert("id")+" title = ?, content = ?, updated = "+db.now(), id, title, content, contentType, title, content)
 	}
 	if err != nil {
 		log.Error("Unable to INSERT appcontent for '%s': %v", id, err)
 	}
 	return err
 }
 
 func (db *datastore) GetAllUsers(page uint) (*[]User, error) {
 	limitStr := fmt.Sprintf("0, %d", adminUsersPerPage)
 	if page > 1 {
 		limitStr = fmt.Sprintf("%d, %d", (page-1)*adminUsersPerPage, adminUsersPerPage)
 	}
 
 	rows, err := db.Query("SELECT id, username, created, status FROM users ORDER BY created DESC LIMIT " + limitStr)
 	if err != nil {
 		log.Error("Failed selecting from users: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve all users."}
 	}
 	defer rows.Close()
 
 	users := []User{}
 	for rows.Next() {
 		u := User{}
 		err = rows.Scan(&u.ID, &u.Username, &u.Created, &u.Status)
 		if err != nil {
 			log.Error("Failed scanning GetAllUsers() row: %v", err)
 			break
 		}
 		users = append(users, u)
 	}
 	return &users, nil
 }
 
 func (db *datastore) GetAllUsersCount() int64 {
 	var count int64
 	err := db.QueryRow("SELECT COUNT(*) FROM users").Scan(&count)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0
 	case err != nil:
 		log.Error("Failed selecting all users count: %v", err)
 		return 0
 	}
 
 	return count
 }
 
+// GetUsersFiltered returns users matching the given filters, each paired with
+// their post count. It intentionally omits pagination: it's used by the `users`
+// moderation command, which needs the full matching set in a single pass.
+// Admins are excluded unless f.IncludeAdmins is set (listing only) so bulk
+// silence/delete actions can never affect them.
+func (db *datastore) GetUsersFiltered(f UserFilter) ([]FilteredUser, error) {
+	var where []string
+	var params []interface{}
+
+	if !f.IncludeAdmins {
+		where = append(where, "u.id != 1")
+	}
+
+	if f.Since != nil {
+		where = append(where, "u.created >= ?")
+		params = append(params, *f.Since)
+	}
+	if f.Until != nil {
+		where = append(where, "u.created < ?")
+		params = append(params, *f.Until)
+	}
+	if f.NoInvite {
+		where = append(where, "NOT EXISTS (SELECT 1 FROM usersinvited i WHERE i.user_id = u.id)")
+	}
+	if f.NoOAuth {
+		where = append(where, "NOT EXISTS (SELECT 1 FROM oauth_users o WHERE o.user_id = u.id)")
+	}
+	if f.MaxPosts >= 0 {
+		where = append(where, "(SELECT COUNT(*) FROM posts p WHERE p.owner_id = u.id) <= ?")
+		params = append(params, f.MaxPosts)
+	}
+
+	q := "SELECT u.id, u.username, u.created, u.status, " +
+		"(SELECT COUNT(*) FROM posts p WHERE p.owner_id = u.id) AS post_count " +
+		"FROM users u"
+	if len(where) > 0 {
+		q += " WHERE " + strings.Join(where, " AND ")
+	}
+	q += " ORDER BY u.created ASC"
+
+	rows, err := db.Query(q, params...)
+	if err != nil {
+		log.Error("Failed selecting filtered users: %v", err)
+		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve users."}
+	}
+	defer rows.Close()
+
+	users := []FilteredUser{}
+	for rows.Next() {
+		fu := FilteredUser{User: &User{}}
+		err = rows.Scan(&fu.User.ID, &fu.User.Username, &fu.User.Created, &fu.User.Status, &fu.PostCount)
+		if err != nil {
+			log.Error("Failed scanning GetUsersFiltered() row: %v", err)
+			return nil, err
+		}
+		users = append(users, fu)
+	}
+	return users, nil
+}
+
 func (db *datastore) GetUserLastPostTime(id int64) (*time.Time, error) {
 	var t time.Time
 	err := db.QueryRow("SELECT created FROM posts WHERE owner_id = ? ORDER BY created DESC LIMIT 1", id).Scan(&t)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, nil
 	case err != nil:
 		log.Error("Failed selecting last post time from posts: %v", err)
 		return nil, err
 	}
 	return &t, nil
 }
 
 // SetUserStatus changes a user's status in the database. see Users.UserStatus
 func (db *datastore) SetUserStatus(id int64, status UserStatus) error {
 	_, err := db.Exec("UPDATE users SET status = ? WHERE id = ?", status, id)
 	if err != nil {
 		return fmt.Errorf("failed to update user status: %v", err)
 	}
 	return nil
 }
 
 func (db *datastore) GetCollectionLastPostTime(id int64) (*time.Time, error) {
 	var t time.Time
 	err := db.QueryRow("SELECT created FROM posts WHERE collection_id = ? ORDER BY created DESC LIMIT 1", id).Scan(&t)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, nil
 	case err != nil:
 		log.Error("Failed selecting last post time from posts: %v", err)
 		return nil, err
 	}
 	return &t, nil
 }
 
 func (db *datastore) GenerateOAuthState(ctx context.Context, provider string, clientID string, attachUser int64, inviteCode string) (string, error) {
 	state := id.Generate62RandomString(24)
 	attachUserVal := sql.NullInt64{Valid: attachUser > 0, Int64: attachUser}
 	inviteCodeVal := sql.NullString{Valid: inviteCode != "", String: inviteCode}
 	_, err := db.ExecContext(ctx, "INSERT INTO oauth_client_states (state, provider, client_id, used, created_at, attach_user_id, invite_code) VALUES (?, ?, ?, FALSE, "+db.now()+", ?, ?)", state, provider, clientID, attachUserVal, inviteCodeVal)
 	if err != nil {
 		return "", fmt.Errorf("unable to record oauth client state: %w", err)
 	}
 	return state, nil
 }
 
 func (db *datastore) ValidateOAuthState(ctx context.Context, state string) (string, string, int64, string, error) {
 	var provider string
 	var clientID string
 	var attachUserID sql.NullInt64
 	var inviteCode sql.NullString
 	err := wf_db.RunTransactionWithOptions(ctx, db.DB, &sql.TxOptions{}, func(ctx context.Context, tx *sql.Tx) error {
 		err := tx.
 			QueryRowContext(ctx, "SELECT provider, client_id, attach_user_id, invite_code FROM oauth_client_states WHERE state = ? AND used = FALSE", state).
 			Scan(&provider, &clientID, &attachUserID, &inviteCode)
 		if err != nil {
 			return err
 		}
 
 		res, err := tx.ExecContext(ctx, "UPDATE oauth_client_states SET used = TRUE WHERE state = ?", state)
 		if err != nil {
 			return err
 		}
 		rowsAffected, err := res.RowsAffected()
 		if err != nil {
 			return err
 		}
 		if rowsAffected != 1 {
 			return fmt.Errorf("state not found")
 		}
 		return nil
 	})
 	if err != nil {
 		return "", "", 0, "", nil
 	}
 	return provider, clientID, attachUserID.Int64, inviteCode.String, nil
 }
 
 func (db *datastore) RecordRemoteUserID(ctx context.Context, localUserID int64, remoteUserID, provider, clientID, accessToken string) error {
 	var err error
 	if db.driverName == driverSQLite {
 		_, err = db.ExecContext(ctx, "INSERT OR REPLACE INTO oauth_users (user_id, remote_user_id, provider, client_id, access_token) VALUES (?, ?, ?, ?, ?)", localUserID, remoteUserID, provider, clientID, accessToken)
 	} else {
 		_, err = db.ExecContext(ctx, "INSERT INTO oauth_users (user_id, remote_user_id, provider, client_id, access_token) VALUES (?, ?, ?, ?, ?) "+db.upsert("user")+" access_token = ?", localUserID, remoteUserID, provider, clientID, accessToken, accessToken)
 	}
 	if err != nil {
 		log.Error("Unable to INSERT oauth_users for '%d': %v", localUserID, err)
 	}
 	return err
 }
 
 // GetIDForRemoteUser returns a user ID associated with a remote user ID.
 func (db *datastore) GetIDForRemoteUser(ctx context.Context, remoteUserID, provider, clientID string) (int64, error) {
 	var userID int64 = -1
 	err := db.
 		QueryRowContext(ctx, "SELECT user_id FROM oauth_users WHERE remote_user_id = ? AND provider = ? AND client_id = ?", remoteUserID, provider, clientID).
 		Scan(&userID)
 	// Not finding a record is OK.
 	if err != nil && err != sql.ErrNoRows {
 		return -1, err
 	}
 	return userID, nil
 }
 
 type oauthAccountInfo struct {
 	Provider        string
 	ClientID        string
 	RemoteUserID    string
 	DisplayName     string
 	AllowDisconnect bool
 }
 
 func (db *datastore) GetOauthAccounts(ctx context.Context, userID int64) ([]oauthAccountInfo, error) {
 	rows, err := db.QueryContext(ctx, "SELECT provider, client_id, remote_user_id FROM oauth_users WHERE user_id = ? ", userID)
 	if err != nil {
 		log.Error("Failed selecting from oauth_users: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user oauth accounts."}
 	}
 	defer rows.Close()
 
 	var records []oauthAccountInfo
 	for rows.Next() {
 		info := oauthAccountInfo{}
 		err = rows.Scan(&info.Provider, &info.ClientID, &info.RemoteUserID)
 		if err != nil {
 			log.Error("Failed scanning GetAllUsers() row: %v", err)
 			break
 		}
 		records = append(records, info)
 	}
 	return records, nil
 }
 
 // DatabaseInitialized returns whether or not the current datastore has been
 // initialized with the correct schema.
 // Currently, it checks to see if the `users` table exists.
 func (db *datastore) DatabaseInitialized() bool {
 	var dummy string
 	var err error
 	if db.driverName == driverSQLite {
 		err = db.QueryRow("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'users'").Scan(&dummy)
 	} else {
 		err = db.QueryRow("SHOW TABLES LIKE 'users'").Scan(&dummy)
 	}
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Couldn't SHOW TABLES: %v", err)
 		return false
 	}
 
 	return true
 }
 
 func (db *datastore) RemoveOauth(ctx context.Context, userID int64, provider string, clientID string, remoteUserID string) error {
 	_, err := db.ExecContext(ctx, `DELETE FROM oauth_users WHERE user_id = ? AND provider = ? AND client_id = ? AND remote_user_id = ?`, userID, provider, clientID, remoteUserID)
 	return err
 }
 
 func stringLogln(log *string, s string, v ...interface{}) {
 	*log += fmt.Sprintf(s+"\n", v...)
 }
 
 func handleFailedPostInsert(err error) error {
 	log.Error("Couldn't insert into posts: %v", err)
 	return err
 }
 
 // Deprecated: use GetProfileURLFromHandle() instead, which returns user-facing URL instead of actor_id
 func (db *datastore) GetProfilePageFromHandle(app *App, handle string) (string, error) {
 	handle = strings.TrimLeft(handle, "@")
 	actorIRI := ""
 	parts := strings.Split(handle, "@")
 	if len(parts) != 2 {
 		return "", fmt.Errorf("invalid handle format")
 	}
 	domain := parts[1]
 
 	// Check non-AP instances
 	if siloProfileURL := silobridge.Profile(parts[0], domain); siloProfileURL != "" {
 		return siloProfileURL, nil
 	}
 
 	remoteUser, err := getRemoteUserFromHandle(app, handle)
 	if err != nil {
 		// can't find using handle in the table but the table may already have this user without
 		// handle from a previous version
 		// TODO: Make this determination. We should know whether a user exists without a handle, or doesn't exist at all
 		actorIRI = RemoteLookup(handle)
 		_, errRemoteUser := getRemoteUser(app, actorIRI)
 		// if it exists then we need to update the handle
 		if errRemoteUser == nil {
 			_, err := app.db.Exec("UPDATE remoteusers SET handle = ? WHERE actor_id = ?", handle, actorIRI)
 			if err != nil {
 				log.Error("Couldn't update handle '%s' for user %s", handle, actorIRI)
 			}
 		} else {
 			// this probably means we don't have the user in the table so let's try to insert it
 			// here we need to ask the server for the inboxes
 			remoteActor, err := activityserve.NewRemoteActor(actorIRI)
 			if err != nil {
 				log.Error("Couldn't fetch remote actor: %v", err)
 			}
 			if debugging {
 				log.Info("%s %s %s %s", actorIRI, remoteActor.GetInbox(), remoteActor.GetSharedInbox(), handle)
 			}
 			_, err = app.db.Exec("INSERT INTO remoteusers (actor_id, inbox, shared_inbox, handle) VALUES(?, ?, ?, ?)", actorIRI, remoteActor.GetInbox(), remoteActor.GetSharedInbox(), handle)
 			if err != nil {
 				log.Error("Couldn't insert remote user: %v", err)
 				return "", err
 			}
 		}
 	} else {
 		actorIRI = remoteUser.ActorID
 	}
 	return actorIRI, nil
 }
 
 func (db *datastore) AddEmailSubscription(collID, userID int64, email string, confirmed bool) (*EmailSubscriber, error) {
 	friendlyChars := "0123456789BCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz"
 	subID := id.GenerateRandomString(friendlyChars, 8)
 	token := id.GenerateRandomString(friendlyChars, 16)
 	emailVal := sql.NullString{
 		String: email,
 		Valid:  email != "",
 	}
 	userIDVal := sql.NullInt64{
 		Int64: userID,
 		Valid: userID > 0,
 	}
 
 	_, err := db.Exec("INSERT INTO emailsubscribers (id, collection_id, user_id, email, subscribed, token, confirmed) VALUES (?, ?, ?, ?, "+db.now()+", ?, ?)", subID, collID, userIDVal, emailVal, token, confirmed)
 	if err != nil {
 		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 			if mysqlErr.Number == mySQLErrDuplicateKey {
 				// Duplicate, so just return existing subscriber information
 				log.Info("Duplicate subscriber for email %s, user %d; returning existing subscriber", email, userID)
 				return db.FetchEmailSubscriber(email, userID, collID)
 			}
 		}
 		return nil, err
 	}
 
 	return &EmailSubscriber{
 		ID:     subID,
 		CollID: collID,
 		UserID: userIDVal,
 		Email:  emailVal,
 		Token:  token,
 	}, nil
 }
 
 func (db *datastore) IsEmailSubscriber(email string, userID, collID int64) bool {
 	var dummy int
 	var err error
 	if email != "" {
 		err = db.QueryRow("SELECT 1 FROM emailsubscribers WHERE email = ? AND collection_id = ?", email, collID).Scan(&dummy)
 	} else {
 		err = db.QueryRow("SELECT 1 FROM emailsubscribers WHERE user_id = ? AND collection_id = ?", userID, collID).Scan(&dummy)
 	}
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		return false
 	}
 	return true
 }
 
 func (db *datastore) GetEmailSubscribers(collID int64, reqConfirmed bool) ([]*EmailSubscriber, error) {
 	cond := ""
 	if reqConfirmed {
 		cond = " AND confirmed = 1"
 	}
 	rows, err := db.Query(`SELECT s.id, collection_id, user_id, s.email, u.email, subscribed, token, confirmed, allow_export
 FROM emailsubscribers s
 LEFT JOIN users u
   ON u.id = user_id
 WHERE collection_id = ?`+cond+`
 ORDER BY subscribed DESC`, collID)
 	if err != nil {
 		log.Error("Failed selecting email subscribers for collection %d: %v", collID, err)
 		return nil, err
 	}
 	defer rows.Close()
 
 	var subs []*EmailSubscriber
 	for rows.Next() {
 		s := &EmailSubscriber{}
 		err = rows.Scan(&s.ID, &s.CollID, &s.UserID, &s.Email, &s.acctEmail, &s.Subscribed, &s.Token, &s.Confirmed, &s.AllowExport)
 		if err != nil {
 			log.Error("Failed scanning row from email subscribers: %v", err)
 			continue
 		}
 		subs = append(subs, s)
 	}
 	return subs, nil
 }
 
 func (db *datastore) FetchEmailSubscriberEmail(subID, token string) (string, error) {
 	var email sql.NullString
 	// TODO: return user email if there's a user_id ?
 	err := db.QueryRow("SELECT email FROM emailsubscribers WHERE id = ? AND token = ?", subID, token).Scan(&email)
 	switch {
 	case err == sql.ErrNoRows:
 		return "", fmt.Errorf("Subscriber doesn't exist or token is invalid.")
 	case err != nil:
 		log.Error("Couldn't SELECT email from emailsubscribers: %v", err)
 		return "", fmt.Errorf("Something went very wrong.")
 	}
 
 	return email.String, nil
 }
 
 func (db *datastore) FetchEmailSubscriber(email string, userID, collID int64) (*EmailSubscriber, error) {
 	const emailSubCols = "id, collection_id, user_id, email, subscribed, token, confirmed, allow_export"
 
 	s := &EmailSubscriber{}
 	var row *sql.Row
 	if email != "" {
 		row = db.QueryRow("SELECT "+emailSubCols+" FROM emailsubscribers WHERE email = ? AND collection_id = ?", email, collID)
 	} else {
 		row = db.QueryRow("SELECT "+emailSubCols+" FROM emailsubscribers WHERE user_id = ? AND collection_id = ?", userID, collID)
 	}
 	err := row.Scan(&s.ID, &s.CollID, &s.UserID, &s.Email, &s.Subscribed, &s.Token, &s.Confirmed, &s.AllowExport)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, nil
 	case err != nil:
 		return nil, err
 	}
 	return s, nil
 }
 
 func (db *datastore) DeleteEmailSubscriber(subID, token string) error {
 	res, err := db.Exec("DELETE FROM emailsubscribers WHERE id = ? AND token = ?", subID, token)
 	if err != nil {
 		return err
 	}
 
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		return impart.HTTPError{http.StatusNotFound, "Invalid token, or subscriber doesn't exist"}
 	}
 	return nil
 }
 
 func (db *datastore) DeleteEmailSubscriberByUser(email string, userID, collID int64) error {
 	var res sql.Result
 	var err error
 	if email != "" {
 		res, err = db.Exec("DELETE FROM emailsubscribers WHERE email = ? AND collection_id = ?", email, collID)
 	} else {
 		res, err = db.Exec("DELETE FROM emailsubscribers WHERE user_id = ? AND collection_id = ?", userID, collID)
 	}
 	if err != nil {
 		return err
 	}
 
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		return impart.HTTPError{http.StatusNotFound, "Subscriber doesn't exist"}
 	}
 	return nil
 }
 
 func (db *datastore) UpdateSubscriberConfirmed(subID, token string) error {
 	email, err := db.FetchEmailSubscriberEmail(subID, token)
 	if err != nil {
 		log.Error("Didn't fetch email subscriber: %v", err)
 		return err
 	}
 
 	// TODO: ensure all addresses with original name are also confirmed, e.g. matt+fake@write.as and matt@write.as are now confirmed
 	_, err = db.Exec("UPDATE emailsubscribers SET confirmed = 1 WHERE email = ?", email)
 	if err != nil {
 		log.Error("Could not update email subscriber confirmation status: %v", err)
 		return err
 	}
 	return nil
 }
 
 func (db *datastore) IsSubscriberConfirmed(email string) bool {
 	var dummy int64
 	err := db.QueryRow("SELECT 1 FROM emailsubscribers WHERE email = ? AND confirmed = 1", email).Scan(&dummy)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Couldn't SELECT in isSubscriberConfirmed: %v", err)
 		return false
 	}
 
 	return true
 }
 
 func (db *datastore) InsertJob(j *PostJob) error {
 	res, err := db.Exec("INSERT INTO publishjobs (post_id, action, delay) VALUES (?, ?, ?)", j.PostID, j.Action, j.Delay)
 	if err != nil {
 		return err
 	}
 	jobID, err := res.LastInsertId()
 	if err != nil {
 		log.Error("[jobs] Couldn't get last insert ID! %s", err)
 	}
 	log.Info("[jobs] Queued %s job #%d for post %s, delayed %d minutes", j.Action, jobID, j.PostID, j.Delay)
 	return nil
 }
 
 func (db *datastore) UpdateJobForPost(postID string, delay int64) error {
 	_, err := db.Exec("UPDATE publishjobs SET delay = ? WHERE post_id = ?", delay, postID)
 	if err != nil {
 		return fmt.Errorf("Unable to update publish job: %s", err)
 	}
 	log.Info("Updated job for post %s: delay %d", postID, delay)
 	return nil
 }
 
 func (db *datastore) DeleteJob(id int64) error {
 	_, err := db.Exec("DELETE FROM publishjobs WHERE id = ?", id)
 	if err != nil {
 		return err
 	}
 	log.Info("[job #%d] Deleted.", id)
 	return nil
 }
 
 func (db *datastore) DeleteJobByPost(postID string) error {
 	_, err := db.Exec("DELETE FROM publishjobs WHERE post_id = ?", postID)
 	if err != nil {
 		return err
 	}
 	log.Info("[job] Deleted job for post %s", postID)
 	return nil
 }
 
 func (db *datastore) GetJobsToRun(action string) ([]*PostJob, error) {
 	timeWhere := "created < DATE_SUB(NOW(), INTERVAL delay MINUTE) AND created > DATE_SUB(NOW(), INTERVAL delay + 5 MINUTE)"
 	if db.driverName == driverSQLite {
 		timeWhere = "created < DATETIME('now', '-' || delay || ' MINUTE') AND created > DATETIME('now', '-' || (delay+5) || ' MINUTE')"
 	}
 	rows, err := db.Query(`SELECT pj.id, post_id, action, delay
 		FROM publishjobs pj
 		INNER JOIN posts p
 			ON post_id = p.id
 		WHERE action = ? AND `+timeWhere+`
 		ORDER BY created ASC`, action)
 	if err != nil {
 		log.Error("Failed selecting from publishjobs: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve publish jobs."}
 	}
 	defer rows.Close()
 
 	jobs := []*PostJob{}
 	for rows.Next() {
 		j := &PostJob{}
 		err = rows.Scan(&j.ID, &j.PostID, &j.Action, &j.Delay)
 		jobs = append(jobs, j)
 	}
 	return jobs, nil
 }
diff --git a/email.go b/email.go
index f2332df..c4718fb 100644
--- a/email.go
+++ b/email.go
@@ -1,512 +1,512 @@
 /*
  * Copyright © 2019-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"bytes"
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/aymerick/douceur/inliner"
 	"github.com/gorilla/mux"
 	stripmd "github.com/writeas/go-strip-markdown/v2"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/key"
 	"github.com/writefreely/writefreely/mailer"
 	"github.com/writefreely/writefreely/spam"
 )
 
 const (
 	emailSendDelay = 15
 )
 
 type (
 	SubmittedSubscription struct {
 		CollAlias string
 		UserID    int64
 
 		Email string `schema:"email" json:"email"`
 		Web   bool   `schema:"web" json:"web"`
 		Slug  string `schema:"slug" json:"slug"`
 		From  string `schema:"from" json:"from"`
 	}
 
 	EmailSubscriber struct {
 		ID          string
 		CollID      int64
 		UserID      sql.NullInt64
 		Email       sql.NullString
 		Subscribed  time.Time
 		Token       string
 		Confirmed   bool
 		AllowExport bool
 		acctEmail   sql.NullString
 	}
 )
 
 func (es *EmailSubscriber) FinalEmail(keys *key.Keychain) string {
 	if !es.UserID.Valid || es.Email.Valid {
 		return es.Email.String
 	}
 
 	decEmail, err := data.Decrypt(keys.EmailKey, []byte(es.acctEmail.String))
 	if err != nil {
 		log.Error("Error decrypting user email: %v", err)
 		return ""
 	}
 	return string(decEmail)
 }
 
 func (es *EmailSubscriber) SubscribedFriendly() string {
 	return es.Subscribed.Format("January 2, 2006")
 }
 
 func handleCreateEmailSubscription(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	var err error
 
 	ss := SubmittedSubscription{
 		CollAlias: vars["alias"],
 	}
 	u := getUserSession(app, r)
 	if u != nil {
 		ss.UserID = u.ID
 	}
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&ss)
 		if err != nil {
 			log.Error("Couldn't parse new subscription JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse new subscription form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&ss, r.PostForm)
 		if err != nil {
 			log.Error("Continuing, but error decoding new subscription form request: %v\n", err)
 			//return ErrBadFormData
 		}
 	}
 
 	c, err := app.db.GetCollection(ss.CollAlias)
 	if err != nil {
 		log.Error("getCollection: %s", err)
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	from := c.CanonicalURL()
 	isAuthorBanned, err := app.db.IsUserSilenced(c.OwnerID)
 	if isAuthorBanned {
 		log.Info("Author is silenced, so subscription is blocked.")
 		return impart.HTTPError{http.StatusFound, from}
 	}
 
 	if ss.Web {
 		if u != nil && u.ID == c.OwnerID {
 			from = "/" + c.Alias + "/"
 		}
 		from += ss.Slug
 	}
 
 	if r.FormValue(spam.HoneypotFieldName()) != "" || r.FormValue("fake_password") != "" {
 		log.Info("Honeypot field was filled out! Not subscribing.")
 		return impart.HTTPError{http.StatusFound, from}
 	}
 
 	if ss.Email == "" && ss.UserID < 1 {
 		log.Info("No subscriber data. Not subscribing.")
 		return impart.HTTPError{http.StatusFound, from}
 	}
 
 	confirmed := app.db.IsSubscriberConfirmed(ss.Email)
 	es, err := app.db.AddEmailSubscription(c.ID, ss.UserID, ss.Email, confirmed)
 	if err != nil {
 		log.Error("addEmailSubscription: %s", err)
 		return err
 	}
 
 	// Send confirmation email if needed
 	if !confirmed {
 		err = sendSubConfirmEmail(app, c, ss.Email, es.ID, es.Token)
 		if err != nil {
 			log.Error("Failed to send subscription confirmation email: %s", err)
 			return err
 		}
 	}
 
 	if ss.Web {
 		session, err := app.sessionStore.Get(r, userEmailCookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
 			log.Error("Getting user email cookie: %v; ignoring", err)
 		}
 		if confirmed {
 			addSessionFlash(app, w, r, "<strong>Subscribed</strong>. You'll now receive future blog posts via email.", nil)
 		} else {
 			addSessionFlash(app, w, r, "Please check your email and <strong>click the confirmation link</strong> to subscribe.", nil)
 		}
 		session.Values[userEmailCookieVal] = ss.Email
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("save email cookie: %s", err)
 			return err
 		}
 
 		return impart.HTTPError{http.StatusFound, from}
 	}
 	return impart.WriteSuccess(w, "", http.StatusAccepted)
 }
 
 func handleExportEmailSubscriptions(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	vars := mux.Vars(r)
 	var err error
 	alias := vars["alias"]
 	filename := ""
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, filename, ErrNotLoggedIn
 	}
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return nil, filename, err
 	}
 
 	// Verify permissions / ownership
 	if u.ID != c.OwnerID {
 		return nil, filename, ErrForbiddenCollectionAccess
 	}
 
 	filename = "subscribers-" + alias + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	subs, err := app.db.GetEmailSubscribers(c.ID, true)
 	if err != nil {
 		return nil, filename, err
 	}
 
 	var data []byte
 	for _, sub := range subs {
 		data = append(data, []byte(sub.Email.String+"\n")...)
 	}
 	data = bytes.TrimRight(data, "\n")
 	return data, filename, err
 }
 
 func handleDeleteEmailSubscription(app *App, w http.ResponseWriter, r *http.Request) error {
 	alias := collectionAliasFromReq(r)
 
 	vars := mux.Vars(r)
 	subID := vars["subscriber"]
 	email := r.FormValue("email")
 	token := r.FormValue("t")
 	slug := r.FormValue("slug")
 	isWeb := r.Method == "GET"
 
 	// Display collection if this is a collection
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		log.Error("Get collection: %s", err)
 		return err
 	}
 
 	from := c.CanonicalURL()
 
 	if subID != "" {
 		// User unsubscribing via email, so assume action is taken by either current
 		// user or not current user, and only use the request's information to
 		// satisfy this unsubscribe, i.e. subscriberID and token.
 		err = app.db.DeleteEmailSubscriber(subID, token)
 	} else {
 		// User unsubscribing through the web app, so assume action is taken by
 		// currently-auth'd user.
 		var userID int64
 		u := getUserSession(app, r)
 		if u != nil {
 			// User is logged in
 			userID = u.ID
 			if userID == c.OwnerID {
 				from = "/" + c.Alias + "/"
 			}
 		}
 		if email == "" && userID <= 0 {
 			// Get email address from saved cookie
 			session, err := app.sessionStore.Get(r, userEmailCookieName)
 			if err != nil {
 				log.Error("Unable to get email cookie: %s", err)
 			} else {
 				email = session.Values[userEmailCookieVal].(string)
 			}
 		}
 
 		if email == "" && userID <= 0 {
 			err = fmt.Errorf("No subscriber given.")
 			log.Error("Not deleting subscription: %s", err)
 			return err
 		}
 
 		err = app.db.DeleteEmailSubscriberByUser(email, userID, c.ID)
 	}
 	if err != nil {
 		log.Error("Unable to delete subscriber: %v", err)
 		return err
 	}
 
 	if isWeb {
 		from += slug
 		addSessionFlash(app, w, r, "<strong>Unsubscribed</strong>. You will no longer receive these blog posts via email.", nil)
 		return impart.HTTPError{http.StatusFound, from}
 	}
 	return impart.WriteSuccess(w, "", http.StatusAccepted)
 }
 
 func handleConfirmEmailSubscription(app *App, w http.ResponseWriter, r *http.Request) error {
 	alias := collectionAliasFromReq(r)
 	subID := mux.Vars(r)["subscriber"]
 	token := r.FormValue("t")
 
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(alias)
 	}
 	if err != nil {
 		log.Error("Get collection: %s", err)
 		return err
 	}
 
 	from := c.CanonicalURL()
 
 	err = app.db.UpdateSubscriberConfirmed(subID, token)
 	if err != nil {
 		addSessionFlash(app, w, r, err.Error(), nil)
 		return impart.HTTPError{http.StatusFound, from}
 	}
 
 	addSessionFlash(app, w, r, "<strong>Confirmed</strong>! Thanks. Now you'll receive future blog posts via email.", nil)
 	return impart.HTTPError{http.StatusFound, from}
 }
 
 func emailPost(app *App, p *PublicPost, collID int64) error {
 	p.augmentContent()
 
 	// Do some shortcode replacement.
 	// Since the user is receiving this email, we can assume they're subscribed via email.
 	p.Content = strings.Replace(p.Content, shortCodeEmailSub, `<p id="emailsub">You're subscribed to email updates.</p>`, -1)
 
 	if p.HTMLContent == template.HTML("") {
 		p.formatContent(app.cfg, false, false)
 	}
 	p.augmentReadingDestination()
 
 	title := p.Title.String
 	if title != "" {
 		title = p.Title.String + "\n\n"
 	}
 	plainMsg := title + "A new post from " + p.CanonicalURL(app.cfg.App.Host) + "\n\n" + stripmd.Strip(p.Content)
 	plainMsg += `
 
 ---------------------------------------------------------------------------------
 
 Originally published on ` + p.Collection.DisplayTitle() + ` (` + p.Collection.CanonicalURL() + `), a blog you subscribe to.
 
 Sent to %recipient.to%. Unsubscribe: ` + p.Collection.CanonicalURL() + `email/unsubscribe/%recipient.id%?t=%recipient.token%`
 
 	mlr, err := mailer.New(app.cfg.Email)
 	if err != nil {
 		return err
 	}
-	m, err := mlr.NewMessage(p.Collection.DisplayTitle()+" <"+p.Collection.Alias+"@"+app.cfg.Email.Domain+">", stripmd.Strip(p.DisplayTitle()), plainMsg)
+	m, err := mlr.NewMessage(mailer.FormatAddress(p.Collection.DisplayTitle(), p.Collection.Alias+"@"+app.cfg.Email.Domain), stripmd.Strip(p.DisplayTitle()), plainMsg)
 	if err != nil {
 		return err
 	}
 	replyTo := app.db.GetCollectionAttribute(collID, collAttrLetterReplyTo)
 	if replyTo != "" {
 		m.SetReplyTo(replyTo)
 	}
 
 	subs, err := app.db.GetEmailSubscribers(collID, true)
 	if err != nil {
 		log.Error("Unable to get email subscribers: %v", err)
 		return err
 	}
 	if len(subs) == 0 {
 		return nil
 	}
 
 	if title != "" {
 		title = string(`<h2 id="title">` + p.FormattedDisplayTitle() + `</h2>`)
 	}
 	m.AddTag("New post")
 
 	fontFam := "Lora, Palatino, Baskerville, serif"
 	if p.IsSans() {
 		fontFam = `"Open Sans", Tahoma, Arial, sans-serif`
 	} else if p.IsMonospace() {
 		fontFam = `Hack, consolas, Menlo-Regular, Menlo, Monaco, monospace, monospace`
 	}
 
 	// TODO: move this to a templated file and LESS-generated stylesheet
 	fullHTML := `<html>
 	<head>
 		<style>
 		body {
 			font-size: 120%;
 			font-family: ` + fontFam + `;
 			margin: 1em 2em;
 		}
 		#article {
 			line-height: 1.5;
 			margin: 1.5em 0;
 			white-space: pre-wrap;
 			word-wrap: break-word;
 		}
 		h1, h2, h3, h4, h5, h6, p, code {
 			display: inline
 		}
 		img, iframe, video {
 			max-width: 100%
 		}
 		#title {
 			margin-bottom: 1em;
 			display: block;
 		}
 		.intro {
 			font-style: italic;
 			font-size: 0.95em;
 		}
 		div#footer {
 			text-align: center;
 			max-width: 35em;
 			margin: 2em auto;
 		}
 		div#footer p {
 			display: block;
 			font-size: 0.86em;
 			color: #666;
 		}
 		hr {
 			border: 1px solid #ccc;
 			margin: 2em 1em;
 		}
 		p#emailsub {
 			text-align: center;
 			display: inline-block !important;
 			width: 100%;
 			font-style: italic;
 		}
 		</style>
 	</head>
 	<body>
 		<div id="article">` + title + `<p class="intro">From <a href="` + p.CanonicalURL(app.cfg.App.Host) + `">` + p.DisplayCanonicalURL() + `</a></p>
 
 ` + string(p.HTMLContent) + `</div>
 		<hr />
 		<div id="footer">
 			<p>Originally published on <a href="` + p.Collection.CanonicalURL() + `">` + p.Collection.DisplayTitle() + `</a>, a blog you subscribe to.</p>
 			<p>Sent to %recipient.to%. <a href="` + p.Collection.CanonicalURL() + `email/unsubscribe/%recipient.id%?t=%recipient.token%">Unsubscribe</a>.</p>
 		</div>
 	</body>
 </html>`
 
 	// inline CSS
 	html, err := inliner.Inline(fullHTML)
 	if err != nil {
 		log.Error("Unable to inline email HTML: %v", err)
 		return err
 	}
 
 	m.SetHTML(html)
 
 	log.Info("[email] Adding %d recipient(s)", len(subs))
 	for _, s := range subs {
 		e := s.FinalEmail(app.keys)
 		log.Info("[email] Adding %s", e)
 		err = m.AddRecipientAndVariables(e, map[string]string{
 			"id":    s.ID,
 			"to":    e,
 			"token": s.Token,
 		})
 		if err != nil {
 			log.Error("Unable to add receipient %s: %s", e, err)
 		}
 	}
 
 	err = mlr.Send(m)
 	log.Info("[email] Email sent")
 	if err != nil {
 		log.Error("Unable to send post email: %v", err)
 		return err
 	}
 
 	return nil
 }
 
 func sendSubConfirmEmail(app *App, c *Collection, email, subID, token string) error {
 	if email == "" {
 		return fmt.Errorf("You must supply an email to verify.")
 	}
 
 	// Send email
 	mlr, err := mailer.New(app.cfg.Email)
 	if err != nil {
 		return err
 	}
 
 	plainMsg := "Confirm your subscription to " + c.DisplayTitle() + ` (` + c.CanonicalURL() + `) to start receiving future posts. Simply click the following link (or copy and paste it into your browser):
 
 ` + c.CanonicalURL() + "email/confirm/" + subID + "?t=" + token + `
 
 If you didn't subscribe to this site or you're not sure why you're getting this email, you can delete it. You won't be subscribed or receive any future emails.`
-	m, err := mlr.NewMessage(c.DisplayTitle()+" <"+c.Alias+"@"+app.cfg.Email.Domain+">", "Confirm your subscription to "+c.DisplayTitle(), plainMsg, fmt.Sprintf("<%s>", email))
+	m, err := mlr.NewMessage(mailer.FormatAddress(c.DisplayTitle(), c.Alias+"@"+app.cfg.Email.Domain), "Confirm your subscription to "+c.DisplayTitle(), plainMsg, fmt.Sprintf("<%s>", email))
 	if err != nil {
 		return err
 	}
 	m.AddTag("Email Verification")
 
 	m.SetHTML(`<html>
 	<body style="font-family:Lora, 'Palatino Linotype', Palatino, Baskerville, 'Book Antiqua', 'New York', 'DejaVu serif', serif; font-size: 100%%; margin:1em 2em;">
 		<div style="font-size: 1.2em;">
 			<p>Confirm your subscription to <a href="` + c.CanonicalURL() + `">` + c.DisplayTitle() + `</a> to start receiving future posts:</p>
 			<p><a href="` + c.CanonicalURL() + `email/confirm/` + subID + `?t=` + token + `">Subscribe to ` + c.DisplayTitle() + `</a></p>
 			<p>If you didn't subscribe to this site or you're not sure why you're getting this email, you can delete it. You won't be subscribed or receive any future emails.</p>
         </div>
 	</body>
 </html>`)
 	err = mlr.Send(m)
 	if err != nil {
 		return err
 	}
 
 	return nil
 }
diff --git a/export.go b/export.go
index a89ed7d..52666d4 100644
--- a/export.go
+++ b/export.go
@@ -1,132 +1,136 @@
 /*
  * Copyright © 2018-2019 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"archive/zip"
 	"bytes"
 	"encoding/csv"
 	"strings"
 	"time"
 
 	"github.com/writeas/web-core/log"
 )
 
 func exportPostsCSV(hostName string, u *User, posts *[]PublicPost) []byte {
 	var b bytes.Buffer
 
 	r := [][]string{
 		{"id", "slug", "blog", "url", "created", "title", "body"},
 	}
 	for _, p := range *posts {
 		var blog string
 		if p.Collection != nil {
 			blog = p.Collection.Alias
 			p.Collection.hostName = hostName
 		}
 		f := []string{p.ID, p.Slug.String, blog, p.CanonicalURL(hostName), p.Created8601(), p.Title.String, strings.Replace(p.Content, "\n", "\\n", -1)}
 		r = append(r, f)
 	}
 
 	w := csv.NewWriter(&b)
 	w.WriteAll(r) // calls Flush internally
 	if err := w.Error(); err != nil {
 		log.Info("error writing csv: %v", err)
 	}
 
 	return b.Bytes()
 }
 
 type exportedTxt struct {
 	Name, Title, Body string
 
 	Mod time.Time
 }
 
 func exportPostsZip(u *User, posts *[]PublicPost) []byte {
 	// Create a buffer to write our archive to.
 	b := new(bytes.Buffer)
 
 	// Create a new zip archive.
 	w := zip.NewWriter(b)
 
 	// Add some files to the archive.
 	var filename string
 	files := []exportedTxt{}
 	for _, p := range *posts {
 		filename = ""
 		if p.Collection != nil {
 			filename += p.Collection.Alias + "/"
 		}
 		if p.Slug.String != "" {
 			filename += p.Slug.String + "_"
 		}
 		filename += p.ID + ".txt"
 		files = append(files, exportedTxt{filename, p.Title.String, p.Content, p.Created})
 	}
 
 	for _, file := range files {
 		head := &zip.FileHeader{Name: file.Name}
 		head.SetModTime(file.Mod)
 		f, err := w.CreateHeader(head)
 		if err != nil {
 			log.Error("export zip header: %v", err)
 		}
 		var fullPost string
 		if file.Title != "" {
 			fullPost = "# " + file.Title + "\n\n"
 		}
 		fullPost += file.Body
 		_, err = f.Write([]byte(fullPost))
 		if err != nil {
 			log.Error("export zip write: %v", err)
 		}
 	}
 
 	// Make sure to check the error on Close.
 	err := w.Close()
 	if err != nil {
 		log.Error("export zip close: %v", err)
 	}
 
 	return b.Bytes()
 }
 
 func compileFullExport(app *App, u *User) *ExportUser {
 	exportUser := &ExportUser{
 		User: u,
 	}
 
 	colls, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 	}
 
 	posts, err := app.db.GetAnonymousPosts(u, 0)
 	if err != nil {
 		log.Error("unable to fetch anon posts: %v", err)
 	}
 	exportUser.AnonymousPosts = *posts
 
 	var collObjs []CollectionObj
 	for _, c := range *colls {
 		co := &CollectionObj{Collection: c}
 		co.Posts, err = app.db.GetPosts(app.cfg, &c, 0, true, false, true, "")
 		if err != nil {
 			log.Error("unable to get collection posts: %v", err)
 		}
 		app.db.GetPostsCount(co, true)
+		// Remove redundant Collection information on each post
+		for i, _ := range *co.Posts {
+			(*co.Posts)[i].Collection = nil
+		}
 		collObjs = append(collObjs, *co)
 	}
 	exportUser.Collections = &collObjs
 
 	return exportUser
 }
diff --git a/go.mod b/go.mod
index a7ffde2..6d9af13 100644
--- a/go.mod
+++ b/go.mod
@@ -1,98 +1,98 @@
 module github.com/writefreely/writefreely
 
 require (
 	github.com/PuerkitoBio/goquery v1.8.1 // indirect
 	github.com/aymerick/douceur v0.2.0
 	github.com/clbanning/mxj v1.8.4 // indirect
 	github.com/dustin/go-humanize v1.0.1
 	github.com/facebookgo/ensure v0.0.0-20200202191622-63f1cf65ac4c // indirect
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
 	github.com/fatih/color v1.19.0
 	github.com/go-ini/ini v1.67.0
 	github.com/go-sql-driver/mysql v1.8.1
 	github.com/go-test/deep v1.0.1 // indirect
 	github.com/gobuffalo/envy v1.9.0 // indirect
 	github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e // indirect
 	github.com/gorilla/csrf v1.7.3
 	github.com/gorilla/feeds v1.1.2
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/schema v1.4.1
 	github.com/gorilla/sessions v1.3.0
 	github.com/gosimple/slug v1.15.0
 	github.com/guregu/null v4.0.0+incompatible
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/ikeikeikeike/go-sitemap-generator/v2 v2.0.2
 	github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec
 	github.com/mailgun/mailgun-go v2.0.0+incompatible
 	github.com/manifoldco/promptui v0.9.0
 	github.com/mattn/go-sqlite3 v1.14.28
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/mitchellh/go-wordwrap v1.0.1
 	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d
 	github.com/onsi/ginkgo v1.16.4 // indirect
 	github.com/onsi/gomega v1.13.0 // indirect
 	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be // indirect
 	github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 // indirect
 	github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c // indirect
 	github.com/stretchr/testify v1.11.1
 	github.com/urfave/cli/v2 v2.27.7
 	github.com/writeas/activity v0.1.2
 	github.com/writeas/activityserve v0.0.0-20230428180247-dc13a4f4d835
 	github.com/writeas/go-strip-markdown/v2 v2.1.1
 	github.com/writeas/go-webfinger v1.1.0
 	github.com/writeas/httpsig v1.0.0
 	github.com/writeas/impart v1.1.1
 	github.com/writeas/import v0.2.1
 	github.com/writeas/monday v1.3.0
 	github.com/writeas/saturday v1.7.2-0.20200427193424-392b95a03320
-	github.com/writeas/web-core v1.7.1-0.20260220200703-91ebade091c4
+	github.com/writeas/web-core v1.8.0
 	github.com/writefreely/go-gopher v0.0.0-20220429181814-40127126f83b
 	github.com/writefreely/go-nodeinfo v1.2.0
-	golang.org/x/crypto v0.53.0
-	golang.org/x/net v0.55.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/net v0.60.0
 )
 
 require github.com/xhit/go-simple-mail/v2 v2.16.0
 
 require (
 	code.as/core/socks v1.0.0 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/andybalholm/cascadia v1.3.2 // indirect
 	github.com/beevik/etree v1.1.0 // indirect
 	github.com/captncraig/cors v0.0.0-20190703115713-e80254a89df1 // indirect
 	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/go-fed/httpsig v0.1.1-0.20200204213531-0ef28562fabe // indirect
 	github.com/gofrs/uuid v3.3.0+incompatible // indirect
 	github.com/gologme/log v1.2.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gosimple/unidecode v1.0.1 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/joho/godotenv v1.3.0 // indirect
 	github.com/jtolds/gls v4.2.1+incompatible // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208 // indirect
 	github.com/writeas/go-writeas/v2 v2.0.2 // indirect
 	github.com/writeas/openssl-go v1.0.0 // indirect
 	github.com/writeas/slug v1.2.0 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-go 1.25.0
+go 1.26.0
diff --git a/go.sum b/go.sum
index 25ed756..02a3924 100644
--- a/go.sum
+++ b/go.sum
@@ -1,373 +1,321 @@
 code.as/core/socks v1.0.0 h1:SPQXNp4SbEwjOAP9VzUahLHak8SDqy5n+9cm9tpjZOs=
 code.as/core/socks v1.0.0/go.mod h1:BAXBy5O9s2gmw6UxLqNJcVbWY7C/UPs+801CcSsfWOY=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/PuerkitoBio/goquery v1.8.1 h1:uQxhNlArOIdbrH1tr0UXwdVFgDcZDrZVdcpygAcwmWM=
 github.com/PuerkitoBio/goquery v1.8.1/go.mod h1:Q8ICL1kNUJ2sXGoAhPGUdYDJvgQgHzJsnnd3H7Ho5jQ=
 github.com/andybalholm/cascadia v1.3.1/go.mod h1:R4bJ1UQfqADjvDa4P6HZHLh/3OxWWEqc0Sk8XGwHqvA=
 github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
 github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
 github.com/captncraig/cors v0.0.0-20190703115713-e80254a89df1 h1:AFSJaASPGYNbkUa5c8ZybrcW9pP3Cy7+z5dnpcc/qG8=
 github.com/captncraig/cors v0.0.0-20190703115713-e80254a89df1/go.mod h1:EIlIeMufZ8nqdUhnesledB15xLRl4wIJUppwDLPrdrQ=
 github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/clbanning/mxj v1.8.3/go.mod h1:BVjHeAH+rl9rs6f+QIpeRl0tfu10SXn1pUSa5PVGJng=
 github.com/clbanning/mxj v1.8.4 h1:HuhwZtbyvyOw+3Z1AowPkU87JkJUSv751ELWaiTpj8I=
 github.com/clbanning/mxj v1.8.4/go.mod h1:BVjHeAH+rl9rs6f+QIpeRl0tfu10SXn1pUSa5PVGJng=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5 h1:RAV05c0xOkJ3dZGS0JFybxFKZ2WMLabgx3uXnd7rpGs=
 github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5/go.mod h1:GgB8SF9nRG+GqaDtLcwJZsQFhcogVCJ79j4EdT0c2V4=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/facebookgo/ensure v0.0.0-20200202191622-63f1cf65ac4c h1:8ISkoahWXwZR41ois5lSJBSVw4D0OV19Ht/JSTzvSv0=
 github.com/facebookgo/ensure v0.0.0-20200202191622-63f1cf65ac4c/go.mod h1:Yg+htXGokKKdzcwhuNDwVvN+uBxDGXJ7G/VN1d8fa64=
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A=
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg=
 github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 h1:7HZCaLC5+BZpmbhCOZJ293Lz68O7PYrF2EzeiFMwCLk=
 github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4/go.mod h1:5tD+neXqOorC30/tWg0LCSkrqj/AR6gu8yY8/fpw1q0=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/go-fed/httpsig v0.1.0/go.mod h1:T56HUNYZUQ1AGUzhAYPugZfp36sKApVnGBgKlIY+aIE=
 github.com/go-fed/httpsig v0.1.1-0.20200204213531-0ef28562fabe h1:U71giCx5NjRn4Lb71UuprPHqhjxGv3Jqonb9fgcaJH8=
 github.com/go-fed/httpsig v0.1.1-0.20200204213531-0ef28562fabe/go.mod h1:T56HUNYZUQ1AGUzhAYPugZfp36sKApVnGBgKlIY+aIE=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.0.1 h1:UQhStjbkDClarlmv0am7OXXO4/GaPdCGiUiMTvi28sg=
 github.com/go-test/deep v1.0.1/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/gobuffalo/envy v1.9.0 h1:eZR0DuEgVLfeIb1zIKt3bT4YovIMf9O9LXQeCZLXpqE=
 github.com/gobuffalo/envy v1.9.0/go.mod h1:FurDp9+EDPE4aIUS3ZLyD+7/9fpx7YRt/ukY6jIHf0w=
 github.com/gofrs/uuid v3.3.0+incompatible h1:8K4tyRfvU1CYPgJsveYFQMhpFd/wXNM7iK6rR7UHz84=
 github.com/gofrs/uuid v3.3.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/gologme/log v1.2.0 h1:Ya5Ip/KD6FX7uH0S31QO87nCCSucKtF44TLbTtO7V4c=
 github.com/gologme/log v1.2.0/go.mod h1:gq31gQ8wEHkR+WekdWsqDuf8pXTUZA9BnnzTuPz1Y9U=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/csrf v1.7.3 h1:BHWt6FTLZAb2HtWT5KDBf6qgpZzvtbp9QWDRKZMXJC0=
 github.com/gorilla/csrf v1.7.3/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
-github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/gorilla/feeds v1.1.2 h1:pxzZ5PD3RJdhFH2FsJJ4x6PqMqbgFk1+Vez4XWBW8Iw=
 github.com/gorilla/feeds v1.1.2/go.mod h1:WMib8uJP3BbY+X8Szd1rA5Pzhdfh+HCCAYT2z7Fza6Y=
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/schema v1.4.1 h1:jUg5hUjCSDZpNGLuXQOgIWGdlgrIdYvgQ0wZtdK1M3E=
 github.com/gorilla/schema v1.4.1/go.mod h1:Dg5SSm5PV60mhF2NFaTV1xuYYj8tV8NOPRo4FggUMnM=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.3.0 h1:XYlkq7KcpOB2ZhHBPv5WpjMIxrQosiZanfoy1HLZFzg=
 github.com/gorilla/sessions v1.3.0/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
 github.com/gosimple/slug v1.15.0 h1:wRZHsRrRcs6b0XnxMUBM6WK1U1Vg5B0R7VkIf1Xzobo=
 github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ=
 github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o=
 github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc=
 github.com/guregu/null v4.0.0+incompatible h1:4zw0ckM7ECd6FNNddc3Fu4aty9nTlpkkzH7dPn4/4Gw=
 github.com/guregu/null v4.0.0+incompatible/go.mod h1:ePGpQaN9cw0tj45IR5E5ehMvsFlLlQZAkkOXZurJ3NM=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ikeikeikeike/go-sitemap-generator/v2 v2.0.2 h1:wIdDEle9HEy7vBPjC6oKz6ejs3Ut+jmsYvuOoAW2pSM=
 github.com/ikeikeikeike/go-sitemap-generator/v2 v2.0.2/go.mod h1:WtaVKD9TeruTED9ydiaOJU08qGoEPP/LyzTKiD3jEsw=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/jtolds/gls v4.2.1+incompatible h1:fSuqC+Gmlu6l/ZYAoZzx2pyucC8Xza35fpRVWLVmUEE=
 github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec h1:ZXWuspqypleMuJy4bzYEqlMhJnGAYpLrWe5p7W3CdvI=
 github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec/go.mod h1:voECJzdraJmolzPBgL9Z7ANwXf4oMXaTCsIkdiPpR/g=
 github.com/mailgun/mailgun-go v2.0.0+incompatible h1:0FoRHWwMUctnd8KIR3vtZbqdfjpIMxOZgcSa51s8F8o=
 github.com/mailgun/mailgun-go v2.0.0+incompatible/go.mod h1:NWTyU+O4aczg/nsGhQnvHL6v2n5Gy6Sv5tNDVvC6FbU=
 github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
 github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
 github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/microcosm-cc/bluemonday v1.0.2/go.mod h1:iVP4YcDBq+n/5fb23BhYFvIMq/leAFZyRl6bYmGDlGc=
-github.com/microcosm-cc/bluemonday v1.0.23/go.mod h1:mN70sk7UkkF8TUr2IGBpNN0jAgStuPzlK76QuruE/z4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d h1:VhgPp6v9qf9Agr/56bj7Y/xa04UccTW04VP0Qed4vnQ=
 github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d/go.mod h1:YUTz3bUH2ZwIWBy3CJBeOBEugqcmXREj14T+iG/4k4U=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.2/go.mod h1:CObGmKUOKaSC0RjmoAK7tKyn4Azo5P2IWuoMnvwxz1E=
 github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.13.0 h1:7lLHu94wT9Ij0o6EWWclhu0aOh32VxhkwEJvzuWPeak=
 github.com/onsi/gomega v1.13.0/go.mod h1:lRk9szgn8TxENtWd0Tp4c3wjlRfMTMH27I+3Je41yGY=
 github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 h1:q2e307iGHPdTGp0hoxKjt1H5pDo6utceo3dQVK3I5XQ=
 github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5/go.mod h1:jvVRKCrJTQWu0XVbaOlby/2lO20uSCHEMzzplHXte1o=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be h1:ta7tUOvsPHVHGom5hKW5VXNc2xZIkfCKP8iaqOyYtUQ=
 github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be/go.mod h1:MIDFMn7db1kT65GmV94GzpX9Qdi7N/pQlwb+AN8wh+Q=
 github.com/rogpeppe/go-internal v1.3.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sasha-s/go-deadlock v0.3.1 h1:sqv7fDNShgjcaxkO0JNcOAlr8B9+cV5Ey/OB71efZx0=
 github.com/sasha-s/go-deadlock v0.3.1/go.mod h1:F73l+cr82YSh10GxyRI6qZiCgK64VaZjwesgfQ1/iLM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
 github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c h1:Ho+uVpkel/udgjbwB5Lktg9BtvJSh2DT0Hi6LPSyI2w=
 github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208 h1:PM5hJF7HVfNWmCjMdEfbuOBNXSVF2cMFGgQTPdKCbwM=
 github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208/go.mod h1:BzWtXXrXzZUvMacR0oF/fbDDgUPO8L36tDMmRAf14ns=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
 github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
 github.com/writeas/activity v0.1.2 h1:Y12B5lIrabfqKE7e7HFCWiXrlfXljr9tlkFm2mp7DgY=
 github.com/writeas/activity v0.1.2/go.mod h1:mYYgiewmEM+8tlifirK/vl6tmB2EbjYaxwb+ndUw5T0=
 github.com/writeas/activityserve v0.0.0-20230428180247-dc13a4f4d835 h1:bm/7gYo6y3GxtTa1qyUFyCk29CTnBAKt7z4D2MASYrw=
 github.com/writeas/activityserve v0.0.0-20230428180247-dc13a4f4d835/go.mod h1:4akDJSl+sSp+QhrQKMqzAqdV1gJ1pPx6XPI77zgMM8o=
 github.com/writeas/go-strip-markdown/v2 v2.1.1 h1:hAxUM21Uhznf/FnbVGiJciqzska6iLei22Ijc3q2e28=
 github.com/writeas/go-strip-markdown/v2 v2.1.1/go.mod h1:UvvgPJgn1vvN8nWuE5e7v/+qmDu3BSVnKAB6Gl7hFzA=
 github.com/writeas/go-webfinger v1.1.0 h1:MzNyt0ry/GMsRmJGftn2o9mPwqK1Q5MLdh4VuJCfb1Q=
 github.com/writeas/go-webfinger v1.1.0/go.mod h1:w2VxyRO/J5vfNjJHYVubsjUGHd3RLDoVciz0DE3ApOc=
 github.com/writeas/go-writeas v1.1.0/go.mod h1:oh9U1rWaiE0p3kzdKwwvOpNXgp0P0IELI7OLOwV4fkA=
 github.com/writeas/go-writeas/v2 v2.0.2 h1:akvdMg89U5oBJiCkBwOXljVLTqP354uN6qnG2oOMrbk=
 github.com/writeas/go-writeas/v2 v2.0.2/go.mod h1:9sjczQJKmru925fLzg0usrU1R1tE4vBmQtGnItUMR0M=
 github.com/writeas/httpsig v1.0.0 h1:peIAoIA3DmlP8IG8tMNZqI4YD1uEnWBmkcC9OFPjt3A=
 github.com/writeas/httpsig v1.0.0/go.mod h1:7ClMGSrSVXJbmiLa17bZ1LrG1oibGZmUMlh3402flPY=
 github.com/writeas/impart v1.1.0/go.mod h1:g0MpxdnTOHHrl+Ca/2oMXUHJ0PcRAEWtkCzYCJUXC9Y=
 github.com/writeas/impart v1.1.1 h1:RyA9+CqbdbDuz53k+nXCWUY+NlEkdyw6+nWanxSBl5o=
 github.com/writeas/impart v1.1.1/go.mod h1:g0MpxdnTOHHrl+Ca/2oMXUHJ0PcRAEWtkCzYCJUXC9Y=
 github.com/writeas/import v0.2.1 h1:3k+bDNCyqaWdZinyUZtEO4je3mR6fr/nE4ozTh9/9Wg=
 github.com/writeas/import v0.2.1/go.mod h1:gFe0Pl7ZWYiXbI0TJxeMMyylPGZmhVvCfQxhMEc8CxM=
 github.com/writeas/monday v1.3.0 h1:h51wJ0DULXIDZ1w11zutLL7YCBRO5LznXISSzqVLZeA=
 github.com/writeas/monday v1.3.0/go.mod h1:9/CdGLDdIeAvzvf4oeihX++PE/qXUT2+tUlPQKCfRWY=
 github.com/writeas/openssl-go v1.0.0 h1:YXM1tDXeYOlTyJjoMlYLQH1xOloUimSR1WMF8kjFc5o=
 github.com/writeas/openssl-go v1.0.0/go.mod h1:WsKeK5jYl0B5y8ggOmtVjbmb+3rEGqSD25TppjJnETA=
 github.com/writeas/saturday v1.6.0/go.mod h1:ETE1EK6ogxptJpAgUbcJD0prAtX48bSloie80+tvnzQ=
 github.com/writeas/saturday v1.7.1/go.mod h1:ETE1EK6ogxptJpAgUbcJD0prAtX48bSloie80+tvnzQ=
 github.com/writeas/saturday v1.7.2-0.20200427193424-392b95a03320 h1:PozPZ29CQ/xt6ym/+FvIz+KvKEObSSc5ye+95zbTjVU=
 github.com/writeas/saturday v1.7.2-0.20200427193424-392b95a03320/go.mod h1:ETE1EK6ogxptJpAgUbcJD0prAtX48bSloie80+tvnzQ=
 github.com/writeas/slug v1.2.0 h1:EMQ+cwLiOcA6EtFwUgyw3Ge18x9uflUnOnR6bp/J+/g=
 github.com/writeas/slug v1.2.0/go.mod h1:RE8shOqQP3YhsfsQe0L3RnuejfQ4Mk+JjY5YJQFubfQ=
-github.com/writeas/web-core v1.2.1-0.20210306215149-e05f572eb21f h1:5D0iyxiaFGC1OKt/VM1W5ptCBfyG82Llej5aMPhy1w8=
-github.com/writeas/web-core v1.2.1-0.20210306215149-e05f572eb21f/go.mod h1:DzNxa0YLV/wNeeWeHFPNa/nHmyJBFIIzXN/m9PpDm5c=
-github.com/writeas/web-core v1.7.0 h1:79bpoTXOLTHhCYaPyl7euNNVNZ/HBLkDxv98s/XRZhM=
-github.com/writeas/web-core v1.7.0/go.mod h1:doPbvwwYCyrLoyrIMH5m+14uCfG3SHMrMcGsj8NIlkM=
-github.com/writeas/web-core v1.7.1-0.20251023181503-180136e6db47 h1:z/WIg+TOFBT0I0pz/dK0csCNg+kE/kMirZCI5WAw1RE=
-github.com/writeas/web-core v1.7.1-0.20251023181503-180136e6db47/go.mod h1:doPbvwwYCyrLoyrIMH5m+14uCfG3SHMrMcGsj8NIlkM=
-github.com/writeas/web-core v1.7.1-0.20260220193454-e9abfc34c1d2 h1:qHIxJoJQtRMMZ7kNkr1VI5Vt2bEkaLj9SY7ZfC7VquY=
-github.com/writeas/web-core v1.7.1-0.20260220193454-e9abfc34c1d2/go.mod h1:ZNf1SsyEapxZYgT/dJx5uDVQoM2SW1W8jFelemDgJpo=
-github.com/writeas/web-core v1.7.1-0.20260220194844-e4cf63404036 h1:ELX8BW8XKLh31u7xepmKvgCz7AiBI/3DUpJMAsPZX6k=
-github.com/writeas/web-core v1.7.1-0.20260220194844-e4cf63404036/go.mod h1:ZNf1SsyEapxZYgT/dJx5uDVQoM2SW1W8jFelemDgJpo=
-github.com/writeas/web-core v1.7.1-0.20260220200703-91ebade091c4 h1:L0sx60T6BBRzWXD3KABCA+H0spDwAtnqBXFbDSMFkG4=
-github.com/writeas/web-core v1.7.1-0.20260220200703-91ebade091c4/go.mod h1:ZNf1SsyEapxZYgT/dJx5uDVQoM2SW1W8jFelemDgJpo=
+github.com/writeas/web-core v1.8.0 h1:SsxXazzo35cW0tPNxJqAu0An1emdwPG59mTYIs6TirI=
+github.com/writeas/web-core v1.8.0/go.mod h1:f5qH0rqpM9Vec2UMdh+ei942giCN54MVkehKBh1Y8C4=
 github.com/writefreely/go-gopher v0.0.0-20220429181814-40127126f83b h1:h3NzB8OZ50NNi5k9yrFeyFszt3LyqyVK4+xUHFYY8B0=
 github.com/writefreely/go-gopher v0.0.0-20220429181814-40127126f83b/go.mod h1:T2UVVzt+R5KSSZe2xRSytnwc2M9AoDegi7foeIsik+M=
 github.com/writefreely/go-nodeinfo v1.2.0 h1:La+YbTCvmpTwFhBSlebWDDL81N88Qf/SCAvRLR7F8ss=
 github.com/writefreely/go-nodeinfo v1.2.0/go.mod h1:UTvE78KpcjYOlRHupZIiSEFcXHioTXuacCbHU+CAcPg=
 github.com/xhit/go-simple-mail/v2 v2.16.0 h1:ouGy/Ww4kuaqu2E2UrDw7SvLaziWTB60ICLkIkNVccA=
 github.com/xhit/go-simple-mail/v2 v2.16.0/go.mod h1:b7P5ygho6SYE+VIqpxA6QkYfv4teeyG4MKqB3utRu98=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20180527072434-ab813273cd59/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190131182504-b8fe1690c613/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210916014120-12bc252f5db8/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180525142821-c11f84a56e43/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/ini.v1 v1.55.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.62.0 h1:duBzk771uxoUuOlyRLkHsygud9+5lrlGjdFBb4mSKDU=
 gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 h1:POO/ycCATvegFmVuPpQzZFJ+pGZeX22Ufu6fibxDVjU=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/handle.go b/handle.go
index 1756be3..81e0aaf 100644
--- a/handle.go
+++ b/handle.go
@@ -1,1013 +1,1014 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"fmt"
 	"html/template"
 	"net/http"
 	"net/url"
 	"runtime/debug"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gorilla/sessions"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/go-gopher"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/page"
 )
 
 // UserLevel represents the required user level for accessing an endpoint
 type UserLevel int
 
 const (
 	UserLevelNoneType         UserLevel = iota // user or not -- ignored
 	UserLevelOptionalType                      // user or not -- object fetched if user
 	UserLevelNoneRequiredType                  // non-user (required)
 	UserLevelUserType                          // user (required)
 )
 
 func UserLevelNone(cfg *config.Config) UserLevel {
 	return UserLevelNoneType
 }
 
 func UserLevelOptional(cfg *config.Config) UserLevel {
 	return UserLevelOptionalType
 }
 
 func UserLevelNoneRequired(cfg *config.Config) UserLevel {
 	return UserLevelNoneRequiredType
 }
 
 func UserLevelUser(cfg *config.Config) UserLevel {
 	return UserLevelUserType
 }
 
 // UserLevelReader returns the permission level required for any route where
 // users can read published content.
 func UserLevelReader(cfg *config.Config) UserLevel {
 	if cfg.App.Private {
 		return UserLevelUserType
 	}
 	return UserLevelOptionalType
 }
 
 type (
 	handlerFunc          func(app *App, w http.ResponseWriter, r *http.Request) error
 	gopherFunc           func(app *App, w gopher.ResponseWriter, r *gopher.Request) error
 	userHandlerFunc      func(app *App, u *User, w http.ResponseWriter, r *http.Request) error
 	userApperHandlerFunc func(apper Apper, u *User, w http.ResponseWriter, r *http.Request) error
 	dataHandlerFunc      func(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error)
 	authFunc             func(app *App, r *http.Request) (*User, error)
 	UserLevelFunc        func(cfg *config.Config) UserLevel
 )
 
 type Handler struct {
 	errors       *ErrorPages
 	sessionStore sessions.Store
 	app          Apper
 }
 
 // ErrorPages hold template HTML error pages for displaying errors to the user.
 // In each, there should be a defined template named "base".
 type ErrorPages struct {
 	NotFound            *template.Template
 	Gone                *template.Template
 	InternalServerError *template.Template
 	UnavailableError    *template.Template
 	Blank               *template.Template
 }
 
 // NewHandler returns a new Handler instance, using the given StaticPage data,
 // and saving alias to the application's CookieStore.
 func NewHandler(apper Apper) *Handler {
 	h := &Handler{
 		errors: &ErrorPages{
 			NotFound:            template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>404</title></head><body><p>Not found.</p></body></html>{{end}}")),
 			Gone:                template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>410</title></head><body><p>Gone.</p></body></html>{{end}}")),
 			InternalServerError: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>500</title></head><body><p>Internal server error.</p></body></html>{{end}}")),
 			UnavailableError:    template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>503</title></head><body><p>Service is temporarily unavailable.</p></body></html>{{end}}")),
 			Blank:               template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>{{.Title}}</title></head><body><p>{{.Content}}</p></body></html>{{end}}")),
 		},
 		sessionStore: apper.App().SessionStore(),
 		app:          apper,
 	}
 
 	return h
 }
 
 // NewWFHandler returns a new Handler instance, using WriteFreely template files.
 // You MUST call writefreely.InitTemplates() before this.
 func NewWFHandler(apper Apper) *Handler {
 	h := NewHandler(apper)
 	h.SetErrorPages(&ErrorPages{
 		NotFound:            pages["404-general.tmpl"],
 		Gone:                pages["410.tmpl"],
 		InternalServerError: pages["500.tmpl"],
 		UnavailableError:    pages["503.tmpl"],
 		Blank:               pages["blank.tmpl"],
 	})
 	return h
 }
 
 // SetErrorPages sets the given set of ErrorPages as templates for any errors
 // that come up.
 func (h *Handler) SetErrorPages(e *ErrorPages) {
 	h.errors = e
 }
 
 // User handles requests made in the web application by the authenticated user.
 // This provides user-friendly HTML pages and actions that work in the browser.
 func (h *Handler) User(f userHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil {
 				err := ErrNotLoggedIn
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app.App(), u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if impErr, ok := err.(impart.HTTPError); ok {
 				status = impErr.Status
 				if impErr == ErrUserNotFound {
 					log.Info("Logged-in user not found. Logging out.")
 					sendRedirect(w, http.StatusFound, "/me/logout?to="+h.app.App().cfg.App.LandingPath())
 					// Reset err so handleHTTPError does nothing
 					err = nil
 				}
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 // Admin handles requests on /admin routes
 func (h *Handler) Admin(f userHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil || !u.IsAdmin() {
 				err := impart.HTTPError{http.StatusNotFound, ""}
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app.App(), u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 // AdminApper handles requests on /admin routes that require an Apper.
 func (h *Handler) AdminApper(f userApperHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil || !u.IsAdmin() {
 				err := impart.HTTPError{http.StatusNotFound, ""}
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app, u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 func apiAuth(app *App, r *http.Request) (*User, error) {
 	// Authorize user from Authorization header
 	t := r.Header.Get("Authorization")
 	if t == "" {
 		return nil, ErrNoAccessToken
 	}
 	u := &User{ID: app.db.GetUserID(t)}
 	if u.ID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return u, nil
 }
 
 // optionalAPIAuth is used for endpoints that accept authenticated requests via
 // Authorization header or cookie, unlike apiAuth. It returns a different err
 // in the case where no Authorization header is present.
 func optionalAPIAuth(app *App, r *http.Request) (*User, error) {
 	// Authorize user from Authorization header
 	t := r.Header.Get("Authorization")
 	if t == "" {
 		return nil, ErrNotLoggedIn
 	}
 	u := &User{ID: app.db.GetUserID(t)}
 	if u.ID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return u, nil
 }
 
 func webAuth(app *App, r *http.Request) (*User, error) {
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, ErrNotLoggedIn
 	}
 	return u, nil
 }
 
 // UserAPI handles requests made in the API by the authenticated user.
 // This provides user-friendly HTML pages and actions that work in the browser.
 func (h *Handler) UserAPI(f userHandlerFunc) http.HandlerFunc {
 	return h.UserAll(false, f, apiAuth)
 }
 
 // UserWebAPI handles endpoints that accept a user authorized either via the web (cookies) or an Authorization header.
 func (h *Handler) UserWebAPI(f userHandlerFunc) http.HandlerFunc {
 	return h.UserAll(false, f, func(app *App, r *http.Request) (*User, error) {
 		// Authorize user via cookies
 		u := getUserSession(app, r)
 		if u != nil {
 			return u, nil
 		}
 
 		// Fall back to access token, since user isn't logged in via web
 		var err error
 		u, err = apiAuth(app, r)
 		if err != nil {
 			return nil, err
 		}
 
 		return u, nil
 	})
 }
 
 func (h *Handler) UserAll(web bool, f userHandlerFunc, a authFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		handleFunc := func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u, err := a(h.app.App(), r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 				return err
 			}
 
 			err = f(h.app.App(), u, w, r)
 			if err == nil {
 				status = 200
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = 500
 			}
 
 			return err
 		}
 
 		if web {
 			h.handleHTTPError(w, r, handleFunc())
 		} else {
 			h.handleError(w, r, handleFunc())
 		}
 	}
 }
 
 func (h *Handler) RedirectOnErr(f handlerFunc, loc string) handlerFunc {
 	return func(app *App, w http.ResponseWriter, r *http.Request) error {
 		err := f(app, w, r)
 		if err != nil {
 			if ie, ok := err.(impart.HTTPError); ok {
 				// Override default redirect with returned error's, if it's a
 				// redirect error.
 				if ie.Status == http.StatusFound {
 					return ie
 				}
 			}
 			return impart.HTTPError{http.StatusFound, loc}
 		}
 		return nil
 	}
 }
 
 func (h *Handler) Page(n string) http.HandlerFunc {
 	return h.Web(func(app *App, w http.ResponseWriter, r *http.Request) error {
 		t, ok := pages[n]
 		if !ok {
 			return impart.HTTPError{http.StatusNotFound, "Page not found."}
 		}
 
 		sp := pageForReq(app, r)
 
 		err := t.ExecuteTemplate(w, "base", sp)
 		if err != nil {
 			log.Error("Unable to render page: %v", err)
 		}
 		return err
 	}, UserLevelOptional)
 }
 
 func (h *Handler) WebErrors(f handlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// TODO: factor out this logic shared with Web()
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					u := getUserSession(h.app.App(), r)
 					username := "None"
 					if u != nil {
 						username = u.Username
 					}
 					log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			var session *sessions.Session
 			var err error
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err = h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			// TODO: pass User object to function
 			err = f(h.app.App(), w, r)
 			if err == nil {
 				status = 200
 			} else if httpErr, ok := err.(impart.HTTPError); ok {
 				status = httpErr.Status
 				if status < 300 || status > 399 {
 					addSessionFlash(h.app.App(), w, r, httpErr.Message, session)
 					return impart.HTTPError{http.StatusFound, r.Referer()}
 				}
 			} else {
 				e := fmt.Sprintf("[Web handler] 500: %v", err)
 				if !strings.HasSuffix(e, "write: broken pipe") {
 					log.Error(e)
 				} else {
 					log.Error(e)
 				}
 				log.Info("Web handler internal error render")
 				h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 				status = 500
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) CollectionPostOrStatic(w http.ResponseWriter, r *http.Request) {
-	if strings.Contains(r.URL.Path, ".") && !isRaw(r) {
+	// This mirrors handleViewPost() to serve reserved static files like robots.txt
+	if (strings.Contains(r.URL.Path, ".") && !isRaw(r)) || r.URL.Path == "/robots.txt" || r.URL.Path == "/manifest.json" {
 		start := time.Now()
 		status := 200
 		defer func() {
 			log.Info(h.app.ReqLog(r, status, time.Since(start)))
 		}()
 
 		// Serve static file
 		h.app.App().shttp.ServeHTTP(w, r)
 		return
 	}
 
 	h.Web(viewCollectionPost, UserLevelReader)(w, r)
 }
 
 // Web handles requests made in the web application. This provides user-
 // friendly HTML pages and actions that work in the browser.
 func (h *Handler) Web(f handlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					u := getUserSession(h.app.App(), r)
 					username := "None"
 					if u != nil {
 						username = u.Username
 					}
 					log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
 					log.Info("Web deferred internal error render")
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err := h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			// TODO: pass User object to function
 			err := f(h.app.App(), w, r)
 			if err == nil {
 				status = 200
 			} else if httpErr, ok := err.(impart.HTTPError); ok {
 				status = httpErr.Status
 			} else {
 				e := fmt.Sprintf("[Web handler] 500: %v", err)
 				log.Error(e)
 				log.Info("Web internal error render")
 				h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 				status = 500
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) All(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			// TODO: do any needed authentication
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) PlainTextAPI(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleTextError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					status = http.StatusInternalServerError
 					w.WriteHeader(status)
 					fmt.Fprintf(w, "Something didn't work quite right. The robots have alerted the humans.")
 				}
 
 				log.Info(fmt.Sprintf("\"%s %s\" %d %s \"%s\" \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent(), r.Host))
 			}()
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = http.StatusInternalServerError
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) OAuth(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleOAuthError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) AllReader(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleError(w, r, func() error {
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			// Allow any origin, as public endpoints are handled in here
 			w.Header().Set("Access-Control-Allow-Origin", "*")
 
 			if h.app.App().cfg.App.Private {
 				// This instance is private, so ensure it's being accessed by a valid user
 				// Check if authenticated with an access token
 				_, apiErr := optionalAPIAuth(h.app.App(), r)
 				if apiErr != nil {
 					if err, ok := apiErr.(impart.HTTPError); ok {
 						status = err.Status
 					} else {
 						status = 500
 					}
 
 					if apiErr == ErrNotLoggedIn {
 						// Fall back to web auth since there was no access token given
 						_, err := webAuth(h.app.App(), r)
 						if err != nil {
 							if err, ok := apiErr.(impart.HTTPError); ok {
 								status = err.Status
 							} else {
 								status = 500
 							}
 							return err
 						}
 					} else {
 						return apiErr
 					}
 				}
 			}
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) Download(f dataHandlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			data, filename, err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 				return err
 			}
 
 			ext := ".json"
 			ct := "application/json"
 			if strings.HasSuffix(r.URL.Path, ".csv") {
 				ext = ".csv"
 				ct = "text/csv"
 			} else if strings.HasSuffix(r.URL.Path, ".zip") {
 				ext = ".zip"
 				ct = "application/zip"
 			}
 			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s%s", filename, ext))
 			w.Header().Set("Content-Type", ct)
 			w.Header().Set("Content-Length", strconv.Itoa(len(data)))
 			fmt.Fprint(w, string(data))
 
 			status = 200
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) Redirect(url string, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			start := time.Now()
 
 			var status int
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err := h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			status = sendRedirect(w, http.StatusFound, url)
 
 			log.Info(h.app.ReqLog(r, status, time.Since(start)))
 
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) handleHTTPError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		} else if err.Status == http.StatusUnauthorized {
 			q := ""
 			if r.URL.RawQuery != "" {
 				q = url.QueryEscape("?" + r.URL.RawQuery)
 			}
 			sendRedirect(w, http.StatusFound, "/login?to="+r.URL.Path+q)
 			return
 		} else if err.Status == http.StatusGone {
 			w.WriteHeader(err.Status)
 			p := &struct {
 				page.StaticPage
 				Content *template.HTML
 			}{
 				StaticPage: pageForReq(h.app.App(), r),
 			}
 			if err.Message != "" {
 				co := template.HTML(err.Message)
 				p.Content = &co
 			}
 			h.errors.Gone.ExecuteTemplate(w, "base", p)
 			return
 		} else if err.Status == http.StatusNotFound {
 			w.WriteHeader(err.Status)
 			if IsActivityPubRequest(r) {
 				// This is a fediverse request; simply return the header
 				return
 			}
 			h.errors.NotFound.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusInternalServerError {
 			w.WriteHeader(err.Status)
 			log.Info("handleHTTPErorr internal error render")
 			h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusServiceUnavailable {
 			w.WriteHeader(err.Status)
 			h.errors.UnavailableError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusAccepted {
 			impart.WriteSuccess(w, "", err.Status)
 			return
 		} else {
 			p := &struct {
 				page.StaticPage
 				Title   string
 				Content template.HTML
 			}{
 				pageForReq(h.app.App(), r),
 				fmt.Sprintf("Uh oh (%d)", err.Status),
 				template.HTML(fmt.Sprintf("<p style=\"text-align: center\" class=\"introduction\">%s</p>", err.Message)),
 			}
 			h.errors.Blank.ExecuteTemplate(w, "base", p)
 			return
 		}
 		impart.WriteError(w, err)
 		return
 	}
 
 	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 }
 
 func (h *Handler) handleError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		//		if strings.Contains(r.Header.Get("Accept"), "text/html") {
 		impart.WriteError(w, err)
 		//		}
 		return
 	}
 
 	if IsJSON(r) {
 		impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 		return
 	}
 	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 }
 
 func (h *Handler) handleTextError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		w.WriteHeader(err.Status)
 		fmt.Fprintf(w, http.StatusText(err.Status))
 		return
 	}
 
 	w.WriteHeader(http.StatusInternalServerError)
 	fmt.Fprintf(w, "This is an unhelpful error message for a miscellaneous internal error.")
 }
 
 func (h *Handler) handleOAuthError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		impart.WriteOAuthError(w, err)
 		return
 	}
 
 	impart.WriteOAuthError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 	return
 }
 
 func correctPageFromLoginAttempt(r *http.Request) string {
 	to := r.FormValue("to")
-	if to == "" {
+	if to == "" || strings.HasPrefix(to, "//") {
 		to = "/"
 	} else if !strings.HasPrefix(to, "/") {
 		to = "/" + to
 	}
 	return to
 }
 
 func (h *Handler) LogHandlerFunc(f http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("Handler.LogHandlerFunc\n\n%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				// TODO: log actual status code returned
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if h.app.App().cfg.App.Private {
 				// This instance is private, so ensure it's being accessed by a valid user
 				// Check if authenticated with an access token
 				_, apiErr := optionalAPIAuth(h.app.App(), r)
 				if apiErr != nil {
 					if err, ok := apiErr.(impart.HTTPError); ok {
 						status = err.Status
 					} else {
 						status = 500
 					}
 
 					if apiErr == ErrNotLoggedIn {
 						// Fall back to web auth since there was no access token given
 						_, err := webAuth(h.app.App(), r)
 						if err != nil {
 							if err, ok := apiErr.(impart.HTTPError); ok {
 								status = err.Status
 							} else {
 								status = 500
 							}
 							return err
 						}
 					} else {
 						return apiErr
 					}
 				}
 			}
 
 			f(w, r)
 
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) Gopher(f gopherFunc) gopher.HandlerFunc {
 	return func(w gopher.ResponseWriter, r *gopher.Request) {
 		defer func() {
 			if e := recover(); e != nil {
 				log.Error("%s: %s", e, debug.Stack())
 				w.WriteError("An internal error occurred")
 			}
 			log.Info("gopher: %s", r.Selector)
 		}()
 
 		err := f(h.app.App(), w, r)
 		if err != nil {
 			log.Error("failed: %s", err)
 			w.WriteError("the page failed for some reason (see logs)")
 		}
 	}
 }
 
 func sendRedirect(w http.ResponseWriter, code int, location string) int {
 	w.Header().Set("Location", location)
 	w.WriteHeader(code)
 	return code
 }
 
 func cacheControl(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Cache-Control", "public, max-age=604800, immutable")
 		next.ServeHTTP(w, r)
 	})
 }
diff --git a/invites.go b/invites.go
index 72f4890..8696eae 100644
--- a/invites.go
+++ b/invites.go
@@ -1,206 +1,209 @@
 /*
  * Copyright © 2019-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"html/template"
 	"net/http"
 	"strconv"
 	"time"
 
+	"github.com/gorilla/csrf"
 	"github.com/gorilla/mux"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/id"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/page"
 )
 
 type Invite struct {
 	ID       string
 	MaxUses  sql.NullInt64
 	Created  time.Time
 	Expires  *time.Time
 	Inactive bool
 
 	uses int64
 }
 
 func (i Invite) Uses() int64 {
 	return i.uses
 }
 
 func (i Invite) Expired() bool {
 	return i.Expires != nil && i.Expires.Before(time.Now())
 }
 
 func (i Invite) Active(db *datastore) bool {
 	if i.Expired() {
 		return false
 	}
 	if i.MaxUses.Valid && i.MaxUses.Int64 > 0 {
 		if c := db.GetUsersInvitedCount(i.ID); c >= i.MaxUses.Int64 {
 			return false
 		}
 	}
 	return true
 }
 
 func (i Invite) ExpiresFriendly() string {
 	return i.Expires.Format("January 2, 2006, 3:04 PM")
 }
 
 func handleViewUserInvites(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	// Don't show page if instance doesn't allow it
 	if !(app.cfg.App.UserInvites != "" && (u.IsAdmin() || app.cfg.App.UserInvites != "admin")) {
 		return impart.HTTPError{http.StatusNotFound, ""}
 	}
 
 	f, _ := getSessionFlashes(app, w, r, nil)
 
 	p := struct {
 		*UserPage
-		Invites  *[]Invite
-		Silenced bool
+		Invites   *[]Invite
+		Silenced  bool
+		CSRFField template.HTML
 	}{
-		UserPage: NewUserPage(app, r, u, "Invite People", f),
+		UserPage:  NewUserPage(app, r, u, "Invite People", f),
+		CSRFField: csrf.TemplateField(r),
 	}
 
 	var err error
 
 	p.Silenced, err = app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view invites: %v", err)
 	}
 
 	p.Invites, err = app.db.GetUserInvites(u.ID)
 	if err != nil {
 		return err
 	}
 	for i := range *p.Invites {
 		(*p.Invites)[i].uses = app.db.GetUsersInvitedCount((*p.Invites)[i].ID)
 	}
 
 	showUserPage(w, "invite", p)
 	return nil
 }
 
 func handleCreateUserInvite(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	muVal := r.FormValue("uses")
 	expVal := r.FormValue("expires")
 
 	if u.IsSilenced() {
 		return ErrUserSilenced
 	}
 
 	var err error
 	var maxUses int
 	if muVal != "0" {
 		maxUses, err = strconv.Atoi(muVal)
 		if err != nil {
 			return impart.HTTPError{http.StatusBadRequest, "Invalid value for 'max_uses'"}
 		}
 	}
 
 	var expDate *time.Time
 	var expires int
 	if expVal != "0" {
 		expires, err = strconv.Atoi(expVal)
 		if err != nil {
 			return impart.HTTPError{http.StatusBadRequest, "Invalid value for 'expires'"}
 		}
 		ed := time.Now().Add(time.Duration(expires) * time.Minute)
 		expDate = &ed
 	}
 
 	inviteID := id.GenerateRandomString("0123456789BCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz", 6)
 	err = app.db.CreateUserInvite(inviteID, u.ID, maxUses, expDate)
 	if err != nil {
 		return err
 	}
 
 	return impart.HTTPError{http.StatusFound, "/me/invites"}
 }
 
 func handleViewInvite(app *App, w http.ResponseWriter, r *http.Request) error {
 	inviteCode := mux.Vars(r)["code"]
 
 	i, err := app.db.GetUserInvite(inviteCode)
 	if err != nil {
 		return err
 	}
 
 	expired := i.Expired()
 	if !expired && i.MaxUses.Valid && i.MaxUses.Int64 > 0 {
 		// Invite has a max-use number, so check if we're past that limit
 		i.uses = app.db.GetUsersInvitedCount(inviteCode)
 		expired = i.uses >= i.MaxUses.Int64
 	}
 
 	if u := getUserSession(app, r); u != nil {
 		// check if invite belongs to another user
 		// error can be ignored as not important in this case
 		if ownInvite, _ := app.db.IsUsersInvite(inviteCode, u.ID); !ownInvite {
 			addSessionFlash(app, w, r, "You're already registered and logged in.", nil)
 			// show homepage
 			return impart.HTTPError{http.StatusFound, "/me/settings"}
 		}
 
 		// show invite instructions
 		p := struct {
 			*UserPage
 			Invite  *Invite
 			Expired bool
 		}{
 			UserPage: NewUserPage(app, r, u, "Invite to "+app.cfg.App.SiteName, nil),
 			Invite:   i,
 			Expired:  expired,
 		}
 		showUserPage(w, "invite-help", p)
 		return nil
 	}
 
 	p := struct {
 		page.StaticPage
 		*OAuthButtons
 		Error   string
 		Flashes []template.HTML
 		Invite  string
 	}{
 		StaticPage:   pageForReq(app, r),
 		OAuthButtons: NewOAuthButtons(app.cfg),
 		Invite:       inviteCode,
 	}
 
 	if expired {
 		p.Error = "This invite link has expired."
 	}
 
 	// Tell search engines not to index invite links
 	w.Header().Set("X-Robots-Tag", "noindex")
 
 	// Get error messages
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// Ignore this
 		log.Error("Unable to get session in handleViewInvite; ignoring: %v", err)
 	}
 	flashes, _ := getSessionFlashes(app, w, r, session)
 	for _, flash := range flashes {
 		p.Flashes = append(p.Flashes, template.HTML(flash))
 	}
 
 	// Show landing page
 	return renderPage(w, "signup.tmpl", p)
 }
diff --git a/keys.go b/keys.go
index fa2adb5..efbada9 100644
--- a/keys.go
+++ b/keys.go
@@ -1,75 +1,80 @@
 /*
  * Copyright © 2018-2019, 2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/key"
 )
 
 const (
 	keysDir = "keys"
 )
 
 var (
 	emailKeyPath      = filepath.Join(keysDir, "email.aes256")
 	cookieAuthKeyPath = filepath.Join(keysDir, "cookies_auth.aes256")
 	cookieKeyPath     = filepath.Join(keysDir, "cookies_enc.aes256")
 	csrfKeyPath       = filepath.Join(keysDir, "csrf.aes256")
 )
 
 // InitKeys loads encryption keys into memory via the given Apper interface
 func InitKeys(apper Apper) error {
 	log.Info("Loading encryption keys...")
 	err := apper.LoadKeys()
 	if err != nil {
+		if os.IsNotExist(err) {
+			keysPath := filepath.Join(apper.App().cfg.Server.KeysParentDir, keysDir)
+			return fmt.Errorf("Missing encryption keys at %s. To create, run:\n  writefreely keys generate", keysPath)
+		}
 		return err
 	}
 	return nil
 }
 
 func initKeyPaths(app *App) {
 	emailKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, emailKeyPath)
 	cookieAuthKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, cookieAuthKeyPath)
 	cookieKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, cookieKeyPath)
 	csrfKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, csrfKeyPath)
 }
 
 // generateKey generates a key at the given path used for the encryption of
 // certain user data. Because user data becomes unrecoverable without these
 // keys, this won't overwrite any existing key, and instead outputs a message.
 func generateKey(path string) error {
 	// Check if key file exists
 	if _, err := os.Stat(path); err == nil {
 		log.Info("%s already exists. rm the file if you understand the consequences.", path)
 		return nil
 	} else if !os.IsNotExist(err) {
 		log.Error("%s", err)
 		return err
 	}
 
 	log.Info("Generating %s.", path)
 	b, err := key.GenerateBytes(key.EncKeysBytes)
 	if err != nil {
 		log.Error("FAILED. %s. Run writefreely --gen-keys again.", err)
 		return err
 	}
 	err = os.WriteFile(path, b, 0600)
 	if err != nil {
 		log.Error("FAILED writing file: %s", err)
 		return err
 	}
 	log.Info("Success.")
 	return nil
 }
diff --git a/less/icons.less b/less/icons.less
index 2be5064..596a947 100644
--- a/less/icons.less
+++ b/less/icons.less
@@ -1,38 +1,36 @@
 @font-face {
 	font-family: 'Material Icons';
 	font-style: normal;
 	font-weight: 400;
-	src: url(MaterialIcons-Regular.eot); /* For IE6-8 */
-	src: local('Material Icons'),
-	   local('MaterialIcons-Regular'),
-	   url(/fonts/MaterialIcons-Regular.woff2) format('woff2'),
-	   url(/fonts/MaterialIcons-Regular.woff) format('woff'),
-	   url(/fonts/MaterialIcons-Regular.ttf) format('truetype');
+	font-display: block;
+	src: url(/fonts/MaterialIcons-Regular.woff2) format('woff2'),
+	     url(/fonts/MaterialIcons-Regular.woff) format('woff');
 }
 
 .material-icons {
 	font-family: 'Material Icons';
 	font-weight: normal;
 	font-style: normal;
 	font-size: 24px;  /* Preferred icon size */
 	display: inline-block;
 	width: 1em;
-	height: 1em;
 	line-height: 1;
 	text-transform: none;
 	letter-spacing: normal;
 	word-wrap: normal;
 	white-space: nowrap;
 	direction: ltr;
 
+	font-size-adjust: none;
+
 	/* Support for all WebKit browsers. */
 	-webkit-font-smoothing: antialiased;
 	/* Support for Safari and Chrome. */
 	text-rendering: optimizeLegibility;
 
 	/* Support for Firefox. */
 	-moz-osx-font-smoothing: grayscale;
 
 	/* Support for IE. */
 	font-feature-settings: 'liga';
 }
diff --git a/mailer/mailer.go b/mailer/mailer.go
index a08643c..53a00dd 100644
--- a/mailer/mailer.go
+++ b/mailer/mailer.go
@@ -1,182 +1,191 @@
 /*
  * Copyright © 2024 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package mailer
 
 import (
 	"fmt"
+	netmail "net/mail"
 	"strings"
 
 	"github.com/mailgun/mailgun-go"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/config"
 	mail "github.com/xhit/go-simple-mail/v2"
 )
 
 type (
 	// Mailer holds configurations for the preferred mailing provider.
 	Mailer struct {
 		smtp    *mail.SMTPServer
 		mailGun *mailgun.MailgunImpl
 	}
 
 	// Message holds the email contents and metadata for the preferred mailing provider.
 	Message struct {
 		mgMsg   *mailgun.Message
 		smtpMsg *SmtpMessage
 	}
 
 	SmtpMessage struct {
 		from       string
 		replyTo    string
 		subject    string
 		recipients []Recipient
 		html       string
 		text       string
 	}
 
 	Recipient struct {
 		email string
 		vars  map[string]string
 	}
 )
 
+// FormatAddress returns a correctly quoted and escaped "name <address>"
+// string, per RFC 5322, for use as a From, To, or Reply-To header value.
+// This ensures names containing special characters (like commas) don't
+// break address parsing.
+func FormatAddress(name, address string) string {
+	return (&netmail.Address{Name: name, Address: address}).String()
+}
+
 // New creates a new Mailer from the instance's config.EmailCfg, returning an error if not properly configured.
 func New(eCfg config.EmailCfg) (*Mailer, error) {
 	m := &Mailer{}
 	if eCfg.Domain != "" && eCfg.MailgunPrivate != "" {
 		m.mailGun = mailgun.NewMailgun(eCfg.Domain, eCfg.MailgunPrivate)
 		if eCfg.MailgunEurope {
 			m.mailGun.SetAPIBase("https://api.eu.mailgun.net/v3")
 		}
 	} else if eCfg.Username != "" && eCfg.Password != "" && eCfg.Host != "" && eCfg.Port > 0 {
 		m.smtp = mail.NewSMTPClient()
 		m.smtp.Host = eCfg.Host
 		m.smtp.Port = eCfg.Port
 		m.smtp.Username = eCfg.Username
 		m.smtp.Password = eCfg.Password
 		if eCfg.EnableStartTLS {
 			m.smtp.Encryption = mail.EncryptionSTARTTLS
 		}
 		// To allow sending multiple email
 		m.smtp.KeepAlive = true
 	} else {
 		return nil, fmt.Errorf("no email provider is configured")
 	}
 
 	return m, nil
 }
 
 // NewMessage creates a new Message from the given parameters.
 func (m *Mailer) NewMessage(from, subject, text string, to ...string) (*Message, error) {
 	msg := &Message{}
 	if m.mailGun != nil {
 		msg.mgMsg = m.mailGun.NewMessage(from, subject, text, to...)
 	} else if m.smtp != nil {
 		msg.smtpMsg = &SmtpMessage{
 			from:       from,
 			replyTo:    "",
 			subject:    subject,
-			recipients: make([]Recipient, len(to)),
+			recipients: make([]Recipient, 0, len(to)),
 			html:       "",
 			text:       text,
 		}
 		for _, r := range to {
 			msg.smtpMsg.recipients = append(msg.smtpMsg.recipients, Recipient{r, make(map[string]string)})
 		}
 	}
 	return msg, nil
 }
 
 // SetHTML sets the body of the message.
 func (m *Message) SetHTML(html string) {
 	if m.smtpMsg != nil {
 		m.smtpMsg.html = html
 	} else if m.mgMsg != nil {
 		m.mgMsg.SetHtml(html)
 	}
 }
 
 func (m *Message) SetReplyTo(replyTo string) {
 	if m.smtpMsg != nil {
 		m.smtpMsg.replyTo = replyTo
 	} else {
 		m.mgMsg.SetReplyTo(replyTo)
 	}
 }
 
 // AddTag attaches a tag to the Message for providers that support it.
 func (m *Message) AddTag(tag string) {
 	if m.mgMsg != nil {
 		m.mgMsg.AddTag(tag)
 	}
 }
 
 func (m *Message) AddRecipientAndVariables(r string, vars map[string]string) error {
 	if m.smtpMsg != nil {
 		m.smtpMsg.recipients = append(m.smtpMsg.recipients, Recipient{r, vars})
 		return nil
 	} else {
 		varsInterfaces := make(map[string]interface{}, len(vars))
 		for k, v := range vars {
 			varsInterfaces[k] = v
 		}
 		return m.mgMsg.AddRecipientAndVariables(r, varsInterfaces)
 	}
 }
 
 // Send sends the given message via the preferred provider.
 func (m *Mailer) Send(msg *Message) error {
 	if m.smtp != nil {
 		client, err := m.smtp.Connect()
 		if err != nil {
 			return err
 		}
 		emailSent := false
 		for _, r := range msg.smtpMsg.recipients {
 			customMsg := mail.NewMSG()
 			customMsg.SetFrom(msg.smtpMsg.from)
 			if msg.smtpMsg.replyTo != "" {
 				customMsg.SetReplyTo(msg.smtpMsg.replyTo)
 			}
 			customMsg.SetSubject(msg.smtpMsg.subject)
 			customMsg.AddTo(r.email)
 			cText := msg.smtpMsg.text
 			cHtml := msg.smtpMsg.html
 			for v, value := range r.vars {
 				placeHolder := fmt.Sprintf("%%recipient.%s%%", v)
 				cText = strings.ReplaceAll(cText, placeHolder, value)
 				cHtml = strings.ReplaceAll(cHtml, placeHolder, value)
 			}
 			customMsg.SetBody(mail.TextHTML, cHtml)
 			customMsg.AddAlternative(mail.TextPlain, cText)
 			e := customMsg.Error
 			if e == nil {
 				e = customMsg.Send(client)
 			}
 			if e == nil {
 				emailSent = true
 			} else {
 				log.Error("Unable to send email to %s: %v", r.email, e)
 				err = e
 			}
 		}
 		if !emailSent {
 			// only send an error if no email could be sent (to avoid retry of successfully sent emails)
 			return err
 		}
 	} else if m.mailGun != nil {
 		_, _, err := m.mailGun.Send(msg.mgMsg)
 		if err != nil {
 			return err
 		}
 	}
 	return nil
 }
diff --git a/mailer/mailer_test.go b/mailer/mailer_test.go
new file mode 100644
index 0000000..6ca530b
--- /dev/null
+++ b/mailer/mailer_test.go
@@ -0,0 +1,52 @@
+/*
+ * Copyright © 2026 Musing Studio LLC.
+ *
+ * This file is part of WriteFreely.
+ *
+ * WriteFreely is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, included
+ * in the LICENSE file in this source code package.
+ */
+
+package mailer
+
+import (
+	netmail "net/mail"
+	"testing"
+
+	mail "github.com/xhit/go-simple-mail/v2"
+)
+
+func TestFormatAddress(t *testing.T) {
+	cases := []struct {
+		name, address string
+	}{
+		{"Le blog", "le-blog@example.com"},
+		{"A, B, C et D", "sender@example.net"},
+		{"", "noreply@example.com"},
+	}
+	for _, c := range cases {
+		got := FormatAddress(c.name, c.address)
+		addr, err := netmail.ParseAddress(got)
+		if err != nil {
+			t.Fatalf("FormatAddress(%q, %q) = %q, which failed to parse: %v", c.name, c.address, got, err)
+		}
+		if addr.Address != c.address {
+			t.Errorf("FormatAddress(%q, %q) = %q, parsed address = %q, want %q", c.name, c.address, got, addr.Address, c.address)
+		}
+	}
+}
+
+func TestNewMessageDoesNotAddPhantomRecipients(t *testing.T) {
+	m := &Mailer{smtp: mail.NewSMTPClient()}
+	msg, err := m.NewMessage("Test <from@example.com>", "Subject", "body", "<to@example.com>")
+	if err != nil {
+		t.Fatalf("NewMessage returned error: %v", err)
+	}
+	if len(msg.smtpMsg.recipients) != 1 {
+		t.Fatalf("expected 1 recipient, got %d: %+v", len(msg.smtpMsg.recipients), msg.smtpMsg.recipients)
+	}
+	if msg.smtpMsg.recipients[0].email != "<to@example.com>" {
+		t.Errorf("unexpected recipient: %+v", msg.smtpMsg.recipients[0])
+	}
+}
diff --git a/nodeinfo.go b/nodeinfo.go
index 608aa74..e13013e 100644
--- a/nodeinfo.go
+++ b/nodeinfo.go
@@ -1,122 +1,122 @@
 /*
  * Copyright © 2018-2019, 2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"strings"
 
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/go-nodeinfo"
 	"github.com/writefreely/writefreely/config"
 )
 
 type nodeInfoResolver struct {
 	cfg *config.Config
 	db  *datastore
 }
 
 func nodeInfoConfig(db *datastore, cfg *config.Config) *nodeinfo.Config {
 	name := cfg.App.SiteName
 	desc := cfg.App.SiteDesc
 	if desc == "" {
 		desc = "Minimal, federated blogging platform."
 	}
 	if cfg.App.SingleUser {
 		// Fetch blog information, instead
 		coll, err := db.GetCollectionByID(1)
 		if err == nil {
 			desc = coll.Description
 		}
 	}
 	return &nodeinfo.Config{
 		BaseURL: cfg.App.Host,
 		InfoURL: "/api/nodeinfo",
 
 		Metadata: nodeinfo.Metadata{
 			NodeName:        name,
 			NodeDescription: desc,
 			Private:         cfg.App.Private,
 			Software: nodeinfo.SoftwareMeta{
 				HomePage: softwareURL,
 				GitHub:   "https://github.com/writefreely/writefreely",
 				Follow:   "https://writing.exchange/@writefreely",
 			},
 			MaxBlogs:     cfg.App.MaxBlogs,
 			PublicReader: cfg.App.LocalTimeline,
 			Invites:      cfg.App.UserInvites != "",
 		},
 		Protocols: []nodeinfo.NodeProtocol{
 			nodeinfo.ProtocolActivityPub,
 		},
 		Services: nodeinfo.Services{
 			Inbound: []nodeinfo.NodeService{},
 			Outbound: []nodeinfo.NodeService{
 				nodeinfo.ServiceRSS,
 			},
 		},
 		Software: nodeinfo.SoftwareInfo{
 			Name:    strings.ToLower(serverSoftware),
 			Version: softwareVer,
 		},
 	}
 }
 
 func (r nodeInfoResolver) IsOpenRegistration() (bool, error) {
 	return r.cfg.App.OpenRegistration, nil
 }
 
 func (r nodeInfoResolver) Usage() (nodeinfo.Usage, error) {
 	var collCount, postCount int64
 	var activeHalfYear, activeMonth int
 	var err error
 	collCount, err = r.db.GetTotalCollections()
 	if err != nil {
 		collCount = 0
 	}
 	postCount, err = r.db.GetTotalPosts()
 	if err != nil {
 		log.Error("Unable to fetch post counts: %v", err)
 	}
 
 	if r.cfg.App.PublicStats {
 		// Display bi-yearly / monthly stats
 		err = r.db.QueryRow(`SELECT COUNT(*) FROM (
 SELECT DISTINCT collection_id
 FROM posts
 INNER JOIN collections c
 ON collection_id = c.id
 WHERE collection_id IS NOT NULL
-	AND updated > DATE_SUB(NOW(), INTERVAL 6 MONTH)) co`).Scan(&activeHalfYear)
+	AND updated > ` + r.db.dateSub(6, "MONTH") + `) co`).Scan(&activeHalfYear)
 		if err != nil {
 			log.Error("Failed getting 6-month active user stats: %s", err)
 		}
 
 		err = r.db.QueryRow(`SELECT COUNT(*) FROM (
 SELECT DISTINCT collection_id
 FROM posts
 INNER JOIN collections c
 ON collection_id = c.id
 WHERE collection_id IS NOT NULL
-	AND updated > DATE_SUB(NOW(), INTERVAL 1 MONTH)) co`).Scan(&activeMonth)
+	AND updated > ` + r.db.dateSub(1, "MONTH") + `) co`).Scan(&activeMonth)
 		if err != nil {
 			log.Error("Failed getting 1-month active user stats: %s", err)
 		}
 	}
 
 	return nodeinfo.Usage{
 		Users: nodeinfo.UsageUsers{
 			Total:          int(collCount),
 			ActiveHalfYear: activeHalfYear,
 			ActiveMonth:    activeMonth,
 		},
 		LocalPosts: int(postCount),
 	}, nil
 }
diff --git a/oauth_generic.go b/oauth_generic.go
index 6fa09d7..e04181e 100644
--- a/oauth_generic.go
+++ b/oauth_generic.go
@@ -1,145 +1,150 @@
 /*
  * Copyright © 2020-2021 Musing Studio LLC and respective authors.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"context"
 	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
 	"strings"
 
 	"github.com/writeas/web-core/log"
 )
 
 type genericOauthClient struct {
-	ClientID         string
-	ClientSecret     string
-	AuthLocation     string
-	ExchangeLocation string
-	InspectLocation  string
-	CallbackLocation string
-	Scope            string
-	MapUserID        string
-	MapUsername      string
-	MapDisplayName   string
-	MapEmail         string
-	HttpClient       HttpClient
+	ClientID           string
+	ClientSecret       string
+	AuthUseRequestBody bool
+	AuthLocation       string
+	ExchangeLocation   string
+	InspectLocation    string
+	CallbackLocation   string
+	Scope              string
+	MapUserID          string
+	MapUsername        string
+	MapDisplayName     string
+	MapEmail           string
+	HttpClient         HttpClient
 }
 
 var _ oauthClient = genericOauthClient{}
 
 const (
 	genericOauthDisplayName = "OAuth"
 )
 
 func (c genericOauthClient) GetProvider() string {
 	return "generic"
 }
 
 func (c genericOauthClient) GetClientID() string {
 	return c.ClientID
 }
 
 func (c genericOauthClient) GetCallbackLocation() string {
 	return c.CallbackLocation
 }
 
 func (c genericOauthClient) buildLoginURL(state string) (string, error) {
 	u, err := url.Parse(c.AuthLocation)
 	if err != nil {
 		return "", err
 	}
 	q := u.Query()
 	q.Set("client_id", c.ClientID)
 	q.Set("redirect_uri", c.CallbackLocation)
 	q.Set("response_type", "code")
 	q.Set("state", state)
 	q.Set("scope", c.Scope)
 	u.RawQuery = q.Encode()
 	return u.String(), nil
 }
 
 func (c genericOauthClient) exchangeOauthCode(ctx context.Context, code string) (*TokenResponse, error) {
 	form := url.Values{}
-	form.Add("client_id", c.ClientID)
-	form.Add("client_secret", c.ClientSecret)
+	if c.AuthUseRequestBody {
+		form.Add("client_id", c.ClientID)
+		form.Add("client_secret", c.ClientSecret)
+	}
 	form.Add("grant_type", "authorization_code")
 	form.Add("redirect_uri", c.CallbackLocation)
 	form.Add("scope", c.Scope)
 	form.Add("code", code)
 	req, err := http.NewRequest("POST", c.ExchangeLocation, strings.NewReader(form.Encode()))
 	if err != nil {
 		return nil, err
 	}
 	req.WithContext(ctx)
 	req.Header.Set("User-Agent", ServerUserAgent(""))
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.SetBasicAuth(c.ClientID, c.ClientSecret)
+	if !c.AuthUseRequestBody {
+		req.SetBasicAuth(c.ClientID, c.ClientSecret)
+	}
 
 	resp, err := c.HttpClient.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode != http.StatusOK {
 		return nil, errors.New("unable to exchange code for access token")
 	}
 
 	var tokenResponse TokenResponse
 	if err := limitedJsonUnmarshal(resp.Body, tokenRequestMaxLen, &tokenResponse); err != nil {
 		return nil, err
 	}
 	if tokenResponse.Error != "" {
 		return nil, errors.New(tokenResponse.Error)
 	}
 	return &tokenResponse, nil
 }
 
 func (c genericOauthClient) inspectOauthAccessToken(ctx context.Context, accessToken string) (*InspectResponse, error) {
 	req, err := http.NewRequest("GET", c.InspectLocation, nil)
 	if err != nil {
 		return nil, err
 	}
 	req.WithContext(ctx)
 	req.Header.Set("User-Agent", ServerUserAgent(""))
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("Authorization", "Bearer "+accessToken)
 
 	resp, err := c.HttpClient.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode != http.StatusOK {
 		return nil, errors.New("unable to inspect access token")
 	}
 
 	// since we don't know what the JSON from the server will look like, we create a
 	// generic interface and then map manually to values set in the config
 	var genericInterface map[string]interface{}
 	if err := limitedJsonUnmarshal(resp.Body, infoRequestMaxLen, &genericInterface); err != nil {
 		return nil, err
 	}
 
 	// map each relevant field in inspectResponse to the mapped field from the config
 	var inspectResponse InspectResponse
 	inspectResponse.UserID, _ = genericInterface[c.MapUserID].(string)
 	if inspectResponse.UserID == "" {
 		log.Error("[CONFIGURATION ERROR] Generic OAuth provider returned empty UserID value (`%s`).\n  Do you need to configure a different `map_user_id` value for this provider?", c.MapUserID)
 		return nil, fmt.Errorf("no UserID (`%s`) value returned", c.MapUserID)
 	}
 	inspectResponse.Username, _ = genericInterface[c.MapUsername].(string)
 	inspectResponse.DisplayName, _ = genericInterface[c.MapDisplayName].(string)
 	inspectResponse.Email, _ = genericInterface[c.MapEmail].(string)
 
 	return &inspectResponse, nil
 }
diff --git a/oauth_signup.go b/oauth_signup.go
index b5f881b..1f41d12 100644
--- a/oauth_signup.go
+++ b/oauth_signup.go
@@ -1,232 +1,250 @@
 /*
  * Copyright © 2020-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
 	"html/template"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/log"
+	"github.com/writefreely/writefreely/author"
 	"github.com/writefreely/writefreely/page"
 )
 
 type viewOauthSignupVars struct {
 	page.StaticPage
 	To      string
 	Message template.HTML
 	Flashes []template.HTML
 
 	AccessToken     string
 	TokenUsername   string
 	TokenAlias      string // TODO: rename this to match the data it represents: the collection title
 	TokenEmail      string
 	TokenRemoteUser string
 	Provider        string
 	ClientID        string
 	TokenHash       string
 	InviteCode      string
 
 	LoginUsername string
 	Alias         string // TODO: rename this to match the data it represents: the collection title
 	Email         string
 }
 
 const (
 	oauthParamAccessToken       = "access_token"
 	oauthParamTokenUsername     = "token_username"
 	oauthParamTokenAlias        = "token_alias"
 	oauthParamTokenEmail        = "token_email"
 	oauthParamTokenRemoteUserID = "token_remote_user"
 	oauthParamClientID          = "client_id"
 	oauthParamProvider          = "provider"
 	oauthParamHash              = "signature"
 	oauthParamUsername          = "username"
 	oauthParamAlias             = "alias"
 	oauthParamEmail             = "email"
 	oauthParamPassword          = "password"
 	oauthParamInviteCode        = "invite_code"
 )
 
 type oauthSignupPageParams struct {
 	AccessToken     string
 	TokenUsername   string
 	TokenAlias      string // TODO: rename this to match the data it represents: the collection title
 	TokenEmail      string
 	TokenRemoteUser string
 	ClientID        string
 	Provider        string
 	TokenHash       string
 	InviteCode      string
 }
 
 func (p oauthSignupPageParams) HashTokenParams(key string) string {
 	hasher := sha256.New()
 	hasher.Write([]byte(key))
 	hasher.Write([]byte(p.AccessToken))
 	hasher.Write([]byte(p.TokenUsername))
 	hasher.Write([]byte(p.TokenAlias))
 	hasher.Write([]byte(p.TokenEmail))
 	hasher.Write([]byte(p.TokenRemoteUser))
 	hasher.Write([]byte(p.ClientID))
 	hasher.Write([]byte(p.Provider))
+	// Include the invite code so it can't be swapped out between the callback (where it was validated) and this
+	// completion step.
+	hasher.Write([]byte(p.InviteCode))
 	return hex.EncodeToString(hasher.Sum(nil))
 }
 
 func (h oauthHandler) viewOauthSignup(app *App, w http.ResponseWriter, r *http.Request) error {
 	tp := &oauthSignupPageParams{
 		AccessToken:     r.FormValue(oauthParamAccessToken),
 		TokenUsername:   r.FormValue(oauthParamTokenUsername),
 		TokenAlias:      r.FormValue(oauthParamTokenAlias),
 		TokenEmail:      r.FormValue(oauthParamTokenEmail),
 		TokenRemoteUser: r.FormValue(oauthParamTokenRemoteUserID),
 		ClientID:        r.FormValue(oauthParamClientID),
 		Provider:        r.FormValue(oauthParamProvider),
 		InviteCode:      r.FormValue(oauthParamInviteCode),
 	}
 	if tp.HashTokenParams(h.Config.Server.HashSeed) != r.FormValue(oauthParamHash) {
 		return impart.HTTPError{Status: http.StatusBadRequest, Message: "Request has been tampered with."}
 	}
 	tp.TokenHash = tp.HashTokenParams(h.Config.Server.HashSeed)
+	// Re-check registration eligibility at the completion step rather than
+	// trusting that the callback already did. The signed hash proves the OAuth
+	// identity params (including the invite code) weren't tampered with, but
+	// the account is only actually created here -- so this is where closed
+	// registration and invite validity must be enforced.
+	if err := app.canRegister(tp.InviteCode); err != nil {
+		return h.showOauthSignupPage(app, w, r, tp, err)
+	}
 	if err := h.validateOauthSignup(r); err != nil {
 		return h.showOauthSignupPage(app, w, r, tp, err)
 	}
 
 	var err error
 	hashedPass := []byte{}
 	clearPass := r.FormValue(oauthParamPassword)
 	hasPass := clearPass != ""
 	if hasPass {
 		hashedPass, err = auth.HashPass([]byte(clearPass))
 		if err != nil {
 			return h.showOauthSignupPage(app, w, r, tp, fmt.Errorf("unable to hash password"))
 		}
 	}
 	newUser := &User{
-		Username:   r.FormValue(oauthParamUsername),
+		// Normalize the username into a valid slug, just like normal registration, so the collection alias is always
+		// lowercase
+		Username:   getSlug(r.FormValue(oauthParamUsername), ""),
 		HashedPass: hashedPass,
 		HasPass:    hasPass,
 		Email:      prepareUserEmail(r.FormValue(oauthParamEmail), h.EmailKey),
 		Created:    time.Now().Truncate(time.Second).UTC(),
 	}
 	displayName := r.FormValue(oauthParamAlias)
 	if len(displayName) == 0 {
 		displayName = r.FormValue(oauthParamUsername)
 	}
 
 	err = h.DB.CreateUser(h.Config, newUser, displayName, "")
 	if err != nil {
 		return h.showOauthSignupPage(app, w, r, tp, err)
 	}
 
 	// Log invite if needed
 	if tp.InviteCode != "" {
 		err = app.db.CreateInvitedUser(tp.InviteCode, newUser.ID)
 		if err != nil {
 			return err
 		}
 	}
 
 	err = h.DB.RecordRemoteUserID(r.Context(), newUser.ID, r.FormValue(oauthParamTokenRemoteUserID), r.FormValue(oauthParamProvider), r.FormValue(oauthParamClientID), r.FormValue(oauthParamAccessToken))
 	if err != nil {
 		return h.showOauthSignupPage(app, w, r, tp, err)
 	}
 
 	if err := loginOrFail(h.Store, w, r, newUser); err != nil {
 		return h.showOauthSignupPage(app, w, r, tp, err)
 	}
 	return nil
 }
 
 func (h oauthHandler) validateOauthSignup(r *http.Request) error {
-	username := r.FormValue(oauthParamUsername)
+	// Validate the normalized username, since that's what we'll actually store as the user's name and collection alias
+	username := getSlug(r.FormValue(oauthParamUsername), "")
 	if len(username) < h.Config.App.MinUsernameLen {
 		return impart.HTTPError{Status: http.StatusBadRequest, Message: "Username is too short."}
 	}
 	if len(username) > 100 {
 		return impart.HTTPError{Status: http.StatusBadRequest, Message: "Username is too long."}
 	}
+	if !author.IsValidUsername(h.Config, username) {
+		return impart.HTTPError{Status: http.StatusPreconditionFailed, Message: "Username is reserved or isn't valid. It must be at least 3 characters long, and can only include letters, numbers, and hyphens."}
+	}
 	collTitle := r.FormValue(oauthParamAlias)
 	if len(collTitle) == 0 {
 		collTitle = username
 	}
 	email := r.FormValue(oauthParamEmail)
 	if len(email) > 0 {
 		parts := strings.Split(email, "@")
 		if len(parts) != 2 || (len(parts[0]) < 1 || len(parts[1]) < 1) {
 			return impart.HTTPError{Status: http.StatusBadRequest, Message: "Invalid email address"}
 		}
 	}
 	return nil
 }
 
 func (h oauthHandler) showOauthSignupPage(app *App, w http.ResponseWriter, r *http.Request, tp *oauthSignupPageParams, errMsg error) error {
 	username := tp.TokenUsername
 	collTitle := tp.TokenAlias
 	email := tp.TokenEmail
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// Ignore this
 		log.Error("Unable to get session; ignoring: %v", err)
 	}
 
 	if tmpValue := r.FormValue(oauthParamUsername); len(tmpValue) > 0 {
 		username = tmpValue
 	}
 	if tmpValue := r.FormValue(oauthParamAlias); len(tmpValue) > 0 {
 		collTitle = tmpValue
 	}
 	if tmpValue := r.FormValue(oauthParamEmail); len(tmpValue) > 0 {
 		email = tmpValue
 	}
 
 	p := &viewOauthSignupVars{
 		StaticPage: pageForReq(app, r),
 		To:         r.FormValue("to"),
 		Flashes:    []template.HTML{},
 
 		AccessToken:     tp.AccessToken,
 		TokenUsername:   tp.TokenUsername,
 		TokenAlias:      tp.TokenAlias,
 		TokenEmail:      tp.TokenEmail,
 		TokenRemoteUser: tp.TokenRemoteUser,
 		Provider:        tp.Provider,
 		ClientID:        tp.ClientID,
 		TokenHash:       tp.TokenHash,
 		InviteCode:      tp.InviteCode,
 
 		LoginUsername: username,
 		Alias:         collTitle,
 		Email:         email,
 	}
 
 	// Display any error messages
 	flashes, _ := getSessionFlashes(app, w, r, session)
 	for _, flash := range flashes {
 		p.Flashes = append(p.Flashes, template.HTML(flash))
 	}
 	if errMsg != nil {
 		p.Flashes = append(p.Flashes, template.HTML(errMsg.Error()))
 	}
 	err = pages["signup-oauth.tmpl"].ExecuteTemplate(w, "base", p)
 	if err != nil {
 		log.Error("Unable to render signup-oauth: %v", err)
 		return err
 	}
 	return nil
 }
diff --git a/pad.go b/pad.go
index 55dde70..199a4c3 100644
--- a/pad.go
+++ b/pad.go
@@ -1,193 +1,199 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"net/http"
 	"strings"
 
 	"github.com/gorilla/mux"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/page"
 )
 
 func handleViewPad(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	action := vars["action"]
 	slug := vars["slug"]
 	collAlias := vars["collection"]
 	if app.cfg.App.SingleUser {
 		// TODO: refactor all of this, especially for single-user blogs
 		c, err := app.db.GetCollectionByID(1)
 		if err != nil {
 			return err
 		}
 		collAlias = c.Alias
 	}
 	appData := &struct {
 		page.StaticPage
 		Post     *RawPost
 		User     *User
 		Blogs    *[]Collection
 		Silenced bool
 
 		Editing        bool        // True if we're modifying an existing post
 		EditCollection *Collection // Collection of the post we're editing, if any
 	}{
 		StaticPage: pageForReq(app, r),
 		Post:       &RawPost{Font: "norm"},
 		User:       getUserSession(app, r),
 	}
 	var err error
 	if appData.User != nil {
 		appData.Blogs, err = app.db.GetPublishableCollections(appData.User, app.cfg.App.Host)
 		if err != nil {
 			log.Error("Unable to get user's blogs for Pad: %v", err)
 		}
 		appData.Silenced, err = app.db.IsUserSilenced(appData.User.ID)
 		if err != nil {
 			if err == ErrUserNotFound {
 				return err
 			}
 			log.Error("Unable to get user status for Pad: %v", err)
 		}
 	}
 
 	padTmpl := app.cfg.App.Editor
 	if templates[padTmpl] == nil {
 		if padTmpl != "" {
 			log.Info("No template '%s' found. Falling back to default 'pad' template.", padTmpl)
 		}
 		padTmpl = "pad"
 	}
 
 	if action == "" && slug == "" {
 		// Not editing any post; simply render the Pad
 		if err = templates[padTmpl].ExecuteTemplate(w, "pad", appData); err != nil {
 			log.Error("Unable to execute template: %v", err)
 		}
 
 		return nil
 	}
 
 	// Retrieve post information for editing
 	appData.Editing = true
 	// Make sure this isn't cached, so user doesn't accidentally lose data
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	w.Header().Set("Expires", "Thu, 04 Oct 1990 20:00:00 GMT")
 	if slug != "" {
 		// TODO: refactor all of this, especially for single-user blogs
 		appData.Post = getRawCollectionPost(app, slug, collAlias)
 		if appData.Post.OwnerID != appData.User.ID {
 			// TODO: add ErrForbiddenEditPost message to flashes
 			return impart.HTTPError{http.StatusFound, r.URL.Path[:strings.LastIndex(r.URL.Path, "/edit")]}
 		}
 		appData.EditCollection, err = app.db.GetCollectionForPad(collAlias)
 		if err != nil {
 			log.Error("Unable to GetCollectionForPad: %s", err)
 			return err
 		}
 		appData.EditCollection.hostName = app.cfg.App.Host
 	} else {
 		// Editing a floating article
 		appData.Post = getRawPost(app, action)
 		appData.Post.Id = action
+		if appData.Post.OwnerID != appData.User.ID {
+			return impart.HTTPError{http.StatusFound, r.URL.Path[:strings.LastIndex(r.URL.Path, "/edit")]}
+		}
 	}
 
 	if appData.Post.Gone {
 		return ErrPostUnpublished
 	} else if appData.Post.Found && (appData.Post.Title != "" || appData.Post.Content != "") {
 		// Got the post
 	} else if appData.Post.Found {
 		log.Error("Found post, but other conditions failed.")
 		return ErrPostFetchError
 	} else {
 		return ErrPostNotFound
 	}
 
 	if err = templates[padTmpl].ExecuteTemplate(w, "pad", appData); err != nil {
 		log.Error("Unable to execute template: %v", err)
 	}
 	return nil
 }
 
 func handleViewMeta(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	action := vars["action"]
 	slug := vars["slug"]
 	collAlias := vars["collection"]
 	appData := &struct {
 		page.StaticPage
 		Post           *RawPost
 		User           *User
 		EditCollection *Collection // Collection of the post we're editing, if any
 		Flashes        []string
 		NeedsToken     bool
 		Silenced       bool
 	}{
 		StaticPage: pageForReq(app, r),
 		Post:       &RawPost{Font: "norm"},
 		User:       getUserSession(app, r),
 	}
 	var err error
 	appData.Silenced, err = app.db.IsUserSilenced(appData.User.ID)
 	if err != nil {
 		log.Error("view meta: get user status: %v", err)
 		return ErrInternalGeneral
 	}
 
 	if action == "" && slug == "" {
 		return ErrPostNotFound
 	}
 
 	// Make sure this isn't cached, so user doesn't accidentally lose data
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	w.Header().Set("Expires", "Thu, 28 Jul 1989 12:00:00 GMT")
 	if slug != "" {
 		appData.Post = getRawCollectionPost(app, slug, collAlias)
 		if appData.Post.OwnerID != appData.User.ID {
 			// TODO: add ErrForbiddenEditPost message to flashes
 			return impart.HTTPError{http.StatusFound, r.URL.Path[:strings.LastIndex(r.URL.Path, "/meta")]}
 		}
 		if app.cfg.App.SingleUser {
 			// TODO: optimize this query just like we do in GetCollectionForPad (?)
 			appData.EditCollection, err = app.db.GetCollectionByID(1)
 		} else {
 			appData.EditCollection, err = app.db.GetCollectionForPad(collAlias)
 		}
 		if err != nil {
 			return err
 		}
 		appData.EditCollection.hostName = app.cfg.App.Host
 	} else {
 		// Editing a floating article
 		appData.Post = getRawPost(app, action)
 		appData.Post.Id = action
+		if appData.Post.OwnerID != appData.User.ID {
+			return impart.HTTPError{http.StatusFound, r.URL.Path[:strings.LastIndex(r.URL.Path, "/meta")]}
+		}
 	}
 	appData.NeedsToken = appData.User == nil || appData.User.ID != appData.Post.OwnerID
 
 	if appData.Post.Gone {
 		return ErrPostUnpublished
 	} else if appData.Post.Found && appData.Post.Content != "" {
 		// Got the post
 	} else if appData.Post.Found {
 		return ErrPostFetchError
 	} else {
 		return ErrPostNotFound
 	}
 	appData.Flashes, _ = getSessionFlashes(app, w, r, nil)
 
 	if err = templates["edit-meta"].ExecuteTemplate(w, "edit-meta", appData); err != nil {
 		log.Error("Unable to execute template: %v", err)
 	}
 	return nil
 }
diff --git a/page/page.go b/page/page.go
index 057f034..18a842f 100644
--- a/page/page.go
+++ b/page/page.go
@@ -1,49 +1,50 @@
 /*
  * Copyright © 2018-2019, 2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 // package page provides mechanisms and data for generating a WriteFreely page.
 package page
 
 import (
 	"strings"
 
 	"github.com/writefreely/writefreely/config"
 )
 
 type StaticPage struct {
 	// App configuration
 	config.AppCfg
 	Version   string
 	HeaderNav bool
 	CustomCSS bool
 
 	// Request values
-	Path          string
-	Username      string
-	Values        map[string]string
-	Flashes       []string
-	CanViewReader bool
-	IsAdmin       bool
-	CanInvite     bool
+	Path            string
+	Username        string
+	Values          map[string]string
+	Flashes         []string
+	CanViewReader   bool
+	IsAdmin         bool
+	CanInvite       bool
+	UpdateAvailable bool
 }
 
 // SanitizeHost alters the StaticPage to contain a real hostname. This is
 // especially important for the Tor hidden service, as it can be served over
 // proxies, messing up the apparent hostname.
 func (sp *StaticPage) SanitizeHost(cfg *config.Config) {
 	if cfg.Server.HiddenHost != "" && strings.HasPrefix(sp.Host, cfg.Server.HiddenHost) {
 		sp.Host = cfg.Server.HiddenHost
 	}
 }
 
 func (sp StaticPage) OfficialVersion() string {
 	p := strings.Split(sp.Version, "-")
 	return p[0]
 }
diff --git a/postrender.go b/postrender.go
index 2e3bc8c..2fb8b72 100644
--- a/postrender.go
+++ b/postrender.go
@@ -1,381 +1,381 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"bytes"
 	"encoding/json"
 	"fmt"
 	"html"
 	"html/template"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strings"
 	"unicode"
 	"unicode/utf8"
 
 	"github.com/microcosm-cc/bluemonday"
 	stripmd "github.com/writeas/go-strip-markdown/v2"
 	"github.com/writeas/impart"
 	blackfriday "github.com/writeas/saturday"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/stringmanip"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/parse"
 	"github.com/writefreely/writefreely/spam"
 )
 
 var (
 	blockReg        = regexp.MustCompile("<(ul|ol|blockquote)>\n")
 	endBlockReg     = regexp.MustCompile("</([a-z]+)>\n</(ul|ol|blockquote)>")
 	youtubeReg      = regexp.MustCompile("(https?://www.youtube.com/embed/[a-zA-Z0-9\\-_]+)(\\?[^\t\n\f\r \"']+)?")
 	titleElementReg = regexp.MustCompile("</?h[1-6]>")
 	hashtagReg      = regexp.MustCompile(`{{\[\[\|\|([^|]+)\|\|\]\]}}`)
 	markeddownReg   = regexp.MustCompile("<p>(.+)</p>")
 	mentionReg      = regexp.MustCompile(`@([A-Za-z0-9._%+-]+)(@[A-Za-z0-9.-]+\.[A-Za-z]+)\b`)
 )
 
 func (p *Post) handlePremiumContent(c *Collection, isOwner, postPage bool, cfg *config.Config) {
 	if c.Monetization != "" {
 		// User has Web Monetization enabled, so split content if it exists
 		spl := strings.Index(p.Content, shortCodePaid)
 		p.IsPaid = spl > -1
 		if postPage {
 			// We're viewing the individual post
 			if isOwner {
 				p.Content = strings.Replace(p.Content, shortCodePaid, "\n\n"+`<p class="split">Your subscriber content begins here.</p>`+"\n\n", 1)
 			} else {
 				if spl > -1 {
 					p.Content = p.Content[:spl+len(shortCodePaid)]
 					p.Content = strings.Replace(p.Content, shortCodePaid, "\n\n"+`<p class="split">Continue reading with <strong>Web Monetization</strong>.</p>`+"\n\n", 1)
 				}
 			}
 		} else {
 			// We've viewing the post on the collection landing
 			if spl > -1 {
 				baseURL := c.CanonicalURL()
 				if isOwner {
 					baseURL = "/" + c.Alias + "/"
 				}
 
 				p.Content = p.Content[:spl+len(shortCodePaid)]
 				p.HTMLExcerpt = template.HTML(applyMarkdown([]byte(p.Content[:spl]), baseURL, cfg))
 			}
 		}
 	}
 }
 
 func (p *Post) formatContent(cfg *config.Config, c *Collection, isOwner bool, isPostPage bool) {
 	baseURL := c.CanonicalURL()
 	// TODO: redundant
 	if !isSingleUser {
 		baseURL = "/" + c.Alias + "/"
 	}
 
 	p.handlePremiumContent(c, isOwner, isPostPage, cfg)
 	p.Content = strings.Replace(p.Content, "&lt;!--paid-->", "<!--paid-->", 1)
 
 	p.HTMLTitle = template.HTML(applyBasicMarkdown([]byte(p.Title.String)))
 	p.HTMLContent = template.HTML(applyMarkdown([]byte(p.Content), baseURL, cfg))
 	if exc := strings.Index(string(p.Content), "<!--more-->"); exc > -1 {
 		p.HTMLExcerpt = template.HTML(applyMarkdown([]byte(p.Content[:exc]), baseURL, cfg))
 	}
 }
 
 func (p *PublicPost) formatContent(cfg *config.Config, isOwner bool, isPostPage bool) {
 	p.Post.formatContent(cfg, &p.Collection.Collection, isOwner, isPostPage)
 }
 
 func (p *Post) augmentContent(c *Collection) {
 	if p.PinnedPosition.Valid {
 		// Don't augment posts that are pinned
 		return
 	}
 	if strings.Index(p.Content, shortCodeNoSig) > -1 {
 		// Don't augment posts with the special "nosig" shortcode
 		return
 	}
 	// Add post signatures
-	if c.Signature != "" {
+	if c.Signature != "" && !strings.HasSuffix(strings.TrimSpace(p.Content), strings.TrimSpace(c.Signature)) {
 		p.Content += "\n\n" + c.Signature
 	}
 }
 
 func (p *PublicPost) augmentContent() {
 	p.Post.augmentContent(&p.Collection.Collection)
 }
 
 func (p *PublicPost) augmentReadingDestination() {
 	if p.IsPaid {
 		p.HTMLContent += template.HTML("\n\n" + `<p><a class="read-more" href="` + p.Collection.CanonicalURL() + p.Slug.String + `">` + localStr("Read more...", p.Language.String) + `</a> ($)</p>`)
 	}
 }
 
 func applyMarkdown(data []byte, baseURL string, cfg *config.Config) string {
 	return applyMarkdownSpecial(data, baseURL, cfg, cfg.App.SingleUser)
 }
 
 func disableYoutubeAutoplay(outHTML string) string {
 	for _, match := range youtubeReg.FindAllString(outHTML, -1) {
 		u, err := url.Parse(match)
 		if err != nil {
 			continue
 		}
 		u.RawQuery = html.UnescapeString(u.RawQuery)
 		q := u.Query()
 		// Set Youtube autoplay url parameter, if any, to 0
 		if len(q["autoplay"]) == 1 {
 			q.Set("autoplay", "0")
 		}
 		u.RawQuery = q.Encode()
 		cleanURL := u.String()
 		outHTML = strings.Replace(outHTML, match, cleanURL, 1)
 	}
 	return outHTML
 }
 
 func applyMarkdownSpecial(data []byte, baseURL string, cfg *config.Config, skipNoFollow bool) string {
 	mdExtensions := 0 |
 		blackfriday.EXTENSION_TABLES |
 		blackfriday.EXTENSION_FENCED_CODE |
 		blackfriday.EXTENSION_AUTOLINK |
 		blackfriday.EXTENSION_STRIKETHROUGH |
 		blackfriday.EXTENSION_SPACE_HEADERS |
 		blackfriday.EXTENSION_AUTO_HEADER_IDS
 	htmlFlags := 0 |
 		blackfriday.HTML_USE_SMARTYPANTS |
 		blackfriday.HTML_SMARTYPANTS_DASHES
 
 	if baseURL != "" {
 		htmlFlags |= blackfriday.HTML_HASHTAGS
 	}
 
 	// Generate Markdown
 	md := blackfriday.Markdown([]byte(data), blackfriday.HtmlRenderer(htmlFlags, "", ""), mdExtensions)
 	if baseURL != "" {
 		// Replace special text generated by Markdown parser
 		tagPrefix := baseURL + "tag:"
 		if cfg.App.Chorus {
 			tagPrefix = "/read/t/"
 		}
 		md = []byte(hashtagReg.ReplaceAll(md, []byte("<a href=\""+tagPrefix+"$1\" class=\"hashtag\"><span>#</span><span class=\"p-category\">$1</span></a>")))
 		handlePrefix := cfg.App.Host + "/@/"
 		md = []byte(mentionReg.ReplaceAll(md, []byte("<a href=\""+handlePrefix+"$1$2\" class=\"u-url mention\">@<span>$1$2</span></a>")))
 	}
 	// Strip out bad HTML
 	policy := getSanitizationPolicy()
 	policy.RequireNoFollowOnLinks(!skipNoFollow)
 	outHTML := string(policy.SanitizeBytes(md))
 	// Strip newlines on certain block elements that render with them
 	outHTML = blockReg.ReplaceAllString(outHTML, "<$1>")
 	outHTML = endBlockReg.ReplaceAllString(outHTML, "</$1></$2>")
 	outHTML = disableYoutubeAutoplay(outHTML)
 	return outHTML
 }
 
 func applyBasicMarkdown(data []byte) string {
 	if len(bytes.TrimSpace(data)) == 0 {
 		return ""
 	}
 
 	mdExtensions := 0 |
 		blackfriday.EXTENSION_STRIKETHROUGH |
 		blackfriday.EXTENSION_SPACE_HEADERS |
 		blackfriday.EXTENSION_HEADER_IDS
 	htmlFlags := 0 |
 		blackfriday.HTML_SKIP_HTML |
 		blackfriday.HTML_USE_SMARTYPANTS |
 		blackfriday.HTML_SMARTYPANTS_DASHES
 
 	// Generate Markdown
 	// This passes the supplied title into blackfriday.Markdown() as an H1 header, so we only render HTML that
 	// belongs in an H1.
 	md := blackfriday.Markdown(append([]byte("# "), data...), blackfriday.HtmlRenderer(htmlFlags, "", ""), mdExtensions)
 	// Remove H1 markup
 	md = bytes.TrimSpace(md) // blackfriday.Markdown adds a newline at the end of the <h1>
 	if len(md) == 0 {
 		return ""
 	}
 	md = md[len("<h1>") : len(md)-len("</h1>")]
 	// Strip out bad HTML
 	policy := bluemonday.UGCPolicy()
 	policy.AllowAttrs("class", "id").Globally()
 	outHTML := string(policy.SanitizeBytes(md))
 	outHTML = markeddownReg.ReplaceAllString(outHTML, "$1")
 	outHTML = strings.TrimRightFunc(outHTML, unicode.IsSpace)
 
 	return outHTML
 }
 
 func postTitle(content, friendlyId string) string {
 	const maxTitleLen = 80
 
 	content = stripHTMLWithoutEscaping(content)
 
 	content = strings.TrimLeftFunc(stripmd.Strip(content), unicode.IsSpace)
 	eol := strings.IndexRune(content, '\n')
 	blankLine := strings.Index(content, "\n\n")
 	if blankLine != -1 && blankLine <= eol && blankLine <= assumedTitleLen {
 		return strings.TrimSpace(content[:blankLine])
 	} else if utf8.RuneCountInString(content) <= maxTitleLen {
 		return content
 	}
 	return friendlyId
 }
 
 // TODO: fix duplicated code from postTitle. postTitle is a widely used func we
 // don't have time to investigate right now.
 func friendlyPostTitle(content, friendlyId string) string {
 	const maxTitleLen = 80
 
 	content = stripHTMLWithoutEscaping(content)
 
 	content = strings.TrimLeftFunc(stripmd.Strip(content), unicode.IsSpace)
 	eol := strings.IndexRune(content, '\n')
 	blankLine := strings.Index(content, "\n\n")
 	if blankLine != -1 && blankLine <= eol && blankLine <= assumedTitleLen {
 		return strings.TrimSpace(content[:blankLine])
 	} else if eol == -1 && utf8.RuneCountInString(content) <= maxTitleLen {
 		return content
 	}
 	title, truncd := parse.TruncToWord(parse.PostLede(content, true), maxTitleLen)
 	if truncd {
 		title += "..."
 	}
 	return title
 }
 
 // Strip HTML tags with bluemonday's StrictPolicy, then unescape the HTML
 // entities added in by sanitizing the content.
 func stripHTMLWithoutEscaping(content string) string {
 	return html.UnescapeString(bluemonday.StrictPolicy().Sanitize(content))
 }
 
 func getSanitizationPolicy() *bluemonday.Policy {
 	policy := bluemonday.UGCPolicy()
 	policy.AllowAttrs("src", "style").OnElements("iframe", "video", "audio")
 	policy.AllowAttrs("src", "type").OnElements("source")
 	policy.AllowAttrs("frameborder", "width", "height").Matching(bluemonday.Integer).OnElements("iframe")
 	policy.AllowAttrs("allowfullscreen").OnElements("iframe")
 	policy.AllowAttrs("controls", "loop", "muted", "autoplay").OnElements("video")
 	policy.AllowAttrs("controls", "loop", "muted", "autoplay", "preload").OnElements("audio")
 	policy.AllowAttrs("target").OnElements("a")
 	policy.AllowAttrs("title").OnElements("abbr")
 	policy.AllowAttrs("style", "class", "id").Globally()
 	policy.AllowAttrs("alt").OnElements("img")
 	policy.AllowElements("header", "footer")
 	policy.AllowAttrs("method", "action").OnElements("form")
 	policy.AllowAttrs("type", "name", "value", "placeholder").OnElements("input")
 	policy.AllowURLSchemes("http", "https", "mailto", "xmpp", "gopher", "gophers", "gemini", "spartan")
 	return policy
 }
 
 func sanitizePost(content string) string {
 	return strings.Replace(content, "<", "&lt;", -1)
 }
 
 // postDescription generates a description based on the given post content,
 // title, and post ID. This doesn't consider a V2 post field, `title` when
 // choosing what to generate. In case a post has a title, this function will
 // fail, and logic should instead be implemented to skip this when there's no
 // title, like so:
 //
 //	var desc string
 //	if title == "" {
 //	    desc = postDescription(content, title, friendlyId)
 //	} else {
 //	    desc = shortPostDescription(content)
 //	}
 func postDescription(content, title, friendlyId string) string {
 	maxLen := 140
 
 	if content == "" {
 		content = "WriteFreely is a painless, simple, federated blogging platform."
 	} else {
 		fmtStr := "%s"
 		truncation := 0
 		if utf8.RuneCountInString(content) > maxLen {
 			// Post is longer than the max description, so let's show a better description
 			fmtStr = "%s..."
 			truncation = 3
 		}
 
 		if title == friendlyId {
 			// No specific title was found; simply truncate the post, starting at the beginning
 			content = fmt.Sprintf(fmtStr, strings.Replace(stringmanip.Substring(content, 0, maxLen-truncation), "\n", " ", -1))
 		} else {
 			// There was a title, so return a real description
 			blankLine := strings.Index(content, "\n\n")
 			if blankLine < 0 {
 				blankLine = 0
 			}
 			truncd := stringmanip.Substring(content, blankLine, blankLine+maxLen-truncation)
 			contentNoNL := strings.Replace(truncd, "\n", " ", -1)
 			content = strings.TrimSpace(fmt.Sprintf(fmtStr, contentNoNL))
 		}
 	}
 
 	return content
 }
 
 func shortPostDescription(content string) string {
 	maxLen := 140
 	fmtStr := "%s"
 	truncation := 0
 	if utf8.RuneCountInString(content) > maxLen {
 		// Post is longer than the max description, so let's show a better description
 		fmtStr = "%s..."
 		truncation = 3
 	}
 	return strings.TrimSpace(fmt.Sprintf(fmtStr, strings.Replace(stringmanip.Substring(content, 0, maxLen-truncation), "\n", " ", -1)))
 }
 
 func handleRenderMarkdown(app *App, w http.ResponseWriter, r *http.Request) error {
 	if !IsJSON(r) {
 		return impart.HTTPError{Status: http.StatusUnsupportedMediaType, Message: "Markdown API only supports JSON requests"}
 	}
 
 	in := struct {
 		CollectionURL string `json:"collection_url"`
 		RawBody       string `json:"raw_body"`
 	}{}
 
 	decoder := json.NewDecoder(r.Body)
 	err := decoder.Decode(&in)
 	if err != nil {
 		log.Error("Couldn't parse markdown JSON request: %v", err)
 		return ErrBadJSON
 	}
 
 	body := in.RawBody
 	if in.CollectionURL != "" {
 		body = strings.Replace(body, shortCodeMore, `<a href="/">Read more...</a>`, 1)
 		body = alterShortCodeEmailSubForm(body, "example", "slug", true)
 	}
 	rendered := applyMarkdown([]byte(in.RawBody), in.CollectionURL, app.cfg)
 	out := struct {
 		Body string `json:"body"`
 	}{
 		Body: rendered,
 	}
 
 	return impart.WriteSuccess(w, out, http.StatusOK)
 }
 
 func alterShortCodeEmailSubForm(postContent, alias, slug string, isDisabled bool) string {
 	subURL := `/api/collections/` + alias + `/email/subscribe`
 	if isDisabled {
 		subURL = ""
 	}
 	formHTML := `<form method="post" id="emailsub" action="` + subURL + `"><input type="hidden" name="slug" value="` + slug + `" /><input type="hidden" name="web" value="1" /><div style="position: absolute; left: -5000px;" aria-hidden="true"><input type="email" name="` + spam.HoneypotFieldName() + `" tabindex="-1" value="" /><input type="password" name="fake_password" tabindex="-1" placeholder="password" autocomplete="new-password" /></div><input type="email" name="email" placeholder="me@example.com" /><input type="submit" id="subscribe-btn" value="Subscribe" /></form>`
 	return strings.Replace(postContent, shortCodeEmailSub, formHTML, -1)
 }
diff --git a/posts.go b/posts.go
index 1e48c6f..117e8b3 100644
--- a/posts.go
+++ b/posts.go
@@ -1,1773 +1,1811 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strings"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/gosimple/slug"
 	"github.com/guregu/null"
 	"github.com/guregu/null/zero"
 	"github.com/kylemcc/twitter-text-go/extract"
 	"github.com/microcosm-cc/bluemonday"
 	stripmd "github.com/writeas/go-strip-markdown/v2"
 	"github.com/writeas/impart"
 	"github.com/writeas/monday"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/bots"
 	"github.com/writeas/web-core/converter"
 	"github.com/writeas/web-core/i18n"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/tags"
 	"github.com/writefreely/writefreely/page"
 	"github.com/writefreely/writefreely/parse"
 )
 
 const (
 	// Post ID length bounds
 	minIDLen      = 10
 	maxIDLen      = 10
 	userPostIDLen = 10
 	postIDLen     = 10
 
 	postMetaDateFormat = "2006-01-02T15:04:05Z"
 )
 
 type PostType string
 
 const (
 	postArch PostType = "archive"
 
 	shortCodeMore     = "<!--more-->"
 	shortCodePaid     = "<!--paid-->"
 	shortCodeNoSig    = "<!--nosig-->"
 	shortCodeEmailSub = "<!--emailsub-->"
 )
 
 type (
 	AnonymousPost struct {
 		ID          string
 		Content     string
 		HTMLContent template.HTML
 		Font        string
 		Language    string
 		Direction   string
 		Title       string
 		GenTitle    string
 		Description string
 		Author      string
 		Views       int64
 		Images      []string
 		IsPlainText bool
 		IsCode      bool
 		IsLinkable  bool
 	}
 
 	AuthenticatedPost struct {
 		ID  string `json:"id" schema:"id"`
 		Web bool   `json:"web" schema:"web"`
 		*SubmittedPost
 	}
 
 	// SubmittedPost represents a post supplied by a client for publishing or
 	// updating. Since Title and Content can be updated to "", they are
 	// pointers that can be easily tested to detect changes.
 	SubmittedPost struct {
 		Slug     *string                  `json:"slug" schema:"slug"`
 		Title    *string                  `json:"title" schema:"title"`
 		Content  *string                  `json:"body" schema:"body"`
 		Font     string                   `json:"font" schema:"font"`
 		IsRTL    converter.NullJSONBool   `json:"rtl" schema:"rtl"`
 		Language converter.NullJSONString `json:"lang" schema:"lang"`
 		Created  *string                  `json:"created" schema:"created"`
 	}
 
 	// Post represents a post as found in the database.
 	Post struct {
 		ID             string        `db:"id" json:"id"`
 		Slug           null.String   `db:"slug" json:"slug,omitempty"`
 		Font           string        `db:"text_appearance" json:"appearance"`
 		Language       zero.String   `db:"language" json:"language"`
 		RTL            zero.Bool     `db:"rtl" json:"rtl"`
 		Privacy        int64         `db:"privacy" json:"-"`
 		OwnerID        null.Int      `db:"owner_id" json:"-"`
 		CollectionID   null.Int      `db:"collection_id" json:"-"`
 		PinnedPosition null.Int      `db:"pinned_position" json:"-"`
 		Created        time.Time     `db:"created" json:"created"`
 		Updated        time.Time     `db:"updated" json:"updated"`
 		ViewCount      int64         `db:"view_count" json:"-"`
 		LikeCount      int64         `db:"like_count" json:"likes"`
 		Title          zero.String   `db:"title" json:"title"`
 		HTMLTitle      template.HTML `db:"title" json:"-"`
 		Content        string        `db:"content" json:"body"`
 		HTMLContent    template.HTML `db:"content" json:"-"`
 		HTMLExcerpt    template.HTML `db:"content" json:"-"`
 		Tags           []string      `json:"tags"`
 		Images         []string      `json:"images,omitempty"`
 		IsPaid         bool          `json:"paid"`
 
 		OwnerName string `json:"owner,omitempty"`
 	}
 
 	// PublicPost holds properties for a publicly returned post, i.e. a post in
 	// a context where the viewer may not be the owner. As such, sensitive
 	// metadata for the post is hidden and properties supporting the display of
 	// the post are added.
 	PublicPost struct {
 		*Post
 		IsSubdomain bool           `json:"-"`
 		IsTopLevel  bool           `json:"-"`
 		DisplayDate string         `json:"-"`
 		Views       int64          `json:"views"`
 		Likes       int64          `json:"likes"`
 		Owner       *PublicUser    `json:"-"`
 		IsOwner     bool           `json:"-"`
 		URL         string         `json:"url,omitempty"`
 		Collection  *CollectionObj `json:"collection,omitempty"`
 	}
 
 	CollectionPostPage struct {
 		*PublicPost
 		page.StaticPage
 		IsOwner         bool
 		IsPinned        bool
 		IsCustomDomain  bool
 		Monetization    string
 		Verification    string
 		FediverseAuthor string
 		PinnedPosts     *[]PublicPost
 		IsFound         bool
 		IsAdmin         bool
 		CanInvite       bool
 		Silenced        bool
 
 		// Helper field for Chorus mode
 		CollAlias string
 	}
 
 	RawPost struct {
 		Id, Slug     string
 		Title        string
 		Content      string
 		Views        int64
 		Font         string
 		Created      time.Time
 		Updated      time.Time
 		IsRTL        sql.NullBool
 		Language     sql.NullString
 		OwnerID      int64
 		CollectionID sql.NullInt64
 
 		Found bool
 		Gone  bool
 	}
 
 	AnonymousAuthPost struct {
 		ID    string `json:"id"`
 		Token string `json:"token"`
 	}
 	ClaimPostRequest struct {
 		*AnonymousAuthPost
 		CollectionAlias  string `json:"collection"`
 		CreateCollection bool   `json:"create_collection"`
 
 		// Generated properties
 		Slug string `json:"-"`
 	}
 	ClaimPostResult struct {
 		ID           string      `json:"id,omitempty"`
 		Code         int         `json:"code,omitempty"`
 		ErrorMessage string      `json:"error_msg,omitempty"`
 		Post         *PublicPost `json:"post,omitempty"`
 	}
 )
 
 func (p *Post) Direction() string {
 	if p.RTL.Valid {
 		if p.RTL.Bool {
 			return "rtl"
 		}
 		return "ltr"
 	}
 	return "auto"
 }
 
 // DisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) DisplayTitle() string {
 	if p.Title.String != "" {
 		return p.Title.String
 	}
 	t := friendlyPostTitle(p.Content, p.ID)
 	return t
 }
 
-// PlainDisplayTitle strips away Markdown from the generated Post's title (if
-// any), for use in places like RSS feeds and ActivityStreams objects, where
-// the raw Markdown would be unwanted.
+// PlainDisplayTitle strips away Markdown and HTML from the generated Post's
+// title (if any), for use in places like RSS feeds and ActivityStreams objects,
+// where only plain text is wanted.
 func (p *Post) PlainDisplayTitle() string {
-	if t := stripmd.Strip(p.DisplayTitle()); t != "" {
+	if t := stripmd.Strip(stripHTMLWithoutEscaping(p.DisplayTitle())); t != "" {
 		return t
 	}
 	return p.ID
 }
 
 // FormattedDisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) FormattedDisplayTitle() template.HTML {
 	if p.HTMLTitle != "" {
 		return p.HTMLTitle
 	}
 	return template.HTML(p.DisplayTitle())
 }
 
 // Summary gives a shortened summary of the post based on the post's title,
 // especially for display in a longer list of posts. It extracts a summary for
 // posts in the Title\n\nBody format, returning nothing if the entire was short
 // enough that the extracted title == extracted summary.
 func (p Post) Summary() string {
 	if p.Content == "" {
 		return ""
 	}
 	p.Content = stripHTMLWithoutEscaping(p.Content)
 	// and Markdown
 	p.Content = stripmd.StripOptions(p.Content, stripmd.Options{SkipImages: true})
 
 	title := p.Title.String
 	var desc string
 	if title == "" {
 		// No title, so generate one
 		title = friendlyPostTitle(p.Content, p.ID)
 		desc = postDescription(p.Content, title, p.ID)
 		if desc == title {
 			return ""
 		}
 		return desc
 	}
 
 	return shortPostDescription(p.Content)
 }
 
 func (p Post) SummaryHTML() template.HTML {
 	return template.HTML(p.Summary())
 }
 
 // Excerpt shows any text that comes before a (more) tag.
 // TODO: use HTMLExcerpt in templates instead of this method
 func (p *Post) Excerpt() template.HTML {
 	return p.HTMLExcerpt
 }
 
 func (p *Post) CreatedDate() string {
 	return p.Created.Format("2006-01-02")
 }
 
 func (p *Post) Created8601() string {
 	return p.Created.Format("2006-01-02T15:04:05Z")
 }
 
 func (p *Post) IsScheduled() bool {
 	return p.Created.After(time.Now())
 }
 
 func (p *Post) HasTag(tag string) bool {
 	// Regexp looks for tag and has a non-capturing group at the end looking
 	// for the end of the word.
 	// Assisted by: https://stackoverflow.com/a/35192941/1549194
 	hasTag, _ := regexp.MatchString("#"+tag+`(?:[[:punct:]]|\s|\z)`, p.Content)
 	return hasTag
 }
 
 func (p *Post) HasTitleLink() bool {
 	if p.Title.String == "" {
 		return false
 	}
 	hasLink, _ := regexp.MatchString(`([^!]+|^)\[.+\]\(.+\)`, p.Title.String)
 	return hasLink
 }
 
+// UserPage provides the fields expected by the shared "user-navigation"
+// template, which otherwise assumes it's rendering for a page that embeds
+// *UserPage (e.g. the "me" backend pages).
+func (c CollectionPostPage) UserPage() *UserPage {
+	return &UserPage{
+		StaticPage: c.StaticPage,
+		IsAdmin:    c.IsAdmin,
+		CanInvite:  c.CanInvite,
+		CollAlias:  c.CollAlias,
+	}
+}
+
 func (c CollectionPostPage) DisplayMonetization() string {
 	if c.Collection == nil {
 		log.Info("CollectionPostPage.DisplayMonetization: c.Collection is nil")
 		return ""
 	}
 	return displayMonetization(c.Monetization, c.Collection.Alias)
 }
 
 func handleViewPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	friendlyID := vars["post"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw() and viewCollectionPost()
 	isJSON := strings.HasSuffix(friendlyID, ".json")
 	isXML := strings.HasSuffix(friendlyID, ".xml")
 	isCSS := strings.HasSuffix(friendlyID, ".css")
 	isMarkdown := strings.HasSuffix(friendlyID, ".md")
 	isRaw := strings.HasSuffix(friendlyID, ".txt") || isJSON || isXML || isCSS || isMarkdown
 
 	// Display reserved page if that is requested resource
 	if t, ok := pages[r.URL.Path[1:]+".tmpl"]; ok {
 		return handleTemplatedPage(app, w, r, t)
 	} else if r.URL.Path == "/sitemap.xml" && !app.cfg.App.SingleUser {
 		return impart.HTTPError{Status: http.StatusNotFound, Message: "Page not found."}
 	} else if (strings.Contains(r.URL.Path, ".") && !isRaw && !isMarkdown) || r.URL.Path == "/robots.txt" || r.URL.Path == "/manifest.json" {
 		// Serve static file
 		app.shttp.ServeHTTP(w, r)
 		return nil
 	}
 
 	// Display collection if this is a collection
 	c, _ := app.db.GetCollection(friendlyID)
 	if c != nil {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", friendlyID)}
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	if friendlyID != strings.ToLower(friendlyID) {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s", strings.ToLower(friendlyID))}
 	}
 
 	ext := ""
 	if isRaw {
 		parts := strings.Split(friendlyID, ".")
 		friendlyID = parts[0]
 		if len(parts) > 1 {
 			ext = "." + parts[1]
 		}
 	}
 
 	var ownerID sql.NullInt64
 	var collectionID sql.NullInt64
 	var title string
 	var content string
 	var font string
 	var language []byte
 	var rtl []byte
 	var views int64
 	var post *AnonymousPost
 	var found bool
 	var gone bool
 
 	fixedID := slug.Make(friendlyID)
 	if fixedID != friendlyID {
 		return impart.HTTPError{http.StatusFound, fmt.Sprintf("/%s%s", fixedID, ext)}
 	}
 
 	err := app.db.QueryRow("SELECT owner_id, collection_id, title, content, text_appearance, view_count, language, rtl FROM posts WHERE id = ?", friendlyID).Scan(&ownerID, &collectionID, &title, &content, &font, &views, &language, &rtl)
 	switch {
 	case err == sql.ErrNoRows:
 		found = false
 
 		// Output the error in the correct format
 		if isJSON {
 			content = "{\"error\": \"Post not found.\"}"
 		} else if isRaw {
 			content = "Post not found."
 		} else {
 			return ErrPostNotFound
 		}
 	case err != nil:
 		found = false
 
 		log.Error("Post loading err: %s\n", err)
 		return ErrInternalGeneral
 	default:
 		found = true
 
 		var d string
 		if len(rtl) == 0 {
 			d = "auto"
 		} else if rtl[0] == 49 {
 			// TODO: find a cleaner way to get this (possibly NULL) value
 			d = "rtl"
 		} else {
 			d = "ltr"
 		}
 		generatedTitle := friendlyPostTitle(content, friendlyID)
 		sanitizedContent := content
 		if font != "code" {
 			sanitizedContent = template.HTMLEscapeString(content)
 		}
 		var desc string
 		if title == "" {
 			desc = postDescription(content, title, friendlyID)
 		} else {
 			desc = shortPostDescription(content)
 		}
 		post = &AnonymousPost{
 			ID:          friendlyID,
 			Content:     sanitizedContent,
 			Title:       title,
 			GenTitle:    generatedTitle,
 			Description: desc,
 			Author:      "",
 			Font:        font,
 			IsPlainText: isRaw,
 			IsCode:      font == "code",
 			IsLinkable:  font != "code",
 			Views:       views,
 			Language:    string(language),
 			Direction:   d,
 		}
 		if !isRaw {
 			post.HTMLContent = template.HTML(applyMarkdown([]byte(content), "", app.cfg))
 			post.Images = extractImages(post.Content)
 		}
 	}
 
 	var silenced bool
 	if found {
 		silenced, err = app.db.IsUserSilenced(ownerID.Int64)
 		if err != nil {
 			log.Error("view post: %v", err)
 		}
 	}
 
 	var protectDraft bool
 	if found && collectionID.Valid {
 		collection, err := app.db.GetCollectionByID(collectionID.Int64)
 		if err != nil {
 			log.Error("view post: %v", err)
 		}
 
 		protectDraft = collection.IsPrivate() || collection.IsProtected()
 	}
 
 	// Check if post has been unpublished
 	if title == "" && content == "" {
 		gone = true
 
 		if isJSON {
 			content = "{\"error\": \"Post was unpublished.\"}"
 		} else if isCSS {
 			content = ""
 		} else if isRaw {
 			content = "Post was unpublished."
 		} else {
 			return ErrPostUnpublished
 		}
 	}
 
 	var u = &User{}
 	if isRaw {
 		contentType := "text/plain"
 		if isJSON {
 			contentType = "application/json"
 		} else if isCSS {
 			contentType = "text/css"
 		} else if isXML {
 			contentType = "application/xml"
 		} else if isMarkdown {
 			contentType = "text/markdown"
 		}
 		w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
 		if isMarkdown && post.Title != "" {
 			fmt.Fprintf(w, "%s\n", post.Title)
 			for i := 1; i <= len(post.Title); i++ {
 				fmt.Fprintf(w, "=")
 			}
 			fmt.Fprintf(w, "\n\n")
 		}
 		fmt.Fprint(w, content)
 
 		if !found {
 			return ErrPostNotFound
 		} else if gone {
 			return ErrPostUnpublished
 		}
 	} else {
 		var err error
 		page := struct {
 			*AnonymousPost
 			page.StaticPage
 			Username string
 			IsOwner  bool
 			SiteURL  string
 			Silenced bool
 		}{
 			AnonymousPost: post,
 			StaticPage:    pageForReq(app, r),
 			SiteURL:       app.cfg.App.Host,
 		}
 		if u = getUserSession(app, r); u != nil {
 			page.Username = u.Username
 			page.IsOwner = ownerID.Valid && ownerID.Int64 == u.ID
 		}
 
 		if !page.IsOwner && silenced {
 			return ErrPostNotFound
 		}
 
 		if !page.IsOwner && protectDraft {
 			return ErrPostNotFound
 		}
 		page.Silenced = silenced
 		err = templates["post"].ExecuteTemplate(w, "post", page)
 		if err != nil {
 			log.Error("Post template execute error: %v", err)
 		}
 	}
 
 	go func() {
 		if u != nil && ownerID.Valid && ownerID.Int64 == u.ID {
 			// Post is owned by someone; skip view increment since that person is viewing this post.
 			return
 		}
 		// Update stats for non-raw post views
 		if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
 			_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE id = ?", friendlyID)
 			if err != nil {
 				log.Error("Unable to update posts count: %v", err)
 			}
 		}
 	}()
 
 	return nil
 }
 
 // API v2 funcs
 // newPost creates a new post with or without an owning Collection.
 //
 // Endpoints:
 //   - /posts
 //   - /posts?collection={alias}
 //   - ? /collections/{alias}/posts
 func newPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 	if collAlias == "" {
 		collAlias = r.FormValue("collection")
 	}
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		// TODO: remove this
 		accessToken = r.FormValue("access_token")
 	}
 
 	// FIXME: determine web submission with Content-Type header
 	var u *User
 	var userID int64 = -1
 	var username string
 	if accessToken == "" {
 		u = getUserSession(app, r)
 		if u != nil {
 			userID = u.ID
 			username = u.Username
 		}
 	} else {
 		userID = app.db.GetUserID(accessToken)
 	}
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("new post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	if userID == -1 {
 		return ErrNotLoggedIn
 	}
 
 	if accessToken == "" && u == nil && collAlias != "" {
 		return impart.HTTPError{http.StatusBadRequest, "Parameter `access_token` required."}
 	}
 
 	// Get post data
 	var p *SubmittedPost
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&p)
 		if err != nil {
 			log.Error("Couldn't parse new post JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 		if p.Title == nil {
 			t := ""
 			p.Title = &t
 		}
 		if strings.TrimSpace(*(p.Title)) == "" && (p.Content == nil || strings.TrimSpace(*(p.Content)) == "") {
 			return ErrNoPublishableContent
 		}
 		if p.Content == nil {
 			c := ""
 			p.Content = &c
 		}
 
 	} else {
 		post := r.FormValue("body")
 		appearance := r.FormValue("font")
 		title := r.FormValue("title")
 		rtlValue := r.FormValue("rtl")
 		langValue := r.FormValue("lang")
 		if strings.TrimSpace(post) == "" {
 			return ErrNoPublishableContent
 		}
 
 		var isRTL, rtlValid bool
 		if rtlValue == "auto" && langValue != "" {
 			isRTL = i18n.LangIsRTL(langValue)
 			rtlValid = true
 		} else {
 			isRTL = rtlValue == "true"
 			rtlValid = rtlValue != "" && langValue != ""
 		}
 
 		// Create a new post
 		p = &SubmittedPost{
 			Title:    &title,
 			Content:  &post,
 			Font:     appearance,
 			IsRTL:    converter.NullJSONBool{sql.NullBool{Bool: isRTL, Valid: rtlValid}},
 			Language: converter.NullJSONString{sql.NullString{String: langValue, Valid: langValue != ""}},
 		}
 	}
 	if !p.isFontValid() {
 		p.Font = "norm"
 	}
 
 	var newPost *PublicPost = &PublicPost{}
 	var coll *Collection
 	if accessToken != "" {
 		newPost, err = app.db.CreateOwnedPost(p, accessToken, collAlias, app.cfg.App.Host)
 	} else {
 		//return ErrNotLoggedIn
 		// TODO: verify user is logged in
 		var collID int64
 		if collAlias != "" {
 			coll, err = app.db.GetCollection(collAlias)
 			if err != nil {
 				return err
 			}
 			coll.hostName = app.cfg.App.Host
 			if coll.OwnerID != u.ID {
 				return ErrForbiddenCollection
 			}
 			collID = coll.ID
 		}
 		// TODO: return PublicPost from createPost
 		newPost.Post, err = app.db.CreatePost(userID, collID, p)
 	}
 	if err != nil {
 		return err
 	}
 	if coll != nil {
 		coll.ForPublic()
 		newPost.Collection = &CollectionObj{Collection: *coll}
 	}
 
 	newPost.extractData()
 	newPost.OwnerName = username
 	newPost.URL = newPost.CanonicalURL(app.cfg.App.Host)
 
 	// Write success now
 	response := impart.WriteSuccess(w, newPost, http.StatusCreated)
 
 	if newPost.Collection != nil {
 		if !app.cfg.App.Private && app.cfg.App.Federation && !newPost.Created.After(time.Now()) {
 			go federatePost(app, newPost, newPost.Collection.ID, false)
 		}
 		if app.cfg.Email.Enabled() && newPost.Collection.EmailSubsEnabled() {
 			go app.db.InsertJob(&PostJob{
 				PostID: newPost.ID,
 				Action: "email",
 				Delay:  emailSendDelay,
 			})
 		}
 	}
 
 	return response
 }
 
 func existingPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	postID := vars["post"]
 
 	p := AuthenticatedPost{ID: postID}
 	var err error
 
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&p)
 		if err != nil {
 			log.Error("Couldn't parse post update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse post update form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		// Can't decode to a nil SubmittedPost property, so create instance now
 		p.SubmittedPost = &SubmittedPost{}
 		err = app.formDecoder.Decode(&p, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode post update form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	if p.Web {
 		p.IsRTL.Valid = true
 	}
 
 	if p.SubmittedPost == nil {
 		return ErrPostNoUpdatableVals
 	}
 
 	// Ensure an access token was given
 	accessToken := r.Header.Get("Authorization")
 	// Get user's cookie session if there's no token
 	var u *User
 	//var username string
 	if accessToken == "" {
 		u = getUserSession(app, r)
 		if u != nil {
 			//username = u.Username
 		}
 	}
 	if u == nil && accessToken == "" {
 		return ErrNoAccessToken
 	}
 
 	// Get user ID from current session or given access token, if one was given.
 	var userID int64
 	if u != nil {
 		userID = u.ID
 	} else if accessToken != "" {
 		userID, err = AuthenticateUser(app.db, accessToken)
 		if err != nil {
 			return err
 		}
 	}
 
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("existing post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	// Modify post struct
 	p.ID = postID
 
 	err = app.db.UpdateOwnedPost(&p, userID)
 	if err != nil {
 		if reqJSON {
 			return err
 		}
 
 		if err, ok := err.(impart.HTTPError); ok {
 			addSessionFlash(app, w, r, err.Message, nil)
 		} else {
 			addSessionFlash(app, w, r, err.Error(), nil)
 		}
 	}
 
 	var pRes *PublicPost
 	pRes, err = app.db.GetPost(p.ID, 0)
 	if reqJSON {
 		if err != nil {
 			return err
 		}
 		pRes.extractData()
 	}
 
 	if pRes.CollectionID.Valid {
 		coll, err := app.db.GetCollectionBy("id = ?", pRes.CollectionID.Int64)
 		if err == nil && !app.cfg.App.Private && app.cfg.App.Federation {
 			coll.hostName = app.cfg.App.Host
 			pRes.Collection = &CollectionObj{Collection: *coll}
 			go federatePost(app, pRes, pRes.Collection.ID, true)
 		}
 	}
 
 	// Write success now
 	if reqJSON {
 		return impart.WriteSuccess(w, pRes, http.StatusOK)
 	}
 
 	addSessionFlash(app, w, r, "Changes saved.", nil)
 	collectionAlias := vars["alias"]
 	redirect := "/" + postID + "/meta"
 	if collectionAlias != "" {
 		collPre := "/" + collectionAlias
 		if app.cfg.App.SingleUser {
 			collPre = ""
 		}
 		redirect = collPre + "/" + pRes.Slug.String + "/edit/meta"
 	} else {
 		if app.cfg.App.SingleUser {
 			redirect = "/d" + redirect
 		}
 	}
 	w.Header().Set("Location", redirect)
 	w.WriteHeader(http.StatusFound)
 
 	return nil
 }
 
 func deletePost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	friendlyID := vars["post"]
 	editToken := r.FormValue("token")
 
 	var ownerID int64
 	var u *User
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" && editToken == "" {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNoAccessToken
 		}
 	}
 
 	var res sql.Result
 	var t *sql.Tx
 	var err error
 	var collID sql.NullInt64
 	var coll *Collection
 	var pp *PublicPost
 	if editToken != "" {
 		// TODO: SELECT owner_id, as well, and return appropriate error if NULL instead of running two queries
 		var dummy int64
 		err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ?", friendlyID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return impart.HTTPError{http.StatusNotFound, "Post not found."}
 		}
 		err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ? AND owner_id IS NULL", friendlyID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			// Post already has an owner. This could provide a bad experience
 			// for the user, but it's more important to ensure data isn't lost
 			// unexpectedly. So prevent deletion via token.
 			return impart.HTTPError{http.StatusConflict, "This post belongs to some user (hopefully yours). Please log in and delete it from that user's account."}
 		}
 		res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND modify_token = ? AND owner_id IS NULL", friendlyID, editToken)
 	} else if accessToken != "" || u != nil {
 		// Caller provided some way to authenticate; assume caller expects the
 		// post to be deleted based on a specific post owner, thus we should
 		// return corresponding errors.
 		if accessToken != "" {
 			ownerID = app.db.GetUserID(accessToken)
 			if ownerID == -1 {
 				return ErrBadAccessToken
 			}
 		} else {
 			ownerID = u.ID
 		}
 
 		// TODO: don't make two queries
 		var realOwnerID sql.NullInt64
 		err = app.db.QueryRow("SELECT collection_id, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&collID, &realOwnerID)
 		if err != nil {
 			return err
 		}
 		if !collID.Valid {
 			// There's no collection; simply delete the post
 			res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
 		} else {
 			// Post belongs to a collection; do any additional clean up
 			coll, err = app.db.GetCollectionBy("id = ?", collID.Int64)
 			if err != nil {
 				log.Error("Unable to get collection: %v", err)
 				return err
 			}
 			if app.cfg.App.Federation {
 				// First fetch full post for federation
 				pp, err = app.db.GetOwnedPost(friendlyID, ownerID)
 				if err != nil {
 					log.Error("Unable to get owned post: %v", err)
 					return err
 				}
 				collObj := &CollectionObj{Collection: *coll}
 				pp.Collection = collObj
 			}
 
 			t, err = app.db.Begin()
 			if err != nil {
 				log.Error("No begin: %v", err)
 				return err
 			}
 			res, err = t.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
 		}
 	} else {
 		return impart.HTTPError{http.StatusBadRequest, "No authenticated user or post token given."}
 	}
 	if err != nil {
 		return err
 	}
 
 	affected, err := res.RowsAffected()
 	if err != nil {
 		if t != nil {
 			t.Rollback()
 			log.Error("Rows affected err! Rolling back")
 		}
 		return err
 	} else if affected == 0 {
 		if t != nil {
 			t.Rollback()
 			log.Error("No rows affected! Rolling back")
 		}
 		return impart.HTTPError{http.StatusForbidden, "Post not found, or you're not the owner."}
 	}
 	if t != nil {
 		t.Commit()
 	}
 	if coll != nil && !app.cfg.App.Private && app.cfg.App.Federation {
 		go deleteFederatedPost(app, pp, collID.Int64)
 	}
 
 	return impart.HTTPError{Status: http.StatusNoContent}
 }
 
 // addPost associates a post with the authenticated user.
 func addPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var ownerID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		ownerID = app.db.GetUserID(at)
 		if ownerID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		ownerID = u.ID
 	}
 
 	silenced, err := app.db.IsUserSilenced(ownerID)
 	if err != nil {
 		log.Error("add post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	// Parse claimed posts in format:
 	// [{"id": "...", "token": "..."}]
 	var claims *[]ClaimPostRequest
 	decoder := json.NewDecoder(r.Body)
 	err = decoder.Decode(&claims)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 
 	// Update all given posts
 	res, err := app.db.ClaimPosts(app.cfg, ownerID, collAlias, claims)
 	if err != nil {
 		return err
 	}
 
 	for _, pRes := range *res {
 		if pRes.Code != http.StatusOK {
 			continue
 		}
 		if !app.cfg.App.Private && app.cfg.App.Federation {
 			if !pRes.Post.Created.After(time.Now()) {
 				pRes.Post.Collection.hostName = app.cfg.App.Host
 				go federatePost(app, pRes.Post, pRes.Post.Collection.ID, false)
 			}
 		}
 		if app.cfg.Email.Enabled() && pRes.Post.Collection.EmailSubsEnabled() {
 			go app.db.InsertJob(&PostJob{
 				PostID: pRes.Post.ID,
 				Action: "email",
 				Delay:  emailSendDelay,
 			})
 		}
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 func dispersePost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var ownerID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		ownerID = app.db.GetUserID(at)
 		if ownerID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		ownerID = u.ID
 	}
 
 	// Parse posts in format:
 	// ["..."]
 	var postIDs []string
 	decoder := json.NewDecoder(r.Body)
 	err := decoder.Decode(&postIDs)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	// Update all given posts
 	res, err := app.db.DispersePosts(ownerID, postIDs)
 	if err != nil {
 		return err
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 type (
 	PinPostResult struct {
 		ID           string `json:"id,omitempty"`
 		Code         int    `json:"code,omitempty"`
 		ErrorMessage string `json:"error_msg,omitempty"`
 	}
 )
 
 // pinPost pins a post to a blog
 func pinPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var userID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		userID = app.db.GetUserID(at)
 		if userID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		userID = u.ID
 	}
 
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("pin post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	// Parse request
 	var posts []struct {
 		ID       string `json:"id"`
 		Position int64  `json:"position"`
 	}
 	decoder := json.NewDecoder(r.Body)
 	err = decoder.Decode(&posts)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	// Validate data
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 
 	coll, err := app.db.GetCollection(collAlias)
 	if err != nil {
 		return err
 	}
 	if coll.OwnerID != userID {
 		return ErrForbiddenCollection
 	}
 
 	// Do (un)pinning
 	isPinning := r.URL.Path[strings.LastIndex(r.URL.Path, "/"):] == "/pin"
 	res := []PinPostResult{}
 	for _, p := range posts {
 		err = app.db.UpdatePostPinState(isPinning, p.ID, coll.ID, userID, p.Position)
 		ppr := PinPostResult{ID: p.ID}
 		if err != nil {
-			ppr.Code = http.StatusInternalServerError
+			if err == ErrForbiddenCollection {
+				ppr.Code = http.StatusForbidden
+			} else {
+				ppr.Code = http.StatusInternalServerError
+			}
 			// TODO: set error message
 		} else {
 			ppr.Code = http.StatusOK
 		}
 		res = append(res, ppr)
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 func fetchPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var collID int64
 	var coll *Collection
 	var err error
 	vars := mux.Vars(r)
 	if collAlias := vars["alias"]; collAlias != "" {
 		// Fetch collection information, since an alias is provided
 		coll, err = app.db.GetCollection(collAlias)
 		if err != nil {
 			return err
 		}
 		collID = coll.ID
 	}
 
 	p, err := app.db.GetPost(vars["post"], collID)
 	if err != nil {
 		return err
 	}
 	if coll == nil && p.CollectionID.Valid {
 		// Collection post is getting fetched by post ID, not coll alias + post slug, so get coll info now.
 		coll, err = app.db.GetCollectionByID(p.CollectionID.Int64)
 		if err != nil {
 			return err
 		}
 	}
 	if coll != nil {
 		coll.hostName = app.cfg.App.Host
 		_, err = apiCheckCollectionPermissions(app, r, coll)
 		if err != nil {
 			return err
 		}
 	}
 
 	silenced, err := app.db.IsUserSilenced(p.OwnerID.Int64)
 	if err != nil {
 		log.Error("fetch post: %v", err)
 	}
 	if silenced {
 		return ErrPostNotFound
 	}
 
 	p.extractData()
 
 	if IsActivityPubRequest(r) {
 		if coll == nil {
 			// This is a draft post; 404 for now
 			// TODO: return ActivityObject
 			return impart.HTTPError{http.StatusNotFound, ""}
 		}
 
 		p.Collection = &CollectionObj{Collection: *coll}
 		po := p.ActivityObject(app)
 		setCacheControl(w, apCacheTime)
 		return impart.RenderActivityJSON(w, po, http.StatusOK)
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func fetchPostProperty(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	p, err := app.db.GetPostProperty(vars["post"], 0, vars["property"])
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func (p *Post) processPost() PublicPost {
 	res := &PublicPost{Post: p, Views: 0}
 	res.Views = p.ViewCount
 	res.Likes = p.LikeCount
 	// TODO: move to own function
 	loc := monday.FuzzyLocale(p.Language.String)
 	res.DisplayDate = monday.Format(p.Created, monday.LongFormatsByLocale[loc], loc)
 
 	return *res
 }
 
 func (p *PublicPost) CanonicalURL(hostName string) string {
 	if p.Collection == nil || p.Collection.Alias == "" {
 		return hostName + "/" + p.ID + ".md"
 	}
 	return p.Collection.CanonicalURL() + p.Slug.String
 }
 
 func (pp *PublicPost) DisplayCanonicalURL() string {
 	us := pp.CanonicalURL(pp.Collection.hostName)
 	u, err := url.Parse(us)
 	if err != nil {
 		return us
 	}
 	return u.Hostname() + u.Path
 }
 
 func (p *PublicPost) ActivityObject(app *App) *activitystreams.Object {
 	cfg := app.cfg
 	var o *activitystreams.Object
 	if cfg.App.NotesOnly || strings.Index(p.Content, "\n\n") == -1 {
 		o = activitystreams.NewNoteObject()
 	} else {
 		o = activitystreams.NewArticleObject()
 	}
 	o.ID = p.Collection.FederatedAPIBase() + "api/posts/" + p.ID
 	o.Published = p.Created
 	o.URL = p.CanonicalURL(cfg.App.Host)
 	o.AttributedTo = p.Collection.FederatedAccount()
 	o.CC = []string{
 		p.Collection.FederatedAccount() + "/followers",
 	}
 	o.Name = p.PlainDisplayTitle()
 	p.augmentContent()
 	if p.HTMLContent == template.HTML("") {
 		p.formatContent(cfg, false, false)
 		p.augmentReadingDestination()
 	}
 	o.Content = string(p.HTMLContent)
 	if o.Type == "Note" && p.Title.String != "" {
 		// Render the explicitly-set title inside the Note, since Mastodon (at least) doesn't show the `name`
 		// property on Notes.
 		o.Content = "<h1>" + applyBasicMarkdown([]byte(p.DisplayTitle())) + "</h1>\n\n" + o.Content
 	}
 	if p.Language.Valid {
 		o.ContentMap = map[string]string{
 			p.Language.String: string(p.HTMLContent),
 		}
 	}
 	if len(p.Tags) == 0 {
 		o.Tag = []activitystreams.Tag{}
 	} else {
 		var tagBaseURL string
 		if isSingleUser {
 			tagBaseURL = p.Collection.CanonicalURL() + "tag:"
 		} else {
 			if cfg.App.Chorus {
 				tagBaseURL = fmt.Sprintf("%s/read/t/", p.Collection.hostName)
 			} else {
 				tagBaseURL = fmt.Sprintf("%s/%s/tag:", p.Collection.hostName, p.Collection.Alias)
 			}
 		}
 		for _, t := range p.Tags {
 			o.Tag = append(o.Tag, activitystreams.Tag{
 				Type: activitystreams.TagHashtag,
 				HRef: tagBaseURL + t,
 				Name: "#" + t,
 			})
 		}
 	}
 	if len(p.Images) > 0 {
+		altText := extractImageAltText(p.Content)
 		for _, i := range p.Images {
-			o.Attachment = append(o.Attachment, activitystreams.NewImageAttachment(i))
+			img := activitystreams.NewImageAttachment(i)
+			if alt, ok := altText[i]; ok {
+				img.Name = alt
+			}
+			o.Attachment = append(o.Attachment, img)
 		}
 	}
 	// Find mentioned users
 	mentionedUsers := make(map[string]string)
 
 	stripper := bluemonday.StrictPolicy()
 	content := stripper.Sanitize(p.Content)
 	mentions := mentionReg.FindAllString(content, -1)
 
 	for _, handle := range mentions {
 		actorIRI, err := app.db.GetProfilePageFromHandle(app, handle)
 		if err != nil || actorIRI == "" {
 			log.Info("Couldn't find user '%s' locally or remotely", handle)
 			continue
 		}
 		mentionedUsers[handle] = actorIRI
 	}
 
 	for handle, iri := range mentionedUsers {
 		o.CC = append(o.CC, iri)
 		o.Tag = append(o.Tag, activitystreams.Tag{Type: "Mention", HRef: iri, Name: handle})
 	}
 
 	// Add shortened Note as the `preview` property if this is an Article
 	if o.Type == "Article" {
 		o.Preview = p.PreviewObject(app, o)
 		o.Summary = &o.Preview.Content
 	}
 
 	if p.Collection.Monetization != "" {
 		o.AddWebMonetization(p.Collection.Monetization)
 	}
 
 	return o
 }
 
 // PreviewObject returns an activitystreams.Object that can be used as an Article's `preview` property.
 func (p *PublicPost) PreviewObject(app *App, art *activitystreams.Object) *activitystreams.Object {
 	o := activitystreams.NewNoteObject()
 	o.Context = nil
 	o.To = nil
 	o.ID = art.ID
 	o.URL = art.URL
 	o.Published = art.Published
 	o.Updated = art.Updated
 	o.Tag = art.Tag
 	o.Attachment = art.Attachment
 
 	baseURL := p.Collection.CanonicalURL()
 	// Try to truncate at user-defined excerpt, if exists
 	exc := strings.Index(p.Content, shortCodeMore)
 	if exc == -1 {
 		// No excerpt; fall back to truncating at first paragraph
 		exc = strings.Index(p.Content, "\n\n")
 	}
 	if exc > -1 {
 		p.HTMLExcerpt = template.HTML(applyMarkdown([]byte(p.Content[:exc]+" [...]"), baseURL, app.cfg))
 	} else {
 		p.HTMLExcerpt = p.HTMLContent
 	}
 	o.Content = strings.TrimRight(string(p.Excerpt()), "\n")
 	return o
 }
 
 // TODO: merge this into getSlugFromPost or phase it out
 func getSlug(title, lang string) string {
 	return getSlugFromPost("", title, lang)
 }
 
 func getSlugFromPost(title, body, lang string) string {
 	if title == "" {
 		// Remove Markdown, so e.g. link URLs and image alt text don't make it into the slug
 		body = strings.TrimSpace(stripmd.StripOptions(body, stripmd.Options{SkipImages: true}))
 		title = postTitle(body, body)
 	}
 	title = parse.PostLede(title, false)
 	// Truncate lede if needed
 	title, _ = parse.TruncToWord(title, 80)
 	var s string
 	if lang != "" && len(lang) == 2 {
 		s = slug.MakeLang(title, lang)
 	} else {
 		s = slug.Make(title)
 	}
 
 	// Transliteration may cause the slug to expand past the limit, so truncate again
 	s, _ = parse.TruncToWord(s, 80)
 	return strings.TrimFunc(s, func(r rune) bool {
 		// TruncToWord doesn't respect words in a slug, since spaces are replaced
 		// with hyphens. So remove any trailing hyphens.
 		return r == '-'
 	})
 }
 
 // isFontValid returns whether or not the submitted post's appearance is valid.
 func (p *SubmittedPost) isFontValid() bool {
 	validFonts := map[string]bool{
 		"norm": true,
 		"sans": true,
 		"mono": true,
 		"wrap": true,
 		"code": true,
 	}
 
 	_, valid := validFonts[p.Font]
 	return valid
 }
 
 func getRawPost(app *App, friendlyID string) *RawPost {
 	var content, font, title string
 	var isRTL sql.NullBool
 	var lang sql.NullString
 	var ownerID sql.NullInt64
 	var created, updated time.Time
 
 	err := app.db.QueryRow("SELECT title, content, text_appearance, language, rtl, created, updated, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&title, &content, &font, &lang, &isRTL, &created, &updated, &ownerID)
 	switch {
 	case err == sql.ErrNoRows:
 		return &RawPost{Content: "", Found: false, Gone: false}
 	case err != nil:
 		log.Error("Unable to fetch getRawPost: %s", err)
 		return &RawPost{Content: "", Found: true, Gone: false}
 	}
 
 	return &RawPost{
 		Title:    title,
 		Content:  content,
 		Font:     font,
 		Created:  created,
 		Updated:  updated,
 		IsRTL:    isRTL,
 		Language: lang,
 		OwnerID:  ownerID.Int64,
 		Found:    true,
 		Gone:     content == "" && title == "",
 	}
 
 }
 
 // TODO; return a Post!
 func getRawCollectionPost(app *App, slug, collAlias string) *RawPost {
 	var id, title, content, font string
 	var isRTL sql.NullBool
 	var lang sql.NullString
 	var created, updated time.Time
 	var ownerID null.Int
 	var views int64
 	var err error
 
 	if app.cfg.App.SingleUser {
 		err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, updated, owner_id FROM posts WHERE slug = ? AND collection_id = 1", slug).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &updated, &ownerID)
 	} else {
 		err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, updated, owner_id FROM posts WHERE slug = ? AND collection_id = (SELECT id FROM collections WHERE alias = ?)", slug, collAlias).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &updated, &ownerID)
 	}
 	switch {
 	case err == sql.ErrNoRows:
 		return &RawPost{Content: "", Found: false, Gone: false}
 	case err != nil:
 		log.Error("Unable to fetch getRawCollectionPost: %s", err)
 		return &RawPost{Content: "", Found: true, Gone: false}
 	}
 
 	return &RawPost{
 		Id:       id,
 		Slug:     slug,
 		Title:    title,
 		Content:  content,
 		Font:     font,
 		Created:  created,
 		Updated:  updated,
 		IsRTL:    isRTL,
 		Language: lang,
 		OwnerID:  ownerID.Int64,
 		Found:    true,
 		Gone:     content == "" && title == "",
 		Views:    views,
 	}
 }
 
 func isRaw(r *http.Request) bool {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw in viewCollectionPost() and handleViewPost()
 	isJSON := strings.HasSuffix(slug, ".json")
 	isXML := strings.HasSuffix(slug, ".xml")
 	isMarkdown := strings.HasSuffix(slug, ".md")
 	return strings.HasSuffix(slug, ".txt") || isJSON || isXML || isMarkdown
 }
 
 func viewCollectionPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw() and handleViewPost()
 	isJSON := strings.HasSuffix(slug, ".json")
 	isXML := strings.HasSuffix(slug, ".xml")
 	isMarkdown := strings.HasSuffix(slug, ".md")
 	isRaw := strings.HasSuffix(slug, ".txt") || isJSON || isXML || isMarkdown
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	// Check for hellbanned users
 	u, err := checkUserForCollection(app, cr, r, true)
 	if err != nil {
 		return err
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	if slug != strings.ToLower(slug) {
 		loc := fmt.Sprintf("/%s", strings.ToLower(slug))
 		if !app.cfg.App.SingleUser {
 			loc = "/" + cr.alias + loc
 		}
 		return impart.HTTPError{http.StatusMovedPermanently, loc}
 	}
 
 	// Display collection if this is a collection
 	var c *Collection
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(cr.alias)
 	}
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if err.Status == http.StatusNotFound {
 				// Redirect if necessary
 				newAlias := app.db.GetCollectionRedirect(cr.alias)
 				if newAlias != "" {
 					return impart.HTTPError{http.StatusFound, "/" + newAlias + "/" + slug}
 				}
 			}
 		}
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("view collection post: %v", err)
 	}
 
 	// Check collection permissions
 	if c.IsPrivate() && (u == nil || u.ID != c.OwnerID) {
 		return ErrPostNotFound
 	}
 	if c.IsProtected() && (u == nil || u.ID != c.OwnerID) {
 		if silenced {
 			return ErrPostNotFound
 		} else if !isAuthorizedForCollection(app, c.Alias, r) {
 			return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
 		}
 	}
 
 	cr.isCollOwner = u != nil && c.OwnerID == u.ID
 
 	if isRaw {
 		slug = strings.Split(slug, ".")[0]
 	}
 
 	// Fetch extra data about the Collection
 	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
 	coll := NewCollectionObj(c)
 	owner, err := app.db.GetUserByID(coll.OwnerID)
 	if err != nil {
 		// Log the error and just continue
 		log.Error("Error getting user for collection: %v", err)
 	} else {
 		coll.Owner = owner
 	}
 
 	postFound := true
 	p, err := app.db.GetPost(slug, coll.ID)
 	if err != nil {
 		if err == ErrCollectionPageNotFound {
 			postFound = false
 
 			if slug == "feed" {
 				// User tried to access blog feed without a trailing slash, and
 				// there's no post with a slug "feed"
 				return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "feed/"}
 			} else if slug == "archive" {
 				// User tried to access blog Archive without a trailing slash, and
 				// there's no post with a slug "archive"
 				return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "archive/"}
 			}
 
 			po := &Post{
 				Slug:     null.NewString(slug, true),
 				Font:     "norm",
 				Language: zero.NewString("en", true),
 				RTL:      zero.NewBool(false, true),
 				Content: `<p class="msg">This page is missing.</p>
 
 Are you sure it was ever here?` + shortCodeNoSig,
 			}
 			pp := po.processPost()
 			p = &pp
 		} else {
 			return err
 		}
 	}
 
 	// Check if the authenticated user is the post owner
 	p.IsOwner = u != nil && u.ID == p.OwnerID.Int64
 	p.Collection = coll
 	p.IsTopLevel = app.cfg.App.SingleUser
 
 	// Only allow a post owner or admin to view a post for silenced collections
 	if silenced && !p.IsOwner && (u == nil || !u.IsAdmin()) {
 		return ErrPostNotFound
 	}
 
 	// Check if post has been unpublished
 	if p.Content == "" && p.Title.String == "" {
 		return impart.HTTPError{http.StatusGone, "Post was unpublished."}
 	}
 
 	p.augmentContent()
 
 	// Serve collection post
 	if isRaw {
 		contentType := "text/plain"
 		if isJSON {
 			contentType = "application/json"
 		} else if isXML {
 			contentType = "application/xml"
 		} else if isMarkdown {
 			contentType = "text/markdown"
 		}
 		w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
 		if !postFound {
 			w.WriteHeader(http.StatusNotFound)
 			fmt.Fprintf(w, "Post not found.")
 			// TODO: return error instead, so status is correctly reflected in logs
 			return nil
 		}
 		if isMarkdown && p.Title.String != "" {
 			fmt.Fprintf(w, "# %s\n\n", p.Title.String)
 		}
 		fmt.Fprint(w, p.Content)
 	} else if IsActivityPubRequest(r) {
 		if !postFound {
 			return ErrCollectionPageNotFound
 		}
 		p.extractData()
 		ap := p.ActivityObject(app)
 		setCacheControl(w, apCacheTime)
 		return impart.RenderActivityJSON(w, ap, http.StatusOK)
 	} else {
 		p.extractData()
 		p.Content = strings.Replace(p.Content, "<!--more-->", "", 1)
 		if app.cfg.Email.Enabled() && c.EmailSubsEnabled() {
 			// TODO: indicate plan is inactive or subs disabled when OWNER is viewing their own post.
 			if u != nil && u.IsEmailSubscriber(app, c.ID) {
 				p.Content = strings.Replace(p.Content, shortCodeEmailSub, `<p id="emailsub">You're subscribed to email updates. <a href="/api/collections/`+c.Alias+`/email/unsubscribe?slug=`+p.Slug.String+`">Unsubscribe</a>.</p>`, -1)
 			} else {
 				p.Content = alterShortCodeEmailSubForm(p.Content, c.Alias, p.Slug.String, false)
 			}
 		}
 		p.Content = strings.Replace(p.Content, "&lt;!--emailsub-->", "<!--emailsub-->", 1)
 		// TODO: move this to function
 		p.formatContent(app.cfg, cr.isCollOwner, true)
 		tp := CollectionPostPage{
 			PublicPost:     p,
 			StaticPage:     pageForReq(app, r),
 			IsOwner:        cr.isCollOwner,
 			IsCustomDomain: cr.isCustomDomain,
 			IsFound:        postFound,
 			Silenced:       silenced,
 			CollAlias:      c.Alias,
 		}
 		tp.IsAdmin = u != nil && u.IsAdmin()
 		tp.CanInvite = canUserInvite(app.cfg, tp.IsAdmin)
 		tp.PinnedPosts, _ = app.db.GetPinnedPosts(coll, p.IsOwner)
 		tp.IsPinned = len(*tp.PinnedPosts) > 0 && PostsContains(tp.PinnedPosts, p)
 		tp.Monetization = coll.Monetization
 		tp.Verification = coll.Verification
 		if tp.Verification != "" {
 			// Fetch info for fediverse:creator tag
 			ru, err := getRemoteUserFromURL(app, coll.Verification)
 			if err != nil {
 				if debugging {
 					log.Info("showing rel=me tag, but no local handle for %s", coll.Verification)
 				}
 			} else {
 				// Though we don't store handles with leading @, strip it here just in case
 				tp.FediverseAuthor = "@" + strings.TrimLeft(ru.Handle, "@")
 			}
 		}
 
 		if !postFound {
 			w.WriteHeader(http.StatusNotFound)
 		}
 		postTmpl := "collection-post"
 		if app.cfg.App.Chorus {
 			postTmpl = "chorus-collection-post"
 		}
 		if err := templates[postTmpl].ExecuteTemplate(w, "post", tp); err != nil {
 			log.Error("Error in %s template: %v", postTmpl, err)
 		}
 	}
 
 	go func() {
 		if p.OwnerID.Valid {
 			// Post is owned by someone. Don't update stats if owner is viewing the post.
 			if u != nil && p.OwnerID.Int64 == u.ID {
 				return
 			}
 		}
 		// Update stats for non-raw post views
 		if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
 			_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE slug = ? AND collection_id = ?", slug, coll.ID)
 			if err != nil {
 				log.Error("Unable to update posts count: %v", err)
 			}
 		}
 	}()
 
 	return nil
 }
 
 // TODO: move this to utils after making it more generic
 func PostsContains(sl *[]PublicPost, s *PublicPost) bool {
 	for _, e := range *sl {
 		if e.ID == s.ID {
 			return true
 		}
 	}
 	return false
 }
 
 func (p *Post) extractData() {
 	p.Tags = tags.Extract(p.Content)
 	p.extractImages()
 }
 
 func (p *Post) IsSans() bool {
 	return p.Font == "sans"
 }
 
 func (p *Post) IsMonospace() bool {
 	return p.Font == "mono"
 }
 
 func (rp *RawPost) UserFacingCreated() string {
 	return rp.Created.Format(postMetaDateFormat)
 }
 
 func (rp *RawPost) Created8601() string {
 	return rp.Created.Format("2006-01-02T15:04:05Z")
 }
 
 func (rp *RawPost) Updated8601() string {
 	if rp.Updated.IsZero() {
 		return ""
 	}
 	return rp.Updated.Format("2006-01-02T15:04:05Z")
 }
 
-var imageURLRegex = regexp.MustCompile(`(?i)[^ ]+\.(gif|png|jpg|jpeg|avif|avifs|webp|jxl|image)$`)
+var (
+	imageURLRegex      = regexp.MustCompile(`(?i)[^ ]+\.(gif|png|jpg|jpeg|avif|avifs|webp|jxl|image)$`)
+	imageMarkdownRegex = regexp.MustCompile(`!\[([^\]]*)\]\(\s*(\S+?)(?:\s+"[^"]*")?\s*\)`)
+)
 
 func (p *Post) extractImages() {
 	p.Images = extractImages(p.Content)
 }
 
+// extractImageAltText maps image URLs to their Markdown alt text for any
+// images written with Markdown image syntax in content.
+func extractImageAltText(content string) map[string]string {
+	alts := map[string]string{}
+	for _, m := range imageMarkdownRegex.FindAllStringSubmatch(content, -1) {
+		alt := strings.TrimSpace(m[1])
+		if alt == "" {
+			continue
+		}
+		alts[m[2]] = alt
+	}
+	return alts
+}
+
 func extractImages(content string) []string {
 	matches := extract.ExtractUrls(content)
 	urls := map[string]bool{}
 	for i := range matches {
 		uRaw := matches[i].Text
 		// Parse the extracted text so we can examine the path
 		u, err := url.Parse(uRaw)
 		if err != nil {
 			continue
 		}
 		// Ensure the path looks like it leads to an image file
 		if !imageURLRegex.MatchString(u.Path) {
 			continue
 		}
 		urls[uRaw] = true
 	}
 
 	resURLs := make([]string, 0)
 	for k := range urls {
 		resURLs = append(resURLs, k)
 	}
 	return resURLs
 }
diff --git a/posts_test.go b/posts_test.go
index 612c178..7b13065 100644
--- a/posts_test.go
+++ b/posts_test.go
@@ -1,45 +1,93 @@
 /*
  * Copyright © 2020-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
-package writefreely_test
+package writefreely
 
 import (
 	"testing"
 
 	"github.com/guregu/null/zero"
 	"github.com/stretchr/testify/assert"
-	"github.com/writefreely/writefreely"
 )
 
 func TestPostSummary(t *testing.T) {
 	testCases := map[string]struct {
-		given    writefreely.Post
+		given    Post
 		expected string
 	}{
 		"no special chars":          {givenPost("Content."), "Content."},
 		"HTML content":              {givenPost("Content <p>with a</p> paragraph."), "Content with a paragraph."},
 		"content with escaped char": {givenPost("Content&#39;s all OK."), "Content's all OK."},
 		"multiline content": {givenPost(`Content
 in
 multiple
 lines.`), "Content in multiple lines."},
 	}
 
 	for name, test := range testCases {
 		t.Run(name, func(t *testing.T) {
 			actual := test.given.Summary()
 			assert.Equal(t, test.expected, actual)
 		})
 	}
 }
 
-func givenPost(content string) writefreely.Post {
-	return writefreely.Post{Title: zero.StringFrom("Title"), Content: content}
+func givenPost(content string) Post {
+	return Post{Title: zero.StringFrom("Title"), Content: content}
+}
+
+func TestExtractImageAltText(t *testing.T) {
+	testCases := map[string]struct {
+		content  string
+		expected map[string]string
+	}{
+		"basic image": {
+			"![a cat](https://example.com/cat.png)",
+			map[string]string{"https://example.com/cat.png": "a cat"},
+		},
+		"image with title": {
+			`![a cat](https://example.com/cat.png "Kitty")`,
+			map[string]string{"https://example.com/cat.png": "a cat"},
+		},
+		"empty alt text is omitted": {
+			"![](https://example.com/cat.png)",
+			map[string]string{},
+		},
+		"whitespace-only alt text is omitted": {
+			"![   ](https://example.com/cat.png)",
+			map[string]string{},
+		},
+		"alt text is trimmed": {
+			"![  a cat  ](https://example.com/cat.png)",
+			map[string]string{"https://example.com/cat.png": "a cat"},
+		},
+		"multiple images": {
+			"![cat](https://example.com/cat.png) and ![dog](https://example.com/dog.jpg)",
+			map[string]string{
+				"https://example.com/cat.png": "cat",
+				"https://example.com/dog.jpg": "dog",
+			},
+		},
+		"bare url has no alt text": {
+			"See https://example.com/cat.png",
+			map[string]string{},
+		},
+		"non-image markdown link ignored": {
+			"[a link](https://example.com/page)",
+			map[string]string{},
+		},
+	}
+
+	for name, test := range testCases {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, test.expected, extractImageAltText(test.content))
+		})
+	}
 }
diff --git a/routes.go b/routes.go
index 7447b62..29e240a 100644
--- a/routes.go
+++ b/routes.go
@@ -1,251 +1,263 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"net/http"
 	"net/url"
 	"path/filepath"
 	"strings"
 
 	"github.com/gorilla/csrf"
 	"github.com/gorilla/mux"
 	"github.com/writeas/go-webfinger"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/go-nodeinfo"
 )
 
 // InitStaticRoutes adds routes for serving static files.
 // TODO: this should just be a func, not method
 func (app *App) InitStaticRoutes(r *mux.Router) {
 	// Handle static files
 	fs := http.FileServer(http.Dir(filepath.Join(app.cfg.Server.StaticParentDir, staticDir)))
 	fs = cacheControl(fs)
 	app.shttp = http.NewServeMux()
 	app.shttp.Handle("/", fs)
 	r.PathPrefix("/").Handler(fs)
 }
 
 // InitRoutes adds dynamic routes for the given mux.Router.
 func InitRoutes(apper Apper, r *mux.Router) *mux.Router {
 	// Create handler
 	handler := NewWFHandler(apper)
 
 	// Set up routes
 	hostSubroute := apper.App().cfg.App.Host[strings.Index(apper.App().cfg.App.Host, "://")+3:]
 	if apper.App().cfg.App.SingleUser {
 		hostSubroute = "{domain}"
 	} else {
 		if strings.HasPrefix(hostSubroute, "localhost") {
 			hostSubroute = "localhost"
 		}
 	}
 
 	if apper.App().cfg.App.SingleUser {
 		log.Info("Adding %s routes (single user)...", hostSubroute)
 	} else {
 		log.Info("Adding %s routes (multi-user)...", hostSubroute)
 	}
 
 	// Primary app routes
 	write := r.PathPrefix("/").Subrouter()
 
 	// Federation endpoint configurations
 	wf := webfinger.Default(wfResolver{apper.App().db, apper.App().cfg})
 	wf.NoTLSHandler = nil
 
 	// Federation endpoints
 	// host-meta
 	write.HandleFunc("/.well-known/host-meta", handler.Web(handleViewHostMeta, UserLevelReader))
 	// webfinger
 	write.HandleFunc(webfinger.WebFingerPath, handler.LogHandlerFunc(http.HandlerFunc(wf.Webfinger)))
 	// nodeinfo
 	niCfg := nodeInfoConfig(apper.App().db, apper.App().cfg)
 	ni := nodeinfo.NewService(*niCfg, nodeInfoResolver{apper.App().cfg, apper.App().db})
 	write.HandleFunc(nodeinfo.NodeInfoPath, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfoDiscover)))
 	write.HandleFunc(niCfg.InfoURL, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfo)))
 
 	// handle mentions
 	write.HandleFunc("/@/{handle}", handler.Web(handleViewMention, UserLevelReader))
 
 	configureSlackOauth(handler, write, apper.App())
 	configureWriteAsOauth(handler, write, apper.App())
 	configureGitlabOauth(handler, write, apper.App())
 	configureGenericOauth(handler, write, apper.App())
 	configureGiteaOauth(handler, write, apper.App())
 
 	// Set up dynamic page handlers
 	// Handle auth
 	auth := write.PathPrefix("/api/auth/").Subrouter()
-	if apper.App().cfg.App.OpenRegistration {
-		auth.HandleFunc("/signup", handler.All(apiSignup)).Methods("POST")
-	}
+	auth.HandleFunc("/signup", handler.All(apiSignup)).Methods("POST")
 	auth.HandleFunc("/login", handler.All(login)).Methods("POST")
 	auth.HandleFunc("/read", handler.WebErrors(handleWebCollectionUnlock, UserLevelNone)).Methods("POST")
 	auth.HandleFunc("/me", handler.All(handleAPILogout)).Methods("DELETE")
 
 	// Handle logged in user sections
 	me := write.PathPrefix("/me").Subrouter()
 	me.HandleFunc("/", handler.Redirect("/me", UserLevelUser))
 	me.HandleFunc("/c", handler.Redirect("/me/c/", UserLevelUser)).Methods("GET")
 	me.HandleFunc("/c/", handler.User(viewCollections)).Methods("GET")
 	me.HandleFunc("/c/{collection}", handler.User(viewEditCollection)).Methods("GET")
 	me.HandleFunc("/c/{collection}/stats", handler.User(viewStats)).Methods("GET")
 	me.HandleFunc("/c/{collection}/subscribers", handler.User(handleViewSubscribers)).Methods("GET")
-	me.Path("/delete").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.User(handleUserDelete))).Methods("POST")
+	me.Path("/delete").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(handleUserDelete))).Methods("POST")
 	me.HandleFunc("/posts", handler.Redirect("/me/posts/", UserLevelUser)).Methods("GET")
 	me.HandleFunc("/posts/", handler.User(viewArticles)).Methods("GET")
 	me.HandleFunc("/posts/export.csv", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/posts/export.zip", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/posts/export.json", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/export", handler.User(viewExportOptions)).Methods("GET")
 	me.HandleFunc("/export.json", handler.Download(viewExportFull, UserLevelUser)).Methods("GET")
-	me.HandleFunc("/import", handler.User(viewImport)).Methods("GET")
-	me.Path("/settings").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.User(viewSettings))).Methods("GET")
-	me.HandleFunc("/invites", handler.User(handleViewUserInvites)).Methods("GET")
+	me.Path("/import").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(viewImport))).Methods("GET")
+	me.Path("/settings").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(viewSettings))).Methods("GET")
+	me.Path("/invites").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(handleViewUserInvites))).Methods("GET")
 	me.HandleFunc("/logout", handler.Web(viewLogout, UserLevelNone)).Methods("GET")
 
 	write.HandleFunc("/api/me", handler.All(viewMeAPI)).Methods("GET")
 	apiMe := write.PathPrefix("/api/me/").Subrouter()
 	apiMe.HandleFunc("/", handler.All(viewMeAPI)).Methods("GET")
 	apiMe.HandleFunc("/posts", handler.UserWebAPI(viewMyPostsAPI)).Methods("GET")
 	apiMe.HandleFunc("/collections", handler.UserAPI(viewMyCollectionsAPI)).Methods("GET")
 	apiMe.HandleFunc("/password", handler.All(updatePassphrase)).Methods("POST")
-	apiMe.HandleFunc("/self", handler.All(updateSettings)).Methods("POST")
-	apiMe.HandleFunc("/invites", handler.User(handleCreateUserInvite)).Methods("POST")
-	apiMe.HandleFunc("/import", handler.User(handleImport)).Methods("POST")
-	apiMe.HandleFunc("/oauth/remove", handler.User(removeOauth)).Methods("POST")
+	apiMe.Path("/self").Handler(csrfProtectForm(apper.App().keys.CSRFKey, handler.All(updateSettings))).Methods("POST")
+	apiMe.Path("/invites").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(handleCreateUserInvite))).Methods("POST")
+	apiMe.Path("/import").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(handleImport))).Methods("POST")
+	apiMe.Path("/oauth/remove").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.User(removeOauth))).Methods("POST")
 
 	// Sign up validation
 	write.HandleFunc("/api/alias", handler.All(handleUsernameCheck)).Methods("POST")
 
 	write.HandleFunc("/api/markdown", handler.All(handleRenderMarkdown)).Methods("POST")
 
 	instanceURL, _ := url.Parse(apper.App().Config().App.Host)
 	host := instanceURL.Host
 
 	// Handle collections
 	write.HandleFunc("/api/collections", handler.All(newCollection)).Methods("POST")
 	apiColls := write.PathPrefix("/api/collections/").Subrouter()
 	apiColls.HandleFunc("/monetization-pointer", handler.PlainTextAPI(handleSPSPEndpoint)).Methods("GET")
 	apiColls.HandleFunc("/"+host, handler.AllReader(fetchCollection)).Methods("GET")
 	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.AllReader(fetchCollection)).Methods("GET")
 	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.All(existingCollection)).Methods("POST", "DELETE")
 	apiColls.HandleFunc("/{alias}/posts", handler.AllReader(fetchCollectionPosts)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/posts", handler.All(newPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/posts/{post}", handler.AllReader(fetchPost)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/posts/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/posts/{post}/splitcontent", handler.AllReader(handleGetSplitContent)).Methods("GET", "POST")
 	apiColls.HandleFunc("/{alias}/posts/{post}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/collect", handler.All(addPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/pin", handler.All(pinPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/unpin", handler.All(pinPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/email/subscribers/export.csv", handler.Download(handleExportEmailSubscriptions, UserLevelUser)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/email/subscribe", handler.All(handleCreateEmailSubscription)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/email/subscribe", handler.All(handleDeleteEmailSubscription)).Methods("DELETE")
 	apiColls.HandleFunc("/{collection}/email/unsubscribe", handler.All(handleDeleteEmailSubscription)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/inbox", handler.All(handleFetchCollectionInbox)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/outbox", handler.AllReader(handleFetchCollectionOutbox)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/following", handler.AllReader(handleFetchCollectionFollowing)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/followers", handler.AllReader(handleFetchCollectionFollowers)).Methods("GET")
 
 	// Handle posts
 	write.HandleFunc("/api/posts", handler.All(newPost)).Methods("POST")
 	posts := write.PathPrefix("/api/posts/").Subrouter()
 	posts.HandleFunc("/claim", handler.All(addPost)).Methods("POST")
 	posts.HandleFunc("/disperse", handler.All(dispersePost)).Methods("POST")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]+}", handler.AllReader(fetchPost)).Methods("GET")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]+}", handler.All(existingPost)).Methods("POST", "PUT")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]+}", handler.All(deletePost)).Methods("DELETE")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]+}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
 
 	write.HandleFunc("/auth/signup", handler.Web(handleWebSignup, UserLevelNoneRequired)).Methods("POST")
 	write.HandleFunc("/auth/login", handler.Web(webLogin, UserLevelNoneRequired)).Methods("POST")
 
 	write.HandleFunc("/admin", handler.Admin(handleViewAdminDash)).Methods("GET")
 	write.HandleFunc("/admin/monitor", handler.Admin(handleViewAdminMonitor)).Methods("GET")
 	write.HandleFunc("/admin/settings", handler.Admin(handleViewAdminSettings)).Methods("GET")
 	write.HandleFunc("/admin/users", handler.Admin(handleViewAdminUsers)).Methods("GET")
 	write.HandleFunc("/admin/user/{username}", handler.Admin(handleViewAdminUser)).Methods("GET")
 	write.HandleFunc("/admin/user/{username}/delete", handler.Admin(handleAdminDeleteUser)).Methods("POST")
 	write.HandleFunc("/admin/user/{username}/status", handler.Admin(handleAdminToggleUserStatus)).Methods("POST")
 	write.HandleFunc("/admin/user/{username}/passphrase", handler.Admin(handleAdminResetUserPass)).Methods("POST")
 	write.HandleFunc("/admin/pages", handler.Admin(handleViewAdminPages)).Methods("GET")
 	write.HandleFunc("/admin/page/{slug}", handler.Admin(handleViewAdminPage)).Methods("GET")
 	write.HandleFunc("/admin/update/config", handler.AdminApper(handleAdminUpdateConfig)).Methods("POST")
 	write.HandleFunc("/admin/update/{page}", handler.Admin(handleAdminUpdateSite)).Methods("POST")
 	write.HandleFunc("/admin/updates", handler.Admin(handleViewAdminUpdates)).Methods("GET")
 
 	// Handle special pages first
-	write.Path("/reset").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.Web(viewResetPassword, UserLevelNoneRequired)))
+	write.Path("/reset").Handler(csrf.Protect(apper.App().keys.CSRFKey, csrf.Path("/"))(handler.Web(viewResetPassword, UserLevelNoneRequired)))
 	write.HandleFunc("/login", handler.Web(viewLogin, UserLevelNoneRequired))
 	write.HandleFunc("/signup", handler.Web(handleViewLanding, UserLevelNoneRequired))
 	write.HandleFunc("/invite/{code:[a-zA-Z0-9]+}", handler.Web(handleViewInvite, UserLevelOptional)).Methods("GET")
 	// TODO: show a reader-specific 404 page if the function is disabled
 	write.HandleFunc("/read", handler.Web(viewLocalTimeline, UserLevelReader))
 	RouteRead(handler, UserLevelReader, write.PathPrefix("/read").Subrouter())
 
 	draftEditPrefix := ""
 	if apper.App().cfg.App.SingleUser {
 		draftEditPrefix = "/d"
 		write.HandleFunc("/me/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
 	} else {
 		write.HandleFunc("/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
 	}
 
 	// All the existing stuff
 	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
 	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelUser)).Methods("GET")
 	// Collections
 	if apper.App().cfg.App.SingleUser {
 		RouteCollections(handler, write.PathPrefix("/").Subrouter())
 	} else {
 		write.HandleFunc("/{prefix:[@~$!\\-+]}{collection}", handler.Web(handleViewCollection, UserLevelReader))
 		write.HandleFunc("/{collection}/", handler.Web(handleViewCollection, UserLevelReader))
 		RouteCollections(handler, write.PathPrefix("/{prefix:[@~$!\\-+]?}{collection}").Subrouter())
 		// Posts
 	}
 	write.HandleFunc(draftEditPrefix+"/{post}", handler.Web(handleViewPost, UserLevelOptional))
 	write.HandleFunc("/", handler.Web(handleViewHome, UserLevelOptional))
 
 	return r
 }
 
+// csrfProtectForm wraps a handler with CSRF protection but exempts JSON
+// requests, which authenticate via Authorization header rather than
+// session cookies and are therefore not CSRF-exploitable.
+func csrfProtectForm(key []byte, next http.Handler) http.Handler {
+	protected := csrf.Protect(key, csrf.Path("/"))(next)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if IsJSON(r) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		protected.ServeHTTP(w, r)
+	})
+}
+
 func RouteCollections(handler *Handler, r *mux.Router) {
 	r.HandleFunc("/logout", handler.Web(handleLogOutCollection, UserLevelOptional))
 	r.HandleFunc("/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelReader))
 	r.HandleFunc("/archive/", handler.Web(handleViewCollection, UserLevelReader))
 	r.HandleFunc("/{archive:archive}/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelReader))
 	r.HandleFunc("/lang:{lang:[a-z]{2}}", handler.Web(handleViewCollectionLang, UserLevelOptional))
 	r.HandleFunc("/lang:{lang:[a-z]{2}}/page/{page:[0-9]+}", handler.Web(handleViewCollectionLang, UserLevelOptional))
 	r.HandleFunc("/tag:{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
 	r.HandleFunc("/tag:{tag}/page/{page:[0-9]+}", handler.Web(handleViewCollectionTag, UserLevelReader))
 	r.HandleFunc("/tag:{tag}/feed/", handler.Web(ViewFeed, UserLevelReader))
 	r.HandleFunc("/sitemap.xml", handler.AllReader(handleViewSitemap))
 	r.HandleFunc("/feed/", handler.AllReader(ViewFeed))
 	r.HandleFunc("/email/confirm/{subscriber}", handler.All(handleConfirmEmailSubscription)).Methods("GET")
 	r.HandleFunc("/email/unsubscribe/{subscriber}", handler.All(handleDeleteEmailSubscription)).Methods("GET")
 	r.HandleFunc("/{slug}", handler.CollectionPostOrStatic)
 	r.HandleFunc("/{slug}/edit", handler.Web(handleViewPad, UserLevelUser))
 	r.HandleFunc("/{slug}/edit/meta", handler.Web(handleViewMeta, UserLevelUser))
 	r.HandleFunc("/{slug}/", handler.Web(handleCollectionPostRedirect, UserLevelReader)).Methods("GET")
 }
 
 func RouteRead(handler *Handler, readPerm UserLevelFunc, r *mux.Router) {
 	r.HandleFunc("/api/posts", handler.Web(viewLocalTimelineAPI, readPerm))
 	r.HandleFunc("/p/{page}", handler.Web(viewLocalTimeline, readPerm))
 	r.HandleFunc("/feed", handler.Web(viewLocalTimelineFeed, readPerm))
 	r.HandleFunc("/feed/", handler.Web(viewLocalTimelineFeed, readPerm))
 	r.HandleFunc("/t/{tag}", handler.Web(viewLocalTimeline, readPerm))
 	r.HandleFunc("/a/{post}", handler.Web(handlePostIDRedirect, readPerm))
 	r.HandleFunc("/{author}", handler.Web(viewLocalTimeline, readPerm))
 	r.HandleFunc("/", handler.Web(viewLocalTimeline, readPerm))
 }
diff --git a/signup_test.go b/signup_test.go
new file mode 100644
index 0000000..1b48ab2
--- /dev/null
+++ b/signup_test.go
@@ -0,0 +1,481 @@
+//go:build sqlite
+
+/*
+ * Copyright © 2026 Musing Studio LLC.
+ *
+ * This file is part of WriteFreely.
+ *
+ * WriteFreely is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, included
+ * in the LICENSE file in this source code package.
+ */
+
+package writefreely
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/gorilla/schema"
+	"github.com/stretchr/testify/assert"
+	"github.com/writeas/impart"
+	"github.com/writefreely/writefreely/config"
+	"github.com/writefreely/writefreely/key"
+)
+
+var initTemplatesOnce sync.Once
+
+// newSignupTestApp builds a real, sqlite-backed App suitable for exercising
+// the HTTP signup handlers end-to-end. It's intentionally minimal: only the
+// pieces those handlers actually touch (db, cfg, keys, session store, form
+// decoder, and the global page/template caches) are initialized.
+func newSignupTestApp(t *testing.T) *App {
+	t.Helper()
+
+	dbPath := filepath.Join(t.TempDir(), "writefreely.db")
+	db, err := sql.Open("sqlite3_with_regex", dbPath+"?parseTime=true&cached=shared")
+	if err != nil {
+		t.Fatalf("open test db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	cfg := config.New()
+	cfg.UseSQLite(true)
+	cfg.Database.FileName = dbPath
+	cfg.App.Host = "http://localhost:0"
+	cfg.App.SingleUser = false
+	cfg.App.OpenRegistration = false
+	cfg.App.MinUsernameLen = 3
+	cfg.Server.HashSeed = "test-hash-seed"
+
+	keys := &key.Keychain{}
+	if err := keys.GenerateKeys(); err != nil {
+		t.Fatalf("generate keys: %v", err)
+	}
+
+	app := &App{
+		db:   &datastore{DB: db, driverName: driverSQLite},
+		cfg:  cfg,
+		keys: keys,
+	}
+	app.formDecoder = schema.NewDecoder()
+	app.InitSession()
+
+	if err := adminInitDatabase(app); err != nil {
+		t.Fatalf("init schema: %v", err)
+	}
+
+	var tmplErr error
+	initTemplatesOnce.Do(func() {
+		tmplErr = InitTemplates(cfg)
+	})
+	if tmplErr != nil {
+		t.Fatalf("init templates: %v", tmplErr)
+	}
+
+	return app
+}
+
+// seedInvite inserts a directly-usable invite code owned by ownerID, with no
+// expiration or use limit.
+func seedInvite(t *testing.T, app *App, code string, ownerID int64) {
+	t.Helper()
+	_, err := app.db.Exec("INSERT INTO userinvites (id, owner_id, max_uses, created, expires, inactive) VALUES (?, ?, NULL, ?, NULL, 0)",
+		code, ownerID, time.Now().UTC().Format("2006-01-02 15:04:05"))
+	if err != nil {
+		t.Fatalf("seed invite: %v", err)
+	}
+}
+
+func userExists(t *testing.T, app *App, username string) bool {
+	t.Helper()
+	var id int64
+	err := app.db.QueryRow("SELECT id FROM users WHERE username = ?", username).Scan(&id)
+	if err == sql.ErrNoRows {
+		return false
+	}
+	if err != nil {
+		t.Fatalf("query user: %v", err)
+	}
+	return true
+}
+
+// --- Regression coverage for #1722: POST /auth/signup (handleWebSignup) ---
+// No test previously covered this path even though the fix landed there.
+
+func TestWebSignupClosedRegistration(t *testing.T) {
+	cases := []struct {
+		name       string
+		invite     string
+		wantStatus int
+		wantUser   bool
+	}{
+		{"no invite code", "", http.StatusForbidden, false},
+		{"bogus invite code", "not-a-real-code", http.StatusForbidden, false},
+		{"valid invite code", "webvalid1", http.StatusFound, true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			app := newSignupTestApp(t)
+			app.cfg.App.OpenRegistration = false
+
+			if tc.invite == "webvalid1" {
+				seedInvite(t, app, "webvalid1", 0)
+			}
+
+			username := "websignup-" + strings.ReplaceAll(tc.name, " ", "-")
+			form := url.Values{}
+			form.Set("alias", username)
+			form.Set("pass", "sup3rSecret!")
+			form.Set("invite_code", tc.invite)
+
+			req := httptest.NewRequest("POST", "/auth/signup", strings.NewReader(form.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			w := httptest.NewRecorder()
+
+			err := handleWebSignup(app, w, req)
+
+			// handleWebSignup always returns an impart.HTTPError: a 302 to
+			// "to" on success, or the rejection status on failure.
+			httpErr, ok := err.(impart.HTTPError)
+			if !ok {
+				t.Fatalf("expected impart.HTTPError, got %T (%v)", err, err)
+			}
+			if httpErr.Status != tc.wantStatus {
+				t.Errorf("status = %d, want %d", httpErr.Status, tc.wantStatus)
+			}
+
+			assert.Equal(t, tc.wantUser, userExists(t, app, username),
+				"unexpected account-creation outcome for case %q", tc.name)
+		})
+	}
+}
+
+// --- Finding A: POST /api/auth/signup (apiSignup -> signup) ---
+
+func TestAPISignupClosedRegistration(t *testing.T) {
+	cases := []struct {
+		name       string
+		invite     string
+		wantStatus int
+		wantUser   bool
+	}{
+		{"no invite code", "", http.StatusForbidden, false},
+		{"bogus invite code", "not-a-real-code", http.StatusForbidden, false},
+		{"valid invite code", "valid1", http.StatusFound /* signupWithRegistration succeeds */, true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			app := newSignupTestApp(t)
+			app.cfg.App.OpenRegistration = false
+
+			if tc.invite == "valid1" {
+				seedInvite(t, app, "valid1", 0)
+			}
+
+			username := "apisignup-" + strings.ReplaceAll(tc.name, " ", "-")
+			form := url.Values{}
+			form.Set("alias", username)
+			form.Set("pass", "sup3rSecret!")
+			form.Set("invite_code", tc.invite)
+
+			req := httptest.NewRequest("POST", "/api/auth/signup", strings.NewReader(form.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			w := httptest.NewRecorder()
+
+			err := apiSignup(app, w, req)
+
+			if !tc.wantUser {
+				httpErr, ok := err.(impart.HTTPError)
+				if !ok {
+					t.Fatalf("expected impart.HTTPError, got %T (%v)", err, err)
+				}
+				if httpErr.Status != tc.wantStatus {
+					t.Errorf("status = %d, want %d", httpErr.Status, tc.wantStatus)
+				}
+			} else if err != nil {
+				t.Fatalf("expected signup to succeed, got error: %v", err)
+			}
+
+			assert.Equal(t, tc.wantUser, userExists(t, app, username),
+				"unexpected account-creation outcome for case %q", tc.name)
+		})
+	}
+}
+
+func TestAPISignupOpenRegistrationStillWorks(t *testing.T) {
+	app := newSignupTestApp(t)
+	app.cfg.App.OpenRegistration = true
+
+	form := url.Values{}
+	form.Set("alias", "apisignup-open")
+	form.Set("pass", "sup3rSecret!")
+
+	req := httptest.NewRequest("POST", "/api/auth/signup", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	if err := apiSignup(app, w, req); err != nil {
+		t.Fatalf("expected signup to succeed with open registration, got: %v", err)
+	}
+	assert.True(t, userExists(t, app, "apisignup-open"))
+}
+
+// TestSignupDisabledPasswordAuth guards against creating a password-based
+// account when password auth is disabled.
+func TestSignupDisabledPasswordAuth(t *testing.T) {
+	newReq := func(path, alias string) (*http.Request, *httptest.ResponseRecorder) {
+		form := url.Values{}
+		form.Set("alias", alias)
+		form.Set("pass", "sup3rSecret!")
+		req := httptest.NewRequest("POST", path, strings.NewReader(form.Encode()))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		return req, httptest.NewRecorder()
+	}
+
+	t.Run("api", func(t *testing.T) {
+		app := newSignupTestApp(t)
+		app.cfg.App.OpenRegistration = true
+		app.cfg.App.DisablePasswordAuth = true
+
+		req, w := newReq("/api/auth/signup", "pwauth-api")
+		if err := apiSignup(app, w, req); err != ErrDisabledPasswordAuth {
+			t.Fatalf("expected ErrDisabledPasswordAuth, got: %v", err)
+		}
+		assert.False(t, userExists(t, app, "pwauth-api"))
+	})
+
+	t.Run("web", func(t *testing.T) {
+		app := newSignupTestApp(t)
+		app.cfg.App.OpenRegistration = true
+		app.cfg.App.DisablePasswordAuth = true
+
+		req, w := newReq("/auth/signup", "pwauth-web")
+		// handleWebSignup converts the rejection into a flash + 302 redirect
+		// rather than returning the error verbatim, so the real signal is that
+		// no account was created.
+		err := handleWebSignup(app, w, req)
+		if httpErr, ok := err.(impart.HTTPError); !ok || httpErr.Status != http.StatusFound {
+			t.Fatalf("expected 302 redirect, got: %v", err)
+		}
+		assert.False(t, userExists(t, app, "pwauth-web"))
+	})
+}
+
+// TestInitRoutesAlwaysRegistersAPISignup guards against the routing-time
+// bypass in Finding A: /api/auth/signup used to only be registered when
+// OpenRegistration was true *at boot*, so toggling the setting off at
+// runtime (via the admin panel) left the route live with no invite check
+// at all. It must now always resolve, regardless of the setting.
+func TestInitRoutesAlwaysRegistersAPISignup(t *testing.T) {
+	app := newSignupTestApp(t)
+	app.cfg.App.OpenRegistration = false
+
+	router := InitRoutes(app, mux.NewRouter())
+
+	req := httptest.NewRequest("POST", "/api/auth/signup", nil)
+	var match mux.RouteMatch
+	if !router.Match(req, &match) {
+		t.Fatal("expected /api/auth/signup to match a route even when OpenRegistration is false")
+	}
+}
+
+// --- Finding B: POST /oauth/signup (viewOauthSignup) ---
+
+func newTestOauthHandler(app *App) oauthHandler {
+	return oauthHandler{
+		Config:   app.cfg,
+		DB:       app.db,
+		Store:    app.sessionStore,
+		EmailKey: app.keys.EmailKey,
+	}
+}
+
+func signOauthParams(hashSeed string, p oauthSignupPageParams) string {
+	return p.HashTokenParams(hashSeed)
+}
+
+func TestOAuthSignupClosedRegistration(t *testing.T) {
+	cases := []struct {
+		name     string
+		invite   string
+		wantUser bool
+	}{
+		{"no invite code", "", false},
+		{"bogus invite code", "not-a-real-code", false},
+		{"valid invite code", "oauthok", true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			app := newSignupTestApp(t)
+			app.cfg.App.OpenRegistration = false
+			h := newTestOauthHandler(app)
+
+			if tc.invite == "oauthok" {
+				seedInvite(t, app, "oauthok", 0)
+			}
+
+			username := "oauthsignup-" + strings.ReplaceAll(tc.name, " ", "-")
+			tp := oauthSignupPageParams{
+				AccessToken:     "tok-" + username,
+				TokenUsername:   username,
+				TokenAlias:      username,
+				TokenEmail:      "",
+				TokenRemoteUser: "remote-" + username,
+				ClientID:        "client1",
+				Provider:        "generic",
+				InviteCode:      tc.invite,
+			}
+			sig := signOauthParams(app.cfg.Server.HashSeed, tp)
+
+			form := url.Values{}
+			form.Set(oauthParamAccessToken, tp.AccessToken)
+			form.Set(oauthParamTokenUsername, tp.TokenUsername)
+			form.Set(oauthParamTokenAlias, tp.TokenAlias)
+			form.Set(oauthParamTokenEmail, tp.TokenEmail)
+			form.Set(oauthParamTokenRemoteUserID, tp.TokenRemoteUser)
+			form.Set(oauthParamClientID, tp.ClientID)
+			form.Set(oauthParamProvider, tp.Provider)
+			form.Set(oauthParamInviteCode, tp.InviteCode)
+			form.Set(oauthParamHash, sig)
+			form.Set(oauthParamUsername, username)
+
+			req := httptest.NewRequest("POST", "/oauth/signup", strings.NewReader(form.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			w := httptest.NewRecorder()
+
+			err := h.viewOauthSignup(app, w, req)
+
+			// On rejection, viewOauthSignup re-renders the signup-oauth page
+			// inline with a flash message rather than returning an
+			// impart.HTTPError (mirroring showOauthSignupPage's contract), so
+			// the account-creation outcome in the DB is the real signal here.
+			if !tc.wantUser {
+				if err != nil {
+					t.Fatalf("expected inline re-render (nil error), got: %v", err)
+				}
+				if !strings.Contains(w.Body.String(), "Registration is closed") {
+					t.Errorf("expected rejection message in response body, got: %s", w.Body.String())
+				}
+			} else if err != nil {
+				t.Fatalf("expected oauth signup to succeed, got error: %v", err)
+			}
+
+			assert.Equal(t, tc.wantUser, userExists(t, app, username),
+				"unexpected account-creation outcome for case %q", tc.name)
+		})
+	}
+}
+
+// TestOAuthSignupCannotSwapInviteCodeWithoutInvalidatingSignature proves the
+// replay bypass from Finding B is closed: a signature minted for one
+// invite_code (or none) can no longer be reused with a different invite_code
+// value, since InviteCode is now part of the signed payload.
+func TestOAuthSignupCannotSwapInviteCodeWithoutInvalidatingSignature(t *testing.T) {
+	app := newSignupTestApp(t)
+	app.cfg.App.OpenRegistration = true // signature minted while registration was open
+	h := newTestOauthHandler(app)
+
+	username := "oauthsignup-swap"
+	tp := oauthSignupPageParams{
+		AccessToken:     "tok-swap",
+		TokenUsername:   username,
+		TokenAlias:      username,
+		TokenRemoteUser: "remote-swap",
+		ClientID:        "client1",
+		Provider:        "generic",
+		InviteCode:      "", // signed with an empty invite code
+	}
+	sig := signOauthParams(app.cfg.Server.HashSeed, tp)
+
+	// Registration is closed by the time the (replayed) form is submitted.
+	app.cfg.App.OpenRegistration = false
+
+	form := url.Values{}
+	form.Set(oauthParamAccessToken, tp.AccessToken)
+	form.Set(oauthParamTokenUsername, tp.TokenUsername)
+	form.Set(oauthParamTokenAlias, tp.TokenAlias)
+	form.Set(oauthParamTokenRemoteUserID, tp.TokenRemoteUser)
+	form.Set(oauthParamClientID, tp.ClientID)
+	form.Set(oauthParamProvider, tp.Provider)
+	form.Set(oauthParamInviteCode, "swapped-in-bogus-code") // tampered after signing
+	form.Set(oauthParamHash, sig)
+	form.Set(oauthParamUsername, username)
+
+	req := httptest.NewRequest("POST", "/oauth/signup", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	err := h.viewOauthSignup(app, w, req)
+	httpErr, ok := err.(impart.HTTPError)
+	if !ok {
+		t.Fatalf("expected impart.HTTPError, got %T (%v)", err, err)
+	}
+	if httpErr.Status != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d (tampered request)", httpErr.Status, http.StatusBadRequest)
+	}
+	assert.False(t, userExists(t, app, username))
+}
+
+// TestOAuthSignupNormalizesUsername is regression coverage for #648 and #844:
+// usernames created via OAuth must be run through the same slug normalization as
+// normal registration, so the resulting collection alias is always lowercase.
+// Otherwise the blog 404s, since collection URLs are redirected to their
+// lowercase form on request but no matching (lowercase) alias exists.
+func TestOAuthSignupNormalizesUsername(t *testing.T) {
+	app := newSignupTestApp(t)
+	app.cfg.App.OpenRegistration = true
+	h := newTestOauthHandler(app)
+
+	const submitted = "MixedCaseUser"
+	const normalized = "mixedcaseuser"
+
+	tp := oauthSignupPageParams{
+		AccessToken:     "tok-mixed",
+		TokenUsername:   submitted,
+		TokenAlias:      submitted,
+		TokenRemoteUser: "remote-mixed",
+		ClientID:        "client1",
+		Provider:        "generic",
+	}
+	sig := signOauthParams(app.cfg.Server.HashSeed, tp)
+
+	form := url.Values{}
+	form.Set(oauthParamAccessToken, tp.AccessToken)
+	form.Set(oauthParamTokenUsername, tp.TokenUsername)
+	form.Set(oauthParamTokenAlias, tp.TokenAlias)
+	form.Set(oauthParamTokenRemoteUserID, tp.TokenRemoteUser)
+	form.Set(oauthParamClientID, tp.ClientID)
+	form.Set(oauthParamProvider, tp.Provider)
+	form.Set(oauthParamHash, sig)
+	form.Set(oauthParamUsername, submitted)
+
+	req := httptest.NewRequest("POST", "/oauth/signup", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	if err := h.viewOauthSignup(app, w, req); err != nil {
+		t.Fatalf("expected oauth signup to succeed, got error: %v", err)
+	}
+
+	assert.True(t, userExists(t, app, normalized), "user should be stored with a lowercased username")
+	assert.False(t, userExists(t, app, submitted), "user should not be stored with the raw mixed-case username")
+
+	var alias string
+	err := app.db.QueryRow("SELECT alias FROM collections WHERE alias = ?", normalized).Scan(&alias)
+	if err != nil {
+		t.Fatalf("expected collection with lowercased alias %q: %v", normalized, err)
+	}
+	assert.Equal(t, normalized, alias, "collection alias must be lowercase to be reachable")
+}
diff --git a/static/fonts/MaterialIcons-Regular.eot b/static/fonts/MaterialIcons-Regular.eot
deleted file mode 100644
index 70508eb..0000000
Binary files a/static/fonts/MaterialIcons-Regular.eot and /dev/null differ
diff --git a/static/fonts/MaterialIcons-Regular.svg b/static/fonts/MaterialIcons-Regular.svg
deleted file mode 100644
index a449327..0000000
--- a/static/fonts/MaterialIcons-Regular.svg
+++ /dev/null
@@ -1,2373 +0,0 @@
-<?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >
-<!--
-2016-2-8: Created with FontForge (http://fontforge.org)
--->
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
-<metadata>
-Created by FontForge 20151118 at Mon Feb  8 11:58:02 2016
- By shyndman
-Copyright 2015 Google, Inc. All Rights Reserved.
-</metadata>
-<defs>
-<font id="MaterialIcons-Regular" horiz-adv-x="512" >
-  <font-face 
-    font-family="Material Icons"
-    font-weight="400"
-    font-stretch="normal"
-    units-per-em="512"
-    panose-1="2 0 5 3 0 0 0 0 0 0"
-    ascent="512"
-    descent="0"
-    bbox="0 0 512 512"
-    underline-thickness="50"
-    underline-position="-100"
-    unicode-range="U+0030-10FFFD"
-  />
-    <missing-glyph />
-    <glyph glyph-name="3d_rotation" unicode="&#x33;d_rotation" 
-d="M256 512c134 0 244 -103 255 -234h-32c-7 80 -57 147 -127 180l-29 -28l-81 81zM353 260c0 34.9356 -13.6691 57 -47 57h-20v-123h19c25.6434 0 40.2719 13.9518 46 34c2 7 2 15 2 24v8zM306 341c38.1819 0 60.9327 -19.3318 72 -47c4 -10 5 -22 5 -34v-8
-c0 -26.4057 -7.57104 -45.571 -21 -59c-13.4122 -13.4122 -30.5519 -22 -57 -22h-49v170h50zM207 258c15.3033 -6.12131 28 -18.2465 28 -39c0 -8 -2 -14 -5 -20s-6 -12 -11 -16c-9.37815 -7.50252 -23.5479 -12 -40 -12c-31.0959 0 -54 15.7441 -54 47h27
-c0 -15.4518 11.6022 -25 27 -25c17.8699 0 28 8.53939 28 27c0 18.8434 -12.3951 27 -31 27h-16v22h16c17.3039 0 29 8.03066 29 25c0 16.5246 -8.84017 25 -26 25c-14.4441 0 -25 -8.58131 -25 -23h-28c0 14.8936 7.55163 24.5516 15 32c9.92709 7.94167 20.8987 13 38 13
-c25.6475 0 40.3859 -9.7718 49 -27c3 -6 4 -12 4 -20c0 -18.1878 -12.3353 -29.6677 -25 -36zM160 54l29 28l81 -81l-14 -1c-134 0 -244 104 -255 235h32c8 -80 57 -148 127 -181z" />
-    <glyph glyph-name="ac_unit" unicode="ac_unit" 
-d="M469 277v-42h-89l69 -69l-30 -31l-99 100h-43v-43l100 -99l-31 -30l-69 69v-89h-42v89l-69 -69l-31 30l100 99v43h-43l-99 -100l-30 31l69 69h-89v42h89l-69 69l30 31l99 -100h43v43l-100 99l31 30l69 -69v89h42v-89l69 69l31 -30l-100 -99v-43h43l99 100l30 -31l-69 -69
-h89z" />
-    <glyph glyph-name="access_alarm" unicode="access_alarm" 
-d="M256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM267 341v-112l85 -50l-16 -26l-101 60v128h32zM168 440l-98 -82l-27 32l98 82zM469 390
-l-27 -33l-98 83l27 32z" />
-    <glyph glyph-name="access_alarms" unicode="access_alarms" 
-d="M256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c107 0 192 -85 192 -192s-85 -192 -192 -192s-192 85 -192 192s85 192 192 192zM267 341v-113l85 -51l-17 -26l-100 62v128h32zM169 439l-99 -81l-27 32l98 81zM469 390
-l-27 -32l-99 84l28 32z" />
-    <glyph glyph-name="access_time" unicode="access_time" 
-d="M267 363v-112l96 -57l-16 -27l-112 68v128h32zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="accessibility" unicode="accessibility" 
-d="M448 320h-128v-277h-43v128h-42v-128h-43v277h-128v43h384v-43zM256 469c23 0 43 -19 43 -42s-20 -43 -43 -43s-43 20 -43 43s20 42 43 42z" />
-    <glyph glyph-name="accessible" unicode="accessible" 
-d="M274 128h44c-10 -49 -53 -85 -105 -85c-59 0 -106 47 -106 106c0 52 36 95 85 105v-44c-25 -9 -43 -33 -43 -61c0 -35 29 -64 64 -64c28 0 52 18 61 43zM213 318c0 29.9891 33.3578 56.5098 64 39h1v-1c5 -2 9 -5 13 -9l28 -31c21 -23 53 -39 86 -39v-42
-c-37 0 -78 18 -106 41v-73h64c23 0 42 -20 42 -43v-117h-42v106h-107c-23 0 -43 20 -43 43v126zM213 427c0 24 19 42 43 42s43 -18 43 -42s-19 -43 -43 -43s-43 19 -43 43z" />
-    <glyph glyph-name="account_balance" unicode="account_balance" 
-d="M245 491l203 -107v-43h-405v43zM341 299h64v-150h-64v150zM43 43v64h405v-64h-405zM213 299h64v-150h-64v150zM85 299h64v-150h-64v150z" />
-    <glyph glyph-name="account_balance_wallet" unicode="account_balance_wallet" 
-d="M341 224c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM256 171v170h213v-170h-213zM448 128v-21c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h298c23 0 43 -20 43 -43v-21h-192c-24 0 -43 -20 -43 -43v-170
-c0 -23 19 -43 43 -43h192z" />
-    <glyph glyph-name="account_box" unicode="account_box" 
-d="M128 149v-21h256v21c0 43 -85 66 -128 66s-128 -23 -128 -66zM320 320c0 35 -29 64 -64 64s-64 -29 -64 -64s29 -64 64 -64s64 29 64 64zM64 405c0 23 19 43 43 43h298c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298z" />
-    <glyph glyph-name="account_circle" unicode="account_circle" 
-d="M256 102c53 0 100 28 128 69c-1 42 -86 66 -128 66c-43 0 -127 -24 -128 -66c28 -41 75 -69 128 -69zM256 405c-35 0 -64 -29 -64 -64s29 -64 64 -64s64 29 64 64s-29 64 -64 64zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z
-" />
-    <glyph glyph-name="adb" unicode="adb" 
-d="M320 320c12 0 21 9 21 21s-9 22 -21 22s-21 -10 -21 -22s9 -21 21 -21zM192 320c12 0 21 9 21 21s-9 22 -21 22s-21 -10 -21 -22s9 -21 21 -21zM344 419c37 -27 61 -71 61 -120v-22h-298v22c0 49 24 93 61 120l-45 45l18 17l49 -49c20 10 42 16 66 16s46 -6 66 -16l49 49
-l18 -17zM107 171v85h298v-85c0 -83 -66 -150 -149 -150s-149 67 -149 150z" />
-    <glyph glyph-name="add" unicode="add" 
-d="M405 235h-128v-128h-42v128h-128v42h128v128h42v-128h128v-42z" />
-    <glyph glyph-name="add_a_photo" unicode="add_a_photo" 
-d="M209 213c0 38 30 69 68 69s69 -31 69 -69s-31 -68 -69 -68s-68 30 -68 68zM277 107c59 0 107 47 107 106s-48 107 -107 107s-106 -48 -106 -107s47 -106 106 -106zM128 299v64h64v64h149l39 -43h68c23 0 43 -20 43 -43v-256c0 -23 -20 -42 -43 -42h-341
-c-23 0 -43 19 -43 42v214h64zM64 427v64h43v-64h64v-43h-64v-64h-43v64h-64v43h64z" />
-    <glyph glyph-name="add_alarm" unicode="add_alarm" 
-d="M277 320v-64h64v-43h-64v-64h-42v64h-64v43h64v64h42zM256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM469 390l-27 -33l-98 83l27 32z
-M168 440l-98 -82l-27 32l98 82z" />
-    <glyph glyph-name="add_alert" unicode="add_alert" 
-d="M341 234v43h-64v64h-42v-64h-64v-43h64v-64h42v64h64zM403 153l45 -45v-23h-384v23l45 45v124c0 69 48 128 113 143v15c0 19 15 34 34 34s34 -15 34 -34v-15c65 -15 113 -74 113 -143v-124zM214 64h84c0 -23 -19 -43 -42 -43s-42 20 -42 43z" />
-    <glyph glyph-name="add_box" unicode="add_box" 
-d="M363 235v42h-86v86h-42v-86h-86v-42h86v-86h42v86h86zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="add_circle" unicode="add_circle" 
-d="M363 235v42h-86v86h-42v-86h-86v-42h86v-86h42v86h86zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="add_circle_outline" unicode="add_circle_outline" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM277 363v-86h86v-42h-86v-86h-42v86h-86v42h86v86h42z" />
-    <glyph glyph-name="add_location" unicode="add_location" 
-d="M341 299v42h-64v64h-42v-64h-64v-42h64v-64h42v64h64zM256 469c82 0 149 -67 149 -149c0 -112 -149 -277 -149 -277s-149 165 -149 277c0 82 67 149 149 149z" />
-    <glyph glyph-name="add_shopping_cart" unicode="add_shopping_cart" 
-d="M153 197c0 -3 2 -5 5 -5h247v-43h-256c-23 0 -42 20 -42 43c0 7 2 14 5 20l29 53l-77 162h-43v42h70c13.5017 -28.165 26.8327 -56.5006 40 -85c17.0313 -35.6353 33.8016 -71.5317 51 -107h150c27.393 49.9404 55.2665 99.4002 82 150l37 -21l-82 -149
-c-7 -13 -21 -22 -37 -22h-159l-19 -35zM363 128c23 0 42 -20 42 -43s-19 -42 -42 -42s-43 19 -43 42s20 43 43 43zM149 128c23 0 43 -20 43 -43s-20 -42 -43 -42s-42 19 -42 42s19 43 42 43zM235 320v64h-64v43h64v64h42v-64h64v-43h-64v-64h-42z" />
-    <glyph glyph-name="add_to_photos" unicode="add_to_photos" 
-d="M405 277v43h-85v85h-43v-85h-85v-43h85v-85h43v85h85zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42z" />
-    <glyph glyph-name="add_to_queue" unicode="add_to_queue" 
-d="M341 299v-43h-64v-64h-42v64h-64v43h64v64h42v-64h64zM448 149v256h-384v-256h384zM448 448c23 0 43 -19 43 -43l-1 -256c0 -23 -19 -42 -42 -42h-107v-43h-170v43h-107c-24 0 -43 19 -43 42v256c0 24 19 43 43 43h384z" />
-    <glyph glyph-name="adjust" unicode="adjust" 
-d="M320 256c0 -35 -29 -64 -64 -64s-64 29 -64 64s29 64 64 64s64 -29 64 -64zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="airline_seat_flat" unicode="airline_seat_flat" 
-d="M152 254c-25 -25 -65 -26 -90 -1s-26 65 -1 90s65 26 90 1s26 -65 1 -90zM43 213h426v-42h-128v-43h-170v43h-128v42zM469 277v-42h-277v128h192c47 0 85 -39 85 -86z" />
-    <glyph glyph-name="airline_seat_flat_angled" unicode="airline_seat_flat_angled" 
-d="M156 294c-32 -15 -71 -2 -86 30s-2 71 30 86s71 2 86 -30s2 -71 -30 -86zM32 253l15 40l405 -146l-14 -40l-97 34v-34h-170v96zM475 207l-15 -40l-264 95l45 121l182 -66c45 -16 68 -65 52 -110z" />
-    <glyph glyph-name="airline_seat_individual_suite" unicode="airline_seat_individual_suite" 
-d="M405 363c47 0 86 -39 86 -86v-128h-470v214h43v-150h171v150h170zM149 235c-35 0 -64 29 -64 64s29 64 64 64s64 -29 64 -64s-29 -64 -64 -64z" />
-    <glyph glyph-name="airline_seat_legroom_extra" unicode="airline_seat_legroom_extra" 
-d="M487 144c9 -16 1 -36 -15 -44l-79 -36l-73 149h-149c-35 0 -64 29 -64 64v171h128v-128h75c16 0 31 -9 38 -24l72 -149l24 11c16 7 35 1 43 -14zM85 256c0 -35 29 -64 64 -64h128v-43h-128c-59 0 -106 48 -106 107v192h42v-192z" />
-    <glyph glyph-name="airline_seat_legroom_normal" unicode="airline_seat_legroom_normal" 
-d="M437 128c18 0 32 -14 32 -32s-14 -32 -32 -32h-96v149h-149c-35 0 -64 29 -64 64v171h128v-128h107c23 0 42 -20 42 -43v-149h32zM107 256c0 -35 29 -64 64 -64h128v-43h-128c-59 0 -107 48 -107 107v192h43v-192z" />
-    <glyph glyph-name="airline_seat_legroom_reduced" unicode="airline_seat_legroom_reduced" 
-d="M107 256c0 -35 29 -64 64 -64h85v-43h-85c-59 0 -107 48 -107 107v192h43v-192zM426 102c4 -20 -11 -38 -31 -38h-96v64l21 85h-128c-35 0 -64 29 -64 64v171h128v-128h107c23 0 42 -20 42 -43l-42 -149h30c16 0 30 -11 33 -26z" />
-    <glyph glyph-name="airline_seat_recline_extra" unicode="airline_seat_recline_extra" 
-d="M346 192l123 -96l-32 -32l-81 64h-146c-31 0 -57 22 -63 52l-29 126c-4 26 13 51 39 56h1c15.1794 2.16848 28.3139 -2.05108 37 -9l35 -27c27 -21 65 -34 100 -27v-46c-40 -7 -76 7 -110 26l22 -87h104zM341 107v-43h-150c-53 0 -98 38 -106 90l-42 209h42l42 -202
-c5 -31 32 -54 64 -54h150zM114 392c-19 14 -23 40 -10 59s40 24 59 11c19 -14 24 -41 11 -60c-14 -19 -41 -23 -60 -10z" />
-    <glyph glyph-name="airline_seat_recline_normal" unicode="airline_seat_recline_normal" 
-d="M427 84l-31 -31l-75 75h-108c-35 0 -64 29 -64 64v123c0 26 22 48 48 48h1c14.8367 0 27.399 -8.39902 35 -16l30 -33c23 -25 65 -43 100 -43v-47c-41 0 -88 22 -118 47v-79h74zM128 171c0 -35 29 -64 64 -64h128v-43h-128c-59 0 -107 48 -107 107v192h43v-192zM162 397
-c-17 17 -17 43 0 60s43 17 60 0s17 -43 0 -60s-43 -17 -60 0z" />
-    <glyph glyph-name="airplanemode_active" unicode="airplanemode_active" 
-d="M217 320zM448 171l-171 53v-117l43 -32v-32l-75 21l-74 -21v32l42 32v117l-170 -53v42l170 107v117c0 18 14 32 32 32s32 -14 32 -32v-117l171 -107v-42z" />
-    <glyph glyph-name="airplanemode_inactive" unicode="airplanemode_inactive" 
-d="M64 400l27 27l336 -336l-27 -27l-123 122v-79l43 -32v-32l-75 21l-74 -21v32l42 32v117l-170 -53v42l127 80zM277 320l171 -107v-42l-68 21l-167 167v78c0 18 14 32 32 32s32 -14 32 -32v-117z" />
-    <glyph glyph-name="airplay" unicode="airplay" 
-d="M448 448c23 0 43 -20 43 -43v-256c0 -23 -20 -42 -43 -42h-85v42h85v256h-384v-256h85v-42h-85c-23 0 -43 19 -43 42v256c0 23 20 43 43 43h384zM128 43l128 128l128 -128h-256z" />
-    <glyph glyph-name="airport_shuttle" unicode="airport_shuttle" 
-d="M320 277h107l-86 86h-21v-86zM373 139c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM277 277v86h-85v-86h85zM128 139c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM64 277h85v86h-85v-86zM363 405l128 -128v-106h-54
-c0 -35 -29 -64 -64 -64s-64 29 -64 64h-117c0 -35 -29 -64 -64 -64s-64 29 -64 64h-43v192c0 24 20 42 43 42h299z" />
-    <glyph glyph-name="alarm" unicode="alarm" 
-d="M256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM267 341v-112l85 -50l-16 -26l-101 60v128h32zM168 440l-98 -82l-27 32l98 82zM469 390
-l-27 -33l-98 83l27 32z" />
-    <glyph glyph-name="alarm_add" unicode="alarm_add" 
-d="M277 320v-64h64v-43h-64v-64h-42v64h-64v43h64v64h42zM256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM469 390l-27 -33l-98 83l27 32z
-M168 440l-98 -82l-27 32l98 82z" />
-    <glyph glyph-name="alarm_off" unicode="alarm_off" 
-d="M171 442l-18 -15l-31 30l19 15zM351 120l-210 210c-21 -26 -34 -59 -34 -95c0 -83 66 -150 149 -150c36 0 69 14 95 35zM62 463c131.276 -131.057 262.677 -261.99 394 -393l-27 -27l-47 47c-34 -29 -78 -47 -126 -47c-106 0 -192 86 -192 192c0 48 18 91 47 125l-17 17
-l-24 -20l-30 31l24 19l-29 29zM469 390l-27 -33l-98 83l27 32zM256 384c-18 0 -35 -3 -51 -9l-33 32c25 12 54 20 84 20c106 0 192 -86 192 -192c0 -30 -7 -59 -19 -84l-33 32c6 16 9 34 9 52c0 83 -66 149 -149 149z" />
-    <glyph glyph-name="alarm_on" unicode="alarm_on" 
-d="M225 202l105 106l23 -23l-128 -128l-68 68l22 22zM256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM168 440l-98 -82l-27 32l98 82zM469 390
-l-27 -33l-98 83l27 32z" />
-    <glyph glyph-name="album" unicode="album" 
-d="M256 277c12 0 21 -9 21 -21s-9 -21 -21 -21s-21 9 -21 21s9 21 21 21zM256 160c53 0 96 43 96 96s-43 96 -96 96s-96 -43 -96 -96s43 -96 96 -96zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="all_inclusive" unicode="all_inclusive" 
-d="M397 371c64 0 115 -52 115 -115s-51 -115 -115 -115c-31 0 -60 12 -82 34l-27 24l32 28l25 -21c15 -15 33 -22 52 -22c40 0 72 32 72 72s-32 72 -72 72c-19 0 -37 -7 -51 -21c-30.1331 -26.5336 -60.4726 -52.8608 -90 -80l-60 -53c-21 -21 -50 -33 -81 -33
-c-64 0 -115 52 -115 115s51 115 115 115c31 0 60 -12 82 -34l27 -24l-33 -28l-24 21c-15 15 -33 22 -52 22c-40 0 -72 -32 -72 -72s32 -72 72 -72c19 0 37 7 51 21c30.1331 26.5336 60.4726 52.8608 90 80l60 53c21 21 50 33 81 33z" />
-    <glyph glyph-name="all_out" unicode="all_out" 
-d="M343 170c45 45 45 120 0 165s-120 45 -165 0s-45 -120 0 -165s120 -45 165 0zM366 358c58 -58 58 -153 0 -211s-153 -58 -211 0s-58 153 0 211s153 58 211 0zM90 338v85h85zM175 82h-85v85zM431 167v-85h-85zM346 423h85v-85z" />
-    <glyph glyph-name="android" unicode="android" 
-d="M320 405v22h-21v-22h21zM213 405v22h-21v-22h21zM331 466c32 -23 53 -61 53 -103h-256c0 42 20 80 52 103l-28 28c-4 4 -4 11 0 15s11 4 15 0l32 -32c17 9 37 14 57 14s39 -5 56 -14l32 32c4 4 11 4 15 0s4 -11 0 -15zM437 341c18 0 32 -14 32 -32v-149
-c0 -18 -14 -32 -32 -32s-32 14 -32 32v149c0 18 14 32 32 32zM75 341c18 0 32 -14 32 -32v-149c0 -18 -14 -32 -32 -32s-32 14 -32 32v149c0 18 14 32 32 32zM128 128v213h256v-213c0 -12 -9 -21 -21 -21h-22v-75c0 -18 -14 -32 -32 -32s-32 14 -32 32v75h-42v-75
-c0 -18 -14 -32 -32 -32s-32 14 -32 32v75h-22c-12 0 -21 9 -21 21z" />
-    <glyph glyph-name="announcement" unicode="announcement" 
-d="M277 192v43h-42v-43h42zM277 277v128h-42v-128h42zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="apps" unicode="apps" 
-d="M341 85v86h86v-86h-86zM341 213v86h86v-86h-86zM213 341v86h86v-86h-86zM341 427h86v-86h-86v86zM213 213v86h86v-86h-86zM85 213v86h86v-86h-86zM85 85v86h86v-86h-86zM213 85v86h86v-86h-86zM85 341v86h86v-86h-86z" />
-    <glyph glyph-name="archive" unicode="archive" 
-d="M109 405h294l-20 22h-256zM256 139l117 117h-74v43h-86v-43h-74zM438 400c6 -7 10 -17 10 -27v-266c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v266c0 10 4 20 10 27l29 36c6 7 15 12 25 12h256c10 0 19 -5 25 -12z" />
-    <glyph glyph-name="arrow_back" unicode="arrow_back" 
-d="M427 277v-42h-260l119 -120l-30 -30l-171 171l171 171l30 -30l-119 -120h260z" />
-    <glyph glyph-name="arrow_downward" unicode="arrow_downward" 
-d="M427 256l-171 -171l-171 171l31 30l119 -119v260h42v-260l120 119z" />
-    <glyph glyph-name="arrow_drop_down" unicode="arrow_drop_down" 
-d="M149 299h214l-107 -107z" />
-    <glyph glyph-name="arrow_drop_down_circle" unicode="arrow_drop_down_circle" 
-d="M256 213l85 86h-170zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="arrow_drop_up" unicode="arrow_drop_up" 
-d="M149 213l107 107l107 -107h-214z" />
-    <glyph glyph-name="arrow_forward" unicode="arrow_forward" 
-d="M256 427l171 -171l-171 -171l-30 30l119 120h-260v42h260l-119 120z" />
-    <glyph glyph-name="arrow_upward" unicode="arrow_upward" 
-d="M85 256l171 171l171 -171l-31 -30l-119 119v-260h-42v260l-120 -119z" />
-    <glyph glyph-name="art_track" unicode="art_track" 
-d="M224 192l-48 64l-37 -48l-27 32l-37 -48h149zM256 320v-128c0 -23 -20 -43 -43 -43h-128c-23 0 -42 20 -42 43v128c0 23 19 43 42 43h128c23 0 43 -20 43 -43zM299 149v43h170v-43h-170zM469 363v-43h-170v43h170zM469 235h-170v42h170v-42z" />
-    <glyph glyph-name="aspect_ratio" unicode="aspect_ratio" 
-d="M448 106v300h-384v-300h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384zM149 320v-64h-42v107h106v-43h-64zM405 256v-107h-106v43h64v64h42z" />
-    <glyph glyph-name="assessment" unicode="assessment" 
-d="M363 149v86h-43v-86h43zM277 149v214h-42v-214h42zM192 149v150h-43v-150h43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="assignment" unicode="assignment" 
-d="M363 320v43h-214v-43h214zM363 235v42h-214v-42h214zM299 149v43h-150v-43h150zM256 448c-12 0 -21 -9 -21 -21s9 -22 21 -22s21 10 21 22s-9 21 -21 21zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h89
-c9 25 32 43 60 43s51 -18 60 -43h89z" />
-    <glyph glyph-name="assignment_ind" unicode="assignment_ind" 
-d="M384 107v30c0 43 -85 66 -128 66s-128 -23 -128 -66v-30h256zM256 363c-35 0 -64 -29 -64 -64s29 -64 64 -64s64 29 64 64s-29 64 -64 64zM256 448c-12 0 -21 -9 -21 -21s9 -22 21 -22s21 10 21 22s-9 21 -21 21zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43
-h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h89c9 25 32 43 60 43s51 -18 60 -43h89z" />
-    <glyph glyph-name="assignment_late" unicode="assignment_late" 
-d="M256 405c12 0 21 10 21 22s-9 21 -21 21s-21 -9 -21 -21s9 -22 21 -22zM277 213v128h-42v-128h42zM277 128v43h-42v-43h42zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h89c9 25 32 43 60 43s51 -18 60 -43
-h89z" />
-    <glyph glyph-name="assignment_return" unicode="assignment_return" 
-d="M341 192v85h-85v64l-107 -106l107 -107v64h85zM256 448c-12 0 -21 -9 -21 -21s9 -22 21 -22s21 10 21 22s-9 21 -21 21zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h89c9 25 32 43 60 43s51 -18 60 -43h89z
-" />
-    <glyph glyph-name="assignment_returned" unicode="assignment_returned" 
-d="M256 128l107 107h-64v85h-86v-85h-64zM256 448c-12 0 -21 -9 -21 -21s9 -22 21 -22s21 10 21 22s-9 21 -21 21zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h89c9 25 32 43 60 43s51 -18 60 -43h89z" />
-    <glyph glyph-name="assignment_turned_in" unicode="assignment_turned_in" 
-d="M213 149l171 171l-30 30l-141 -140l-55 55l-30 -30zM256 448c-12 0 -21 -9 -21 -21s9 -22 21 -22s21 10 21 22s-9 21 -21 21zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h89c9 25 32 43 60 43s51 -18 60 -43
-h89z" />
-    <glyph glyph-name="assistant" unicode="assistant" 
-d="M296 237l88 40l-88 40l-40 88l-40 -88l-88 -40l88 -40l40 -88zM405 469c23 0 43 -19 43 -42v-299c0 -23 -20 -43 -43 -43h-85l-64 -64l-64 64h-85c-23 0 -43 20 -43 43v299c0 23 20 42 43 42h298z" />
-    <glyph glyph-name="assistant_photo" unicode="assistant_photo" 
-d="M307 384h120v-213h-150l-8 42h-120v-149h-42v363h192z" />
-    <glyph glyph-name="attach_file" unicode="attach_file" 
-d="M352 384h32v-245c0 -65 -52 -118 -117 -118s-118 53 -118 118v266c0 47 39 86 86 86s85 -39 85 -86v-224c0 -29 -24 -53 -53 -53s-54 24 -54 53v203h32v-203c0 -12 10 -21 22 -21s21 9 21 21v224c0 29 -24 54 -53 54s-54 -25 -54 -54v-266c0 -47 39 -86 86 -86
-s85 39 85 86v245z" />
-    <glyph glyph-name="attach_money" unicode="attach_money" 
-d="M252 279c48 -13 100 -32 100 -93c0 -44 -33 -68 -75 -76v-46h-64v46c-41 9 -75 35 -78 82h47c2 -25 19 -45 63 -45c47 0 58 23 58 38c0 20 -11 39 -64 52c-60 14 -100 39 -100 88c0 41 33 68 74 77v46h64v-47c45 -11 68 -44 69 -81h-47c-1 27 -16 45 -54 45
-c-36 0 -57 -17 -57 -40c0 -20 16 -33 64 -46z" />
-    <glyph glyph-name="attachment" unicode="attachment" 
-d="M43 245c0 65 52 118 117 118h224c47 0 85 -39 85 -86s-38 -85 -85 -85h-181c-29 0 -54 24 -54 53s25 54 54 54h160v-43h-162c-12 0 -12 -21 0 -21h183c23 0 43 19 43 42s-20 43 -43 43h-224c-41 0 -75 -34 -75 -75s34 -74 75 -74h203v-43h-203c-65 0 -117 52 -117 117z
-" />
-    <glyph glyph-name="audiotrack" unicode="audiotrack" 
-d="M256 448h149v-64h-85v-235h-1c-5 -48 -46 -85 -95 -85c-53 0 -96 43 -96 96s43 96 96 96c11 0 22 -2 32 -6v198z" />
-    <glyph glyph-name="autorenew" unicode="autorenew" 
-d="M400 347c17 -26 27 -58 27 -91c0 -94 -77 -171 -171 -171v-64l-85 86l85 85v-64c71 0 128 57 128 128c0 22 -6 42 -15 60zM256 384c-71 0 -128 -57 -128 -128c0 -22 5 -42 15 -60l-31 -31c-17 26 -27 58 -27 91c0 94 77 171 171 171v64l85 -86l-85 -85v64z" />
-    <glyph glyph-name="av_timer" unicode="av_timer" 
-d="M128 256c0 12 9 21 21 21s22 -9 22 -21s-10 -21 -22 -21s-21 9 -21 21zM384 256c0 -12 -9 -21 -21 -21s-22 9 -22 21s10 21 22 21s21 -9 21 -21zM235 448h21c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192c0 63 30 118 77 153v1l145 -145l-30 -30
-l-116 115c-21 -26 -33 -58 -33 -94c0 -83 66 -149 149 -149s149 66 149 149c0 75 -56 138 -128 148v-41h-42v85zM235 149c0 12 9 22 21 22s21 -10 21 -22s-9 -21 -21 -21s-21 9 -21 21z" />
-    <glyph glyph-name="backspace" unicode="backspace" 
-d="M405 179l-76 77l76 77l-30 30l-76 -77l-77 77l-30 -30l77 -77l-77 -77l30 -30l77 77l76 -77zM469 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-320c-15 0 -26 8 -34 19l-115 173l115 173c8 11 19 19 34 19h320z" />
-    <glyph glyph-name="backup" unicode="backup" 
-d="M299 235h64l-107 106l-107 -106h64v-86h86v86zM413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="battery_alert" unicode="battery_alert" 
-d="M277 213v107h-42v-107h42zM277 128v43h-42v-43h42zM334 427c16 0 29 -13 29 -29v-327c0 -16 -13 -28 -29 -28h-156c-16 0 -29 12 -29 28v327c0 16 13 29 29 29h35v42h86v-42h35z" />
-    <glyph glyph-name="battery_charging_full" unicode="battery_charging_full" 
-d="M235 85l85 160h-43v118l-85 -160h43v-118zM334 427c16 0 29 -13 29 -29v-327c0 -16 -13 -28 -29 -28h-156c-16 0 -29 12 -29 28v327c0 16 13 29 29 29h35v42h86v-42h35z" />
-    <glyph glyph-name="battery_full" unicode="battery_full" 
-d="M334 427c16 0 29 -13 29 -29v-327c0 -16 -13 -28 -29 -28h-156c-16 0 -29 12 -29 28v327c0 16 13 29 29 29h35v42h86v-42h35z" />
-    <glyph glyph-name="battery_std" unicode="battery_std" 
-d="M334 427c16 0 29 -13 29 -29v-327c0 -16 -13 -28 -29 -28h-156c-16 0 -29 12 -29 28v327c0 16 13 29 29 29h35v42h86v-42h35z" />
-    <glyph glyph-name="battery_unknown" unicode="battery_unknown" 
-d="M305 241c9 9 15 22 15 36c0 35 -29 64 -64 64s-64 -29 -64 -64h32c0 18 14 32 32 32s32 -14 32 -32c0 -9 -3 -16 -9 -22l-20 -20c-10 -10 -20 -25 -20 -43h34c0 10 8 24 18 34c6 6 14 15 14 15zM276 129v41h-40v-41h40zM334 427c16 0 29 -13 29 -29v-327
-c0 -16 -13 -28 -29 -28h-156c-16 0 -29 12 -29 28v327c0 16 13 29 29 29h35v42h86v-42h35z" />
-    <glyph glyph-name="beach_access" unicode="beach_access" 
-d="M372 324c-66.8504 66.8504 -159.585 88.9016 -243.437 61.1868c63.7841 7.27512 145.981 -25.7308 212.437 -92.1868l-122 -122c-66.456 66.456 -99.4619 148.653 -92.1868 212.437c-27.7148 -83.8524 -5.66368 -176.587 61.1868 -243.437l-61 -61
-c-83.9541 83.9541 -84 220.85 -0.137673 304.862c0.129398 1.10582 0.166618 1.14572 1.27547 1.27547c84.012 83.8623 220.908 83.8164 304.862 -0.137673zM280 201l31 31l137 -138l-31 -30z" />
-    <glyph glyph-name="beenhere" unicode="beenhere" 
-d="M213 171l192 192l-30 30l-162 -162l-76 76l-30 -30zM405 491c23 0 43 -20 43 -43v-276c0 -15 -8 -27 -19 -35l-173 -116l-173 116c-11 8 -19 20 -19 35v276c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="block" unicode="block" 
-d="M256 85c94 0 171 77 171 171c0 39 -13 76 -36 105l-240 -240c29 -23 66 -36 105 -36zM85 256c0 -39 13 -76 36 -105l240 240c-29 23 -66 36 -105 36c-94 0 -171 -77 -171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="bluetooth" unicode="bluetooth" 
-d="M317 164l-40 41v-81zM277 388v-81l40 41zM378 348l-92 -92l92 -92l-122 -121h-21v162l-98 -98l-30 30l119 119l-119 119l30 30l98 -98v162h21z" />
-    <glyph glyph-name="bluetooth_audio" unicode="bluetooth_audio" 
-d="M275 164l-40 41v-81zM235 388v-81l40 41zM335 348l-92 -92l92 -92l-122 -121h-21v162l-98 -98l-30 30l119 119l-119 119l30 30l98 -98v162h21zM417 369c20 -32 31 -71 31 -111c0 -42 -12 -80 -33 -113l-25 25c13 26 21 55 21 86s-8 60 -21 86zM304 256l49 49
-c6 -15 10 -32 10 -49s-4 -35 -10 -50z" />
-    <glyph glyph-name="bluetooth_connected" unicode="bluetooth_connected" 
-d="M405 299l43 -43l-43 -43l-42 43zM317 164l-40 41v-81zM277 388v-81l40 41zM378 348l-92 -92l92 -92l-122 -121h-21v162l-98 -98l-30 30l119 119l-119 119l30 30l98 -98v162h21zM149 256l-42 -43l-43 43l43 43z" />
-    <glyph glyph-name="bluetooth_disabled" unicode="bluetooth_disabled" 
-d="M277 124l40 40l-40 41v-81zM115 427l312 -312l-30 -30l-49 49l-92 -91h-21v162l-98 -98l-30 30l119 119l-141 141zM277 388v-69l-42 43v107h21l122 -121l-65 -65l-30 30l34 35z" />
-    <glyph glyph-name="bluetooth_searching" unicode="bluetooth_searching" 
-d="M275 164l-40 41v-81zM235 388v-81l40 41zM335 348l-92 -92l92 -92l-122 -121h-21v162l-98 -98l-30 30l119 119l-119 119l30 30l98 -98v162h21zM417 369c20 -32 31 -71 31 -111c0 -42 -12 -80 -33 -113l-25 25c13 26 21 55 21 86s-8 60 -21 86zM304 256l49 49
-c6 -15 10 -32 10 -49s-4 -35 -10 -50z" />
-    <glyph glyph-name="blur_circular" unicode="blur_circular" 
-d="M299 235c12 0 21 -10 21 -22s-9 -21 -21 -21s-22 9 -22 21s10 22 22 22zM299 160c6 0 10 -5 10 -11s-4 -10 -10 -10s-11 4 -11 10s5 11 11 11zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213
-s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM363 309c6 0 10 -4 10 -10s-4 -11 -10 -11s-11 5 -11 11s5 10 11 10zM363 224c6 0 10 -5 10 -11s-4 -10 -10 -10s-11 4 -11 10s5 11 11 11zM299 352c-6 0 -11 5 -11 11s5 10 11 10s10 -4 10 -10s-4 -11 -10 -11z
-M299 320c12 0 21 -9 21 -21s-9 -22 -21 -22s-22 10 -22 22s10 21 22 21zM213 352c-6 0 -10 5 -10 11s4 10 10 10s11 -4 11 -10s-5 -11 -11 -11zM149 224c6 0 11 -5 11 -11s-5 -10 -11 -10s-10 4 -10 10s4 11 10 11zM213 160c6 0 11 -5 11 -11s-5 -10 -11 -10s-10 4 -10 10
-s4 11 10 11zM149 309c6 0 11 -4 11 -10s-5 -11 -11 -11s-10 5 -10 11s4 10 10 10zM213 235c12 0 22 -10 22 -22s-10 -21 -22 -21s-21 9 -21 21s9 22 21 22zM213 320c12 0 22 -9 22 -21s-10 -22 -22 -22s-21 10 -21 22s9 21 21 21z" />
-    <glyph glyph-name="blur_linear" unicode="blur_linear" 
-d="M277 149c-12 0 -21 10 -21 22s9 21 21 21s22 -9 22 -21s-10 -22 -22 -22zM277 235c-12 0 -21 9 -21 21s9 21 21 21s22 -9 22 -21s-10 -21 -22 -21zM277 320c-12 0 -21 9 -21 21s9 22 21 22s22 -10 22 -22s-10 -21 -22 -21zM363 245c-6 0 -11 5 -11 11s5 11 11 11
-s10 -5 10 -11s-4 -11 -10 -11zM363 331c-6 0 -11 4 -11 10s5 11 11 11s10 -5 10 -11s-4 -10 -10 -10zM64 448h384v-43h-384v43zM363 160c-6 0 -11 5 -11 11s5 10 11 10s10 -4 10 -10s-4 -11 -10 -11zM192 149c-12 0 -21 10 -21 22s9 21 21 21s21 -9 21 -21s-9 -22 -21 -22z
-M107 224c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM107 309c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM64 64v43h384v-43h-384zM192 320c-12 0 -21 9 -21 21s9 22 21 22s21 -10 21 -22s-9 -21 -21 -21zM192 235
-c-12 0 -21 9 -21 21s9 21 21 21s21 -9 21 -21s-9 -21 -21 -21zM107 139c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32z" />
-    <glyph glyph-name="blur_off" unicode="blur_off" 
-d="M64 224c6 0 11 -5 11 -11s-5 -10 -11 -10s-11 4 -11 10s5 11 11 11zM128 149c12 0 21 -9 21 -21s-9 -21 -21 -21s-21 9 -21 21s9 21 21 21zM213 75c6 0 11 -5 11 -11s-5 -11 -11 -11s-10 5 -10 11s4 11 10 11zM64 309c6 0 11 -4 11 -10s-5 -11 -11 -11s-11 5 -11 11
-s5 10 11 10zM128 235c12 0 21 -10 21 -22s-9 -21 -21 -21s-21 9 -21 21s9 22 21 22zM448 224c6 0 11 -5 11 -11s-5 -10 -11 -10s-11 4 -11 10s5 11 11 11zM213 149c12 0 22 -9 22 -21s-10 -21 -22 -21s-21 9 -21 21s9 21 21 21zM53 400l27 27l347 -347l-28 -27l-80 81
-c1 -2 1 -4 1 -6c0 -12 -9 -21 -21 -21s-22 9 -22 21s10 21 22 21c2 0 4 0 6 -1l-60 60c-2 -15 -16 -27 -32 -27c-18 0 -32 14 -32 32c0 16 12 30 27 32l-60 60c1 -2 1 -4 1 -6c0 -12 -9 -22 -21 -22s-21 10 -21 22s9 21 21 21l6 -1zM299 75c6 0 10 -5 10 -11s-4 -11 -10 -11
-s-11 5 -11 11s5 11 11 11zM384 363c-12 0 -21 9 -21 21s9 21 21 21s21 -9 21 -21s-9 -21 -21 -21zM384 277c-12 0 -21 10 -21 22s9 21 21 21s21 -9 21 -21s-9 -22 -21 -22zM384 192c-12 0 -21 9 -21 21s9 22 21 22s21 -10 21 -22s-9 -21 -21 -21zM213 363
-c-12 0 -21 9 -21 21s9 21 21 21s22 -9 22 -21s-10 -21 -22 -21zM448 288c-6 0 -11 5 -11 11s5 10 11 10s11 -4 11 -10s-5 -11 -11 -11zM213 437c-6 0 -10 5 -10 11s4 11 10 11s11 -5 11 -11s-5 -11 -11 -11zM299 437c-6 0 -11 5 -11 11s5 11 11 11s10 -5 10 -11
-s-4 -11 -10 -11zM294 267c-14 2 -25 13 -27 27v5c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32h-5zM299 363c-12 0 -22 9 -22 21s10 21 22 21s21 -9 21 -21s-9 -21 -21 -21z" />
-    <glyph glyph-name="blur_on" unicode="blur_on" 
-d="M299 331c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM299 245c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM213 149c12 0 22 -9 22 -21s-10 -21 -22 -21s-21 9 -21 21s9 21 21 21zM213 331c18 0 32 -14 32 -32s-14 -32 -32 -32
-s-32 14 -32 32s14 32 32 32zM299 75c6 0 10 -5 10 -11s-4 -11 -10 -11s-11 5 -11 11s5 11 11 11zM299 149c12 0 21 -9 21 -21s-9 -21 -21 -21s-22 9 -22 21s10 21 22 21zM448 224c6 0 11 -5 11 -11s-5 -10 -11 -10s-11 4 -11 10s5 11 11 11zM384 405c12 0 21 -9 21 -21
-s-9 -21 -21 -21s-21 9 -21 21s9 21 21 21zM384 320c12 0 21 -9 21 -21s-9 -22 -21 -22s-21 10 -21 22s9 21 21 21zM384 149c12 0 21 -9 21 -21s-9 -21 -21 -21s-21 9 -21 21s9 21 21 21zM384 235c12 0 21 -10 21 -22s-9 -21 -21 -21s-21 9 -21 21s9 22 21 22zM213 245
-c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM213 363c-12 0 -21 9 -21 21s9 21 21 21s22 -9 22 -21s-10 -21 -22 -21zM213 437c-6 0 -10 5 -10 11s4 11 10 11s11 -5 11 -11s-5 -11 -11 -11zM213 75c6 0 11 -5 11 -11s-5 -11 -11 -11s-10 5 -10 11
-s4 11 10 11zM64 224c6 0 11 -5 11 -11s-5 -10 -11 -10s-11 4 -11 10s5 11 11 11zM299 437c-6 0 -11 5 -11 11s5 11 11 11s10 -5 10 -11s-4 -11 -10 -11zM299 363c-12 0 -22 9 -22 21s10 21 22 21s21 -9 21 -21s-9 -21 -21 -21zM448 288c-6 0 -11 5 -11 11s5 10 11 10
-s11 -4 11 -10s-5 -11 -11 -11zM128 405c12 0 21 -9 21 -21s-9 -21 -21 -21s-21 9 -21 21s9 21 21 21zM64 309c6 0 11 -4 11 -10s-5 -11 -11 -11s-11 5 -11 11s5 10 11 10zM128 320c12 0 21 -9 21 -21s-9 -22 -21 -22s-21 10 -21 22s9 21 21 21zM128 149c12 0 21 -9 21 -21
-s-9 -21 -21 -21s-21 9 -21 21s9 21 21 21zM128 235c12 0 21 -10 21 -22s-9 -21 -21 -21s-21 9 -21 21s9 22 21 22z" />
-    <glyph glyph-name="book" unicode="book" 
-d="M128 427v-171l53 32l54 -32v171h-107zM384 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v342c0 23 20 42 43 42h256z" />
-    <glyph glyph-name="bookmark" unicode="bookmark" 
-d="M363 448c23 0 42 -20 42 -43v-341l-149 64l-149 -64v341c0 23 19 43 42 43h214z" />
-    <glyph glyph-name="bookmark_border" unicode="bookmark_border" 
-d="M363 128v277h-214v-277l107 47zM363 448c23 0 42 -20 42 -43v-341l-149 64l-149 -64v341c0 23 19 43 42 43h214z" />
-    <glyph glyph-name="border_all" unicode="border_all" 
-d="M405 277v128h-128v-128h128zM405 107v128h-128v-128h128zM235 277v128h-128v-128h128zM235 107v128h-128v-128h128zM64 448h384v-384h-384v384z" />
-    <glyph glyph-name="border_bottom" unicode="border_bottom" 
-d="M107 192v-43h-43v43h43zM64 64v43h384v-43h-384zM107 277v-42h-43v42h43zM405 320v43h43v-43h-43zM405 448h43v-43h-43v43zM107 363v-43h-43v43h43zM405 149v43h43v-43h-43zM405 235v42h43v-42h-43zM363 448v-43h-43v43h43zM277 448v-43h-42v43h42zM363 277v-42h-43v42
-h43zM277 363v-43h-42v43h42zM107 448v-43h-43v43h43zM277 277v-42h-42v42h42zM192 448v-43h-43v43h43zM277 192v-43h-42v43h42zM192 277v-42h-43v42h43z" />
-    <glyph glyph-name="border_clear" unicode="border_clear" 
-d="M320 405v43h43v-43h-43zM320 235v42h43v-42h-43zM320 64v43h43v-43h-43zM235 405v43h42v-43h-42zM405 448h43v-43h-43v43zM235 320v43h42v-43h-42zM405 320v43h43v-43h-43zM405 64v43h43v-43h-43zM405 235v42h43v-42h-43zM405 149v43h43v-43h-43zM235 235v42h42v-42h-42z
-M64 405v43h43v-43h-43zM64 320v43h43v-43h-43zM64 235v42h43v-42h-43zM64 149v43h43v-43h-43zM64 64v43h43v-43h-43zM235 64v43h42v-43h-42zM235 149v43h42v-43h-42zM149 64v43h43v-43h-43zM149 235v42h43v-42h-43zM149 405v43h43v-43h-43z" />
-    <glyph glyph-name="border_color" unicode="border_color" 
-d="M0 85h512v-85h-512v85zM442 426l-42 -42l-80 80l42 42c8 8 22 8 30 0l50 -50c8 -8 8 -22 0 -30zM379 363l-214 -214h-80v80l214 214z" />
-    <glyph glyph-name="border_horizontal" unicode="border_horizontal" 
-d="M405 64v43h43v-43h-43zM320 64v43h43v-43h-43zM235 149v43h42v-43h-42zM405 320v43h43v-43h-43zM405 448h43v-43h-43v43zM64 235v42h384v-42h-384zM235 64v43h42v-43h-42zM405 149v43h43v-43h-43zM277 448v-43h-42v43h42zM277 363v-43h-42v43h42zM363 448v-43h-43v43h43z
-M192 448v-43h-43v43h43zM107 448v-43h-43v43h43zM149 64v43h43v-43h-43zM64 149v43h43v-43h-43zM107 363v-43h-43v43h43zM64 64v43h43v-43h-43z" />
-    <glyph glyph-name="border_inner" unicode="border_inner" 
-d="M405 149v43h43v-43h-43zM405 64v43h43v-43h-43zM277 448v-171h171v-42h-171v-171h-42v171h-171v42h171v171h42zM320 64v43h43v-43h-43zM405 448h43v-43h-43v43zM405 320v43h43v-43h-43zM363 448v-43h-43v43h43zM107 448v-43h-43v43h43zM192 448v-43h-43v43h43zM64 149v43
-h43v-43h-43zM107 363v-43h-43v43h43zM149 64v43h43v-43h-43zM64 64v43h43v-43h-43z" />
-    <glyph glyph-name="border_left" unicode="border_left" 
-d="M320 405v43h43v-43h-43zM320 235v42h43v-42h-43zM405 64v43h43v-43h-43zM405 235v42h43v-42h-43zM405 448h43v-43h-43v43zM405 149v43h43v-43h-43zM320 64v43h43v-43h-43zM405 320v43h43v-43h-43zM64 64v384h43v-384h-43zM149 235v42h43v-42h-43zM149 405v43h43v-43h-43z
-M149 64v43h43v-43h-43zM235 235v42h42v-42h-42zM235 320v43h42v-43h-42zM235 405v43h42v-43h-42zM235 149v43h42v-43h-42zM235 64v43h42v-43h-42z" />
-    <glyph glyph-name="border_outer" unicode="border_outer" 
-d="M192 277v-42h-43v42h43zM277 192v-43h-42v43h42zM405 107v298h-298v-298h298zM64 448h384v-384h-384v384zM363 277v-42h-43v42h43zM277 277v-42h-42v42h42zM277 363v-43h-42v43h42z" />
-    <glyph glyph-name="border_right" unicode="border_right" 
-d="M235 320v43h42v-43h-42zM235 405v43h42v-43h-42zM235 235v42h42v-42h-42zM320 405v43h43v-43h-43zM320 64v43h43v-43h-43zM405 448h43v-384h-43v384zM320 235v42h43v-42h-43zM235 149v43h42v-43h-42zM64 320v43h43v-43h-43zM64 149v43h43v-43h-43zM64 235v42h43v-42h-43z
-M235 64v43h42v-43h-42zM64 64v43h43v-43h-43zM149 235v42h43v-42h-43zM149 405v43h43v-43h-43zM64 405v43h43v-43h-43zM149 64v43h43v-43h-43z" />
-    <glyph glyph-name="border_style" unicode="border_style" 
-d="M405 320v43h43v-43h-43zM64 448h384v-43h-341v-341h-43v384zM405 235v42h43v-42h-43zM405 149v43h43v-43h-43zM235 64v43h42v-43h-42zM149 64v43h43v-43h-43zM405 64v43h43v-43h-43zM320 64v43h43v-43h-43z" />
-    <glyph glyph-name="border_top" unicode="border_top" 
-d="M320 235v42h43v-42h-43zM405 64v43h43v-43h-43zM235 320v43h42v-43h-42zM320 64v43h43v-43h-43zM405 149v43h43v-43h-43zM64 448h384v-43h-384v43zM405 235v42h43v-42h-43zM405 320v43h43v-43h-43zM235 149v43h42v-43h-42zM64 320v43h43v-43h-43zM64 235v42h43v-42h-43z
-M64 64v43h43v-43h-43zM64 149v43h43v-43h-43zM235 64v43h42v-43h-42zM235 235v42h42v-42h-42zM149 235v42h43v-42h-43zM149 64v43h43v-43h-43z" />
-    <glyph glyph-name="border_vertical" unicode="border_vertical" 
-d="M320 235v42h43v-42h-43zM320 64v43h43v-43h-43zM320 405v43h43v-43h-43zM405 320v43h43v-43h-43zM405 448h43v-43h-43v43zM405 235v42h43v-42h-43zM405 64v43h43v-43h-43zM235 64v384h42v-384h-42zM405 149v43h43v-43h-43zM149 405v43h43v-43h-43zM64 149v43h43v-43h-43z
-M64 64v43h43v-43h-43zM64 235v42h43v-42h-43zM149 235v42h43v-42h-43zM149 64v43h43v-43h-43zM64 405v43h43v-43h-43zM64 320v43h43v-43h-43z" />
-    <glyph glyph-name="branding_watermark" unicode="branding_watermark" 
-d="M448 107v128h-192v-128h192zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="brightness_1" unicode="brightness_&#x31;" 
-d="M43 256c0 118 95 213 213 213s213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213z" />
-    <glyph glyph-name="brightness_2" unicode="brightness_&#x32;" 
-d="M213 469c118 0 214 -95 214 -213s-96 -213 -214 -213c-39 0 -75 10 -106 28c64 37 106 106 106 185s-42 148 -106 185c31 18 67 28 106 28z" />
-    <glyph glyph-name="brightness_3" unicode="brightness_&#x33;" 
-d="M192 469c118 0 213 -95 213 -213s-95 -213 -213 -213c-22 0 -44 3 -64 9c87 27 149 108 149 204s-62 177 -149 204c20 6 42 9 64 9z" />
-    <glyph glyph-name="brightness_4" unicode="brightness_&#x34;" 
-d="M256 128c71 0 128 57 128 128s-57 128 -128 128c-19 0 -37 -5 -53 -12c44 -20 74 -64 74 -116s-30 -96 -74 -116c16 -7 34 -12 53 -12zM427 327l70 -71l-70 -71v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100v-100z" />
-    <glyph glyph-name="brightness_5" unicode="brightness_&#x35;" 
-d="M256 128c71 0 128 57 128 128s-57 128 -128 128s-128 -57 -128 -128s57 -128 128 -128zM427 185v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100v-100l70 -71z" />
-    <glyph glyph-name="brightness_6" unicode="brightness_&#x36;" 
-d="M256 128c71 0 128 57 128 128s-57 128 -128 128v-256zM427 185v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100v-100l70 -71z" />
-    <glyph glyph-name="brightness_7" unicode="brightness_&#x37;" 
-d="M256 341c47 0 85 -38 85 -85s-38 -85 -85 -85s-85 38 -85 85s38 85 85 85zM256 128c71 0 128 57 128 128s-57 128 -128 128s-128 -57 -128 -128s57 -128 128 -128zM427 327l70 -71l-70 -71v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100
-v-100z" />
-    <glyph glyph-name="brightness_auto" unicode="brightness_auto" 
-d="M305 171h41l-69 192h-42l-69 -192h41l15 42h68zM427 327l70 -71l-70 -71v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100v-100zM231 242l25 78l25 -78h-50z" />
-    <glyph glyph-name="brightness_high" unicode="brightness_high" 
-d="M256 341c47 0 85 -38 85 -85s-38 -85 -85 -85s-85 38 -85 85s38 85 85 85zM256 128c71 0 128 57 128 128s-57 128 -128 128s-128 -57 -128 -128s57 -128 128 -128zM427 327l70 -71l-70 -71v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100
-v-100z" />
-    <glyph glyph-name="brightness_low" unicode="brightness_low" 
-d="M256 128c71 0 128 57 128 128s-57 128 -128 128s-128 -57 -128 -128s57 -128 128 -128zM427 185v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100v-100l70 -71z" />
-    <glyph glyph-name="brightness_medium" unicode="brightness_medium" 
-d="M256 128c71 0 128 57 128 128s-57 128 -128 128v-256zM427 185v-100h-100l-71 -70l-71 70h-100v100l-70 71l70 71v100h100l71 70l71 -70h100v-100l70 -71z" />
-    <glyph glyph-name="broken_image" unicode="broken_image" 
-d="M384 268l64 -64v-97c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v140l64 -64l85 86l86 -86zM448 405v-140l-64 64l-85 -86l-86 86l-85 -86l-64 65v97c0 23 20 43 43 43h298c23 0 43 -20 43 -43z" />
-    <glyph glyph-name="brush" unicode="brush" 
-d="M442 413c8 -8 8 -22 0 -30l-191 -191l-59 59l191 191c8 8 22 8 30 0zM149 213c35 0 64 -29 64 -64c0 -47 -38 -85 -85 -85c-32 0 -65 17 -85 43c18 0 42 14 42 42c0 35 29 64 64 64z" />
-    <glyph glyph-name="bubble_chart" unicode="bubble_chart" 
-d="M222 324c0 57 45 103 102 103s103 -46 103 -103s-46 -102 -103 -102s-102 45 -102 102zM273 128c0 24 19 43 43 43s42 -19 42 -43s-18 -43 -42 -43s-43 19 -43 43zM85 205c0 38 31 68 69 68s68 -30 68 -68s-30 -68 -68 -68s-69 30 -69 68z" />
-    <glyph glyph-name="bug_report" unicode="bug_report" 
-d="M299 256v43h-86v-43h86zM299 171v42h-86v-42h86zM427 341v-42h-45c1 -7 2 -15 2 -22v-21h43v-43h-43v-21c0 -7 -1 -14 -2 -21h45v-43h-60c-22 -38 -64 -64 -111 -64s-89 26 -111 64h-60v43h45c-1 7 -2 14 -2 21v21h-43v43h43v21c0 7 1 15 2 22h-45v42h60
-c10 17 23 31 39 42l-35 35l30 30l47 -46c10 2 20 3 30 3s20 -1 30 -3l47 46l30 -30l-35 -35c16 -11 29 -25 39 -42h60z" />
-    <glyph glyph-name="build" unicode="build" 
-d="M484 107c9 -6 9 -21 -2 -30l-49 -49c-9 -9 -21 -9 -30 0l-194 194c-49 -19 -106 -9 -147 32c-43 43 -54 107 -28 158l94 -92l64 64l-92 92c51 23 115 15 158 -28c41 -41 51 -98 32 -147z" />
-    <glyph glyph-name="burst_mode" unicode="burst_mode" 
-d="M235 149h213l-68 90l-54 -68l-38 46zM469 405c12 0 22 -9 22 -21v-256c0 -12 -10 -21 -22 -21h-256c-12 0 -21 9 -21 21v256c0 12 9 21 21 21h256zM107 405h42v-298h-42v298zM21 405h43v-298h-43v298z" />
-    <glyph glyph-name="business" unicode="business" 
-d="M384 192v-43h-43v43h43zM384 277v-42h-43v42h43zM427 107v213h-171v-43h43v-42h-43v-43h43v-43h-43v-42h171zM213 363v42h-42v-42h42zM213 277v43h-42v-43h42zM213 192v43h-42v-43h42zM213 107v42h-42v-42h42zM128 363v42h-43v-42h43zM128 277v43h-43v-43h43zM128 192v43
-h-43v-43h43zM128 107v42h-43v-42h43zM256 363h213v-299h-426v384h213v-85z" />
-    <glyph glyph-name="business_center" unicode="business_center" 
-d="M299 363v42h-86v-42h86zM427 363c23 0 42 -20 42 -43v-64c0 -23 -19 -43 -42 -43h-128v43h-86v-43h-128c-24 0 -42 19 -42 43v64c0 23 19 43 42 43h85v42l43 43h85l43 -43v-42h86zM213 171h86v21h149v-85c0 -24 -19 -43 -43 -43h-298c-24 0 -43 19 -43 43v85h149v-21z
-" />
-    <glyph glyph-name="cached" unicode="cached" 
-d="M128 256h64l-85 -85l-86 85h64c0 94 77 171 171 171c33 0 65 -10 91 -27l-31 -31c-18 10 -38 15 -60 15c-71 0 -128 -57 -128 -128zM405 341l86 -85h-64c0 -94 -77 -171 -171 -171c-33 0 -65 10 -91 27l31 31c18 -10 38 -15 60 -15c71 0 128 57 128 128h-64z" />
-    <glyph glyph-name="cake" unicode="cake" 
-d="M384 320c35 0 64 -29 64 -64v-33c0 -23 -19 -42 -42 -42c-11 0 -21 4 -29 12l-46 46l-46 -46c-16 -16 -43 -16 -59 0l-45 46l-46 -46c-8 -8 -18 -12 -29 -12c-23 0 -42 19 -42 42v33c0 35 29 64 64 64h107v43h42v-43h107zM354 171c14 -14 32 -22 52 -22c16 0 30 5 42 13
-v-98c0 -12 -9 -21 -21 -21h-342c-12 0 -21 9 -21 21v98c12 -8 26 -13 42 -13c20 0 38 8 52 22l23 23l23 -23c28 -28 76 -28 104 0l23 23zM256 384c-23 0 -43 20 -43 43c0 8 3 16 7 22l36 63l36 -63c4 -6 7 -14 7 -22c0 -23 -19 -43 -43 -43z" />
-    <glyph glyph-name="call" unicode="call" 
-d="M141 282c31 -60 81 -110 141 -141l47 47c6 6 15 8 22 5c24 -8 50 -12 76 -12c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22z" />
-    <glyph glyph-name="call_end" unicode="call_end" 
-d="M256 320c-34 0 -67 -5 -98 -15v-66c0 -8 -5 -17 -12 -20c-21 -10 -40 -23 -57 -39c-4 -4 -9 -6 -15 -6s-11 2 -15 6l-53 53c-4 4 -6 9 -6 15s2 11 6 15c65 62 153 100 250 100s185 -38 250 -100c4 -4 6 -9 6 -15s-2 -11 -6 -15l-53 -53c-4 -4 -9 -6 -15 -6s-11 2 -15 6
-c-17 16 -36 29 -57 39c-7 3 -12 10 -12 19v66c-31 10 -64 16 -98 16z" />
-    <glyph glyph-name="call_made" unicode="call_made" 
-d="M192 405h213v-213h-42v141l-248 -248l-30 30l248 248h-141v42z" />
-    <glyph glyph-name="call_merge" unicode="call_merge" 
-d="M160 341l96 96l96 -96h-75v-136l-128 -128l-30 30l116 115v119h-75zM363 77l-73 72l30 30l73 -72z" />
-    <glyph glyph-name="call_missed" unicode="call_missed" 
-d="M418 363l30 -30l-192 -192l-149 149v-98h-43v171h171v-43h-98l119 -119z" />
-    <glyph glyph-name="call_missed_outgoing" unicode="call_missed_outgoing" 
-d="M64 333l30 30l162 -162l119 119h-98v43h171v-171h-43v98l-149 -149z" />
-    <glyph glyph-name="call_received" unicode="call_received" 
-d="M427 397l-248 -248h141v-42h-213v213h42v-141l248 248z" />
-    <glyph glyph-name="call_split" unicode="call_split" 
-d="M213 427l-49 -49l113 -113v-180h-42v162l-101 101l-49 -49v128h128zM299 427h128v-128l-49 49l-62 -62l-30 30l62 62z" />
-    <glyph glyph-name="call_to_action" unicode="call_to_action" 
-d="M448 107v64h-384v-64h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="camera" unicode="camera" 
-d="M210 48c34.3543 59.3123 68.2469 119.086 103 178l78 -135c-37 -30 -84 -48 -135 -48c-16 0 -31 2 -46 5zM52 192h207l-79 -135c-61 23 -108 73 -128 135zM99 400c35.9996 -62.3337 71.7933 -124.873 108 -187h-160c-3 14 -4 28 -4 43c0 56 21 106 56 144zM465 299
-c3 -14 4 -28 4 -43c0 -56 -21 -106 -56 -144l-102 176l-6 11h160zM460 320h-207l79 135c61 -23 108 -73 128 -135zM201 288l-2 -2l-78 135c37 30 84 48 135 48c16 0 31 -2 46 -5z" />
-    <glyph glyph-name="camera_alt" unicode="camera_alt" 
-d="M256 149c59 0 107 48 107 107s-48 107 -107 107s-107 -48 -107 -107s48 -107 107 -107zM192 469h128l39 -42h68c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h68zM188 256c0 38 30 68 68 68s68 -30 68 -68
-s-30 -68 -68 -68s-68 30 -68 68z" />
-    <glyph glyph-name="camera_enhance" unicode="camera_enhance" 
-d="M256 149l-27 59l-58 27l58 26l27 59l27 -59l58 -26l-58 -27zM256 128c59 0 107 48 107 107s-48 106 -107 106s-107 -47 -107 -106s48 -107 107 -107zM192 448h128l39 -43h68c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256
-c0 23 19 42 42 42h68z" />
-    <glyph glyph-name="camera_front" unicode="camera_front" 
-d="M149 469v-224c0 36 71 54 107 54s107 -18 107 -54v224h-214zM363 512c23 0 42 -20 42 -43v-298c0 -23 -19 -43 -42 -43h-150l64 -64l-64 -64v43h-106v42h106v43h-64c-23 0 -42 20 -42 43v298c0 23 19 43 42 43h214zM256 341c-23 0 -42 20 -42 43s19 43 42 43
-s43 -20 43 -43s-20 -43 -43 -43zM299 85h106v-42h-106v42z" />
-    <glyph glyph-name="camera_rear" unicode="camera_rear" 
-d="M256 384c23 0 42 20 42 43s-19 42 -42 42s-43 -19 -43 -42s19 -43 43 -43zM363 512c23 0 42 -20 42 -43v-298c0 -23 -19 -43 -42 -43h-150l64 -64l-64 -64v43h-106v42h106v43h-64c-23 0 -42 20 -42 43v298c0 23 19 43 42 43h214zM299 85h106v-42h-106v42z" />
-    <glyph glyph-name="camera_roll" unicode="camera_roll" 
-d="M427 320v43h-43v-43h43zM427 128v43h-43v-43h43zM341 320v43h-42v-43h42zM341 128v43h-42v-43h42zM256 320v43h-43v-43h43zM256 128v43h-43v-43h43zM299 405h170v-320h-170c0 -23 -20 -42 -43 -42h-171c-23 0 -42 19 -42 42v320c0 23 19 43 42 43h22v21c0 12 9 22 21 22
-h85c12 0 22 -10 22 -22v-21h21c23 0 43 -20 43 -43z" />
-    <glyph glyph-name="cancel" unicode="cancel" 
-d="M363 179l-77 77l77 77l-30 30l-77 -77l-77 77l-30 -30l77 -77l-77 -77l30 -30l77 77l77 -77zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="card_giftcard" unicode="card_giftcard" 
-d="M427 213v128h-109l45 -60l-35 -25c-24.0378 32.6288 -48.3187 65.0147 -72 98c-23.6829 -32.9837 -47.9614 -65.3719 -72 -98l-35 25l45 60h-109v-128h342zM427 107v42h-342v-42h342zM192 427c-12 0 -21 -10 -21 -22s9 -21 21 -21s21 9 21 21s-9 22 -21 22zM320 427
-c-12 0 -21 -10 -21 -22s9 -21 21 -21s21 9 21 21s-9 22 -21 22zM427 384c24 0 42 -19 42 -43v-234c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v234c0 24 18 43 42 43h47c-2 7 -4 14 -4 21c0 35 29 64 64 64c22 0 41 -11 53 -28l11 -15l11 15c12 17 31 28 53 28
-c35 0 64 -29 64 -64c0 -7 -2 -14 -4 -21h47z" />
-    <glyph glyph-name="card_membership" unicode="card_membership" 
-d="M427 299v128h-342v-128h342zM427 192v43h-342v-43h342zM427 469c24 0 42 -18 42 -42v-235c0 -24 -18 -43 -42 -43h-86v-106l-85 42l-85 -42v106h-86c-24 0 -42 19 -42 43v235c0 24 18 42 42 42h342z" />
-    <glyph glyph-name="card_travel" unicode="card_travel" 
-d="M427 213v128h-64v-42h-43v42h-128v-42h-43v42h-64v-128h342zM427 107v42h-342v-42h342zM192 427v-43h128v43h-128zM427 384c24 0 42 -19 42 -43v-234c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v234c0 24 18 43 42 43h64v43c0 24 19 42 43 42h128
-c24 0 43 -18 43 -42v-43h64z" />
-    <glyph glyph-name="casino" unicode="casino" 
-d="M352 320c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM352 128c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM256 224c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM160 320c18 0 32 14 32 32s-14 32 -32 32
-s-32 -14 -32 -32s14 -32 32 -32zM160 128c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="cast" unicode="cast" 
-d="M21 299c129 0 235 -105 235 -235h-43c0 106 -86 192 -192 192v43zM21 213c83 0 150 -66 150 -149h-43c0 59 -48 107 -107 107v42zM21 128c35 0 64 -29 64 -64h-64v64zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-149v43h149v298h-384v-64h-43v64
-c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="cast_connected" unicode="cast_connected" 
-d="M448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-149v43h149v298h-384v-64h-43v64c0 23 20 43 43 43h384zM21 299c129 0 235 -105 235 -235h-43c0 106 -86 192 -192 192v43zM405 363v-214h-120c-27 84 -94 152 -178 179v35h298zM21 213c83 0 150 -66 150 -149
-h-43c0 59 -48 107 -107 107v42zM21 128c35 0 64 -29 64 -64h-64v64z" />
-    <glyph glyph-name="center_focus_strong" unicode="center_focus_strong" 
-d="M405 107v85h43v-85c0 -23 -20 -43 -43 -43h-85v43h85zM405 448c23 0 43 -20 43 -43v-85h-43v85h-85v43h85zM107 405v-85h-43v85c0 23 20 43 43 43h85v-43h-85zM107 192v-85h85v-43h-85c-23 0 -43 20 -43 43v85h43zM256 341c47 0 85 -38 85 -85s-38 -85 -85 -85
-s-85 38 -85 85s38 85 85 85z" />
-    <glyph glyph-name="center_focus_weak" unicode="center_focus_weak" 
-d="M256 213c23 0 43 20 43 43s-20 43 -43 43s-43 -20 -43 -43s20 -43 43 -43zM256 341c47 0 85 -38 85 -85s-38 -85 -85 -85s-85 38 -85 85s38 85 85 85zM405 107v85h43v-85c0 -23 -20 -43 -43 -43h-85v43h85zM405 448c23 0 43 -20 43 -43v-85h-43v85h-85v43h85zM107 405
-v-85h-43v85c0 23 20 43 43 43h85v-43h-85zM107 192v-85h85v-43h-85c-23 0 -43 20 -43 43v85h43z" />
-    <glyph glyph-name="change_history" unicode="change_history" 
-d="M256 427l213 -342h-426zM256 346l-136 -218h272z" />
-    <glyph glyph-name="chat" unicode="chat" 
-d="M384 341v43h-256v-43h256zM299 213v43h-171v-43h171zM128 320v-43h256v43h-256zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="chat_bubble" unicode="chat_bubble" 
-d="M427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="chat_bubble_outline" unicode="chat_bubble_outline" 
-d="M427 171v256h-342v-299l43 43h299zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="check" unicode="check" 
-d="M192 167l226 226l30 -30l-256 -256l-119 119l30 30z" />
-    <glyph glyph-name="check_box" unicode="check_box" 
-d="M213 149l192 192l-30 31l-162 -162l-76 76l-30 -30zM405 448c24 0 43 -20 43 -43v-298c0 -23 -19 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="check_box_outline_blank" unicode="check_box_outline_blank" 
-d="M405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298zM405 405h-298v-298h298v298z" />
-    <glyph glyph-name="check_circle" unicode="check_circle" 
-d="M213 149l192 192l-30 31l-162 -162l-76 76l-30 -30zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="chevron_left" unicode="chevron_left" 
-d="M329 354l-98 -98l98 -98l-30 -30l-128 128l128 128z" />
-    <glyph glyph-name="chevron_right" unicode="chevron_right" 
-d="M213 384l128 -128l-128 -128l-30 30l98 98l-98 98z" />
-    <glyph glyph-name="child_care" unicode="child_care" 
-d="M160 213h192c-16 -38 -53 -64 -96 -64s-80 26 -96 64zM256 107c68.0018 0 125.232 44.8128 143 107c2 0 4 -1 6 -1c23 0 43 20 43 43s-20 43 -43 43c-2 0 -4 -1 -6 -1c-17.7643 62.1749 -74.9972 107 -143 107c-68.0018 0 -125.232 -44.8128 -143 -107c-2 0 -4 1 -6 1
-c-23 0 -43 -20 -43 -43s20 -43 43 -43c2 0 4 1 6 1c17.7643 -62.1749 74.9972 -107 143 -107zM489 242c-5 -32 -28 -59 -59 -68c-28.2678 -59.1055 -94.8338 -110 -174 -110c-78.8834 0 -145.522 50.0487 -173 110c-31 9 -55 36 -60 68c-1 4 -2 9 -2 14s1 10 2 14
-c5 32 29 59 60 68c11 24 26 45 46 62c34 30 78 48 127 48c80.292 0 145.109 -49.147 173 -110c31 -9 55 -36 60 -68c1 -4 2 -9 2 -14s-1 -10 -2 -14zM176 288c0 15 12 27 27 27s26 -12 26 -27s-11 -27 -26 -27s-27 12 -27 27zM283 288c0 15 11 27 26 27s27 -12 27 -27
-s-12 -27 -27 -27s-26 12 -26 27z" />
-    <glyph glyph-name="child_friendly" unicode="child_friendly" 
-d="M363 85c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM171 85c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM412 173c15 -14 25 -34 25 -56c0 -41 -33 -74 -74 -74c-38 0 -69 28 -74 64h-45c-5 -36 -35 -64 -73 -64
-c-41 0 -75 33 -75 74c0 28 16 53 39 66c-5 7 -45 94 -45 94h-47v43h74l20 -43h311c0 -39 -14 -75 -36 -104zM277 469c94 0 171 -76 171 -170h-171v170z" />
-    <glyph glyph-name="chrome_reader_mode" unicode="chrome_reader_mode" 
-d="M448 107v277h-192v-277h192zM448 427c23 0 43 -20 43 -43v-277c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v277c0 23 20 43 43 43h384zM277 203h150v-32h-150v32zM277 309h150v-32h-150v32zM277 256h150v-32h-150v32z" />
-    <glyph glyph-name="class" unicode="class" 
-d="M128 427v-171l53 32l54 -32v171h-107zM384 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v342c0 23 20 42 43 42h256z" />
-    <glyph glyph-name="clear" unicode="clear" 
-d="M405 375l-119 -119l119 -119l-30 -30l-119 119l-119 -119l-30 30l119 119l-119 119l30 30l119 -119l119 119z" />
-    <glyph glyph-name="clear_all" unicode="clear_all" 
-d="M149 363h299v-43h-299v43zM64 149v43h299v-43h-299zM107 235v42h298v-42h-298z" />
-    <glyph glyph-name="close" unicode="close" 
-d="M405 375l-119 -119l119 -119l-30 -30l-119 119l-119 -119l-30 30l119 119l-119 119l30 30l119 -119l119 119z" />
-    <glyph glyph-name="closed_caption" unicode="closed_caption" 
-d="M384 277v22c0 12 -9 21 -21 21h-64c-12 0 -22 -9 -22 -21v-86c0 -12 10 -21 22 -21h64c12 0 21 9 21 21v22h-32v-11h-43v64h43v-11h32zM235 277v22c0 12 -10 21 -22 21h-64c-12 0 -21 -9 -21 -21v-86c0 -12 9 -21 21 -21h64c12 0 22 9 22 21v22h-32v-11h-43v64h43v-11h32
-zM405 427c23 0 43 -20 43 -43v-256c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v256c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="cloud" unicode="cloud" 
-d="M413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="cloud_circle" unicode="cloud_circle" 
-d="M352 171c29 0 53 24 53 53s-24 53 -53 53h-11c0 47 -38 86 -85 86c-40 0 -73 -28 -82 -65l-3 1c-35 0 -64 -29 -64 -64s29 -64 64 -64h181zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="cloud_done" unicode="cloud_done" 
-d="M213 149l141 141l-30 30l-111 -110l-44 44l-30 -30zM413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="cloud_download" unicode="cloud_download" 
-d="M363 235h-64v85h-86v-85h-64l107 -107zM413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="cloud_off" unicode="cloud_off" 
-d="M165 299h-37c-47 0 -85 -39 -85 -86s38 -85 85 -85h208zM64 400l27 27l357 -357l-27 -27l-43 42h-250c-71 0 -128 57 -128 128c0 69 55 125 123 128zM413 298c55 -4 99 -50 99 -106c0 -36 -18 -68 -45 -87l-31 31c20 11 33 32 33 56c0 35 -29 64 -64 64h-32v11
-c0 65 -52 117 -117 117c-20 0 -38 -4 -54 -13l-32 31c25 16 54 25 86 25c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="cloud_queue" unicode="cloud_queue" 
-d="M405 128c35 0 64 29 64 64s-29 64 -64 64h-32v11c0 65 -52 117 -117 117c-54 0 -99 -36 -113 -85h-15c-47 0 -85 -39 -85 -86s38 -85 85 -85h277zM413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127
-c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="cloud_upload" unicode="cloud_upload" 
-d="M299 235h64l-107 106l-107 -106h64v-86h86v86zM413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="code" unicode="code" 
-d="M311 158l99 98l-99 98l30 30l128 -128l-128 -128zM201 158l-30 -30l-128 128l128 128l30 -30l-99 -98z" />
-    <glyph glyph-name="collections" unicode="collections" 
-d="M43 384h42v-299h299v-42h-299c-23 0 -42 19 -42 42v299zM235 256l-64 -85h256l-86 106l-63 -79zM469 171c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256c23 0 42 -19 42 -42v-256z" />
-    <glyph glyph-name="collections_bookmark" unicode="collections_bookmark" 
-d="M427 256v171h-107v-171l53 32zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42z" />
-    <glyph glyph-name="color_lens" unicode="color_lens" 
-d="M373 256c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM309 341c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM203 341c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 256c18 0 32 14 32 32s-14 32 -32 32
-s-32 -14 -32 -32s14 -32 32 -32zM256 448c106 0 192 -77 192 -171c0 -59 -48 -106 -107 -106h-37c-18 0 -32 -14 -32 -32c0 -8 3 -15 8 -21s8 -14 8 -22c0 -18 -14 -32 -32 -32c-106 0 -192 86 -192 192s86 192 192 192z" />
-    <glyph glyph-name="colorize" unicode="colorize" 
-d="M148 107l172 172l-41 41l-172 -172zM442 392c8 -8 9 -21 0 -30l-67 -67l41 -41l-30 -30l-30 30l-191 -190h-101v101l190 191l-30 30l30 30l41 -41l67 67c8 8 22 8 30 0z" />
-    <glyph glyph-name="comment" unicode="comment" 
-d="M384 341v43h-256v-43h256zM384 277v43h-256v-43h256zM384 213v43h-256v-43h256zM469 427v-384l-85 85h-299c-23 0 -42 20 -42 43v256c0 23 19 42 42 42h342c23 0 42 -19 42 -42z" />
-    <glyph glyph-name="compare" unicode="compare" 
-d="M405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-106v192l106 -128v277h-106v43h106zM213 128v128l-106 -128h106zM213 448v43h43v-470h-43v43h-106c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h106z" />
-    <glyph glyph-name="compare_arrows" unicode="compare_arrows" 
-d="M320 235l-85 85l85 85v-64h149v-42h-149v-64zM192 213v64l85 -85l-85 -85v64h-149v42h149z" />
-    <glyph glyph-name="computer" unicode="computer" 
-d="M85 384v-213h342v213h-342zM427 128h85v-43h-512v43h85c-23 0 -42 20 -42 43v213c0 23 19 43 42 43h342c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43z" />
-    <glyph glyph-name="confirmation_number" unicode="confirmation_number" 
-d="M277 331v42h-42v-42h42zM277 235v42h-42v-42h42zM277 139v42h-42v-42h42zM469 299c-23 0 -42 -20 -42 -43s19 -43 42 -43v-85c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v85c24 0 42 20 42 43s-19 43 -42 43v85c0 24 19 43 42 43h342c23 0 42 -19 42 -43v-85z" />
-    <glyph glyph-name="contact_mail" unicode="contact_mail" 
-d="M469 256v128h-170v-128h170zM299 128v21c0 43 -85 66 -128 66s-128 -23 -128 -66v-21h256zM171 384c-35 0 -64 -29 -64 -64s29 -64 64 -64s64 29 64 64s-29 64 -64 64zM469 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-426c-23 0 -43 20 -43 43v298
-c0 23 20 43 43 43h426zM448 341l-64 -42l-64 42v22l64 -43l64 43v-22z" />
-    <glyph glyph-name="contact_phone" unicode="contact_phone" 
-d="M381 213c-5 13 -8 28 -8 43s3 30 8 43h35l32 42l-42 43c-28 -21 -49 -50 -59 -85c-4 -14 -6 -28 -6 -43s2 -29 6 -43c10 -34 31 -64 59 -85l42 43l-32 42h-35zM299 128v21c0 43 -85 66 -128 66s-128 -23 -128 -66v-21h256zM171 384c-35 0 -64 -29 -64 -64s29 -64 64 -64
-s64 29 64 64s-29 64 -64 64zM469 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-426c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h426z" />
-    <glyph glyph-name="contacts" unicode="contacts" 
-d="M363 149v32c0 36 -71 54 -107 54s-107 -18 -107 -54v-32h214zM256 368c-26 0 -48 -22 -48 -48s22 -48 48 -48s48 22 48 48s-22 48 -48 48zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342zM85 0v43h342v-43
-h-342zM427 512v-43h-342v43h342z" />
-    <glyph glyph-name="content_copy" unicode="content_copy" 
-d="M405 64v299h-234v-299h234zM405 405c23 0 43 -19 43 -42v-299c0 -23 -20 -43 -43 -43h-234c-23 0 -43 20 -43 43v299c0 23 20 42 43 42h234zM341 491v-43h-256v-299h-42v299c0 23 19 43 42 43h256z" />
-    <glyph glyph-name="content_cut" unicode="content_cut" 
-d="M405 448h64v-21l-149 -150l-43 43zM256 245c6 0 11 5 11 11s-5 11 -11 11s-11 -5 -11 -11s5 -11 11 -11zM128 85c23 0 43 19 43 43s-20 43 -43 43s-43 -19 -43 -43s20 -43 43 -43zM128 341c23 0 43 19 43 43s-20 43 -43 43s-43 -19 -43 -43s20 -43 43 -43zM206 349
-l263 -264v-21h-64l-149 149l-50 -50c5 -11 7 -22 7 -35c0 -47 -38 -85 -85 -85s-85 38 -85 85s38 85 85 85c13 0 24 -2 35 -7l50 50l-50 50c-11 -5 -22 -7 -35 -7c-47 0 -85 38 -85 85s38 85 85 85s85 -38 85 -85c0 -13 -2 -24 -7 -35z" />
-    <glyph glyph-name="content_paste" unicode="content_paste" 
-d="M405 85v342h-42v-64h-214v64h-42v-342h298zM256 469c-12 0 -21 -9 -21 -21s9 -21 21 -21s21 9 21 21s-9 21 -21 21zM405 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-298c-23 0 -43 19 -43 42v342c0 23 20 42 43 42h89c9 25 32 43 60 43s51 -18 60 -43h89z" />
-    <glyph glyph-name="control_point" unicode="control_point" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM277 363v-86h86v-42h-86v-86h-42v86h-86v42h86v86h42z" />
-    <glyph glyph-name="control_point_duplicate" unicode="control_point_duplicate" 
-d="M320 107c82 0 149 67 149 149s-67 149 -149 149s-149 -67 -149 -149s67 -149 149 -149zM320 448c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM43 256c0 -60 34 -111 85 -135v-46c-74 26 -128 98 -128 181s54 155 128 181v-46
-c-51 -24 -85 -75 -85 -135zM341 341v-64h64v-42h-64v-64h-42v64h-64v42h64v64h42z" />
-    <glyph glyph-name="copyright" unicode="copyright" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM253 317c-30.7612 0 -40 -27.2286 -40 -58v-6c0 -30.7691 9.25381 -58 40 -58
-c18.7788 0 35 11.4624 35 30h38c0 -19.5209 -10.5691 -34.2021 -22 -44c-12.8931 -11.0512 -27.9049 -18 -51 -18c-54.5845 0 -82 36.0734 -82 90v6c0 25.8562 7.26023 49.4403 20 64c13.1991 15.0847 34.3422 27 62 27c22.1368 0 40.6281 -7.62806 52 -19
-c11.0024 -11.0024 21 -27.9871 21 -49h-38c0 5 -1 9 -3 13s-4 9 -7 12c-5.41728 5.41728 -14.6761 10 -25 10z" />
-    <glyph glyph-name="create" unicode="create" 
-d="M442 362l-39 -39l-80 80l39 39c8 8 22 8 30 0l50 -50c8 -8 8 -22 0 -30zM64 144l236 236l80 -80l-236 -236h-80v80z" />
-    <glyph glyph-name="create_new_folder" unicode="create_new_folder" 
-d="M405 213v43h-64v64h-42v-64h-64v-43h64v-64h42v64h64zM427 384c24 0 42 -19 42 -43v-213c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v256c0 24 18 43 42 43h128l43 -43h171z" />
-    <glyph glyph-name="credit_card" unicode="credit_card" 
-d="M427 341v43h-342v-43h342zM427 128v128h-342v-128h342zM427 427c24 0 42 -19 42 -43v-256c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v256c0 24 18 43 42 43h342z" />
-    <glyph glyph-name="crop" unicode="crop" 
-d="M149 149h342v-42h-86v-86h-42v86h-214c-23 0 -42 19 -42 42v214h-86v42h86v86h42v-342zM363 192v171h-171v42h171c23 0 42 -19 42 -42v-171h-42z" />
-    <glyph glyph-name="crop_16_9" unicode="crop_&#x31;&#x36;_&#x39;" 
-d="M405 171v170h-298v-170h298zM405 384c23 0 43 -20 43 -43v-170c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v170c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="crop_3_2" unicode="crop_&#x33;_&#x32;" 
-d="M405 128v256h-298v-256h298zM405 427c23 0 43 -20 43 -43v-256c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v256c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="crop_5_4" unicode="crop_&#x35;_&#x34;" 
-d="M405 149v214h-298v-214h298zM405 405c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-298c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h298z" />
-    <glyph glyph-name="crop_7_5" unicode="crop_&#x37;_&#x35;" 
-d="M405 192v128h-298v-128h298zM405 363c23 0 43 -20 43 -43v-128c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v128c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="crop_din" unicode="crop_din" 
-d="M405 107v298h-298v-298h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="crop_free" unicode="crop_free" 
-d="M405 448c23 0 43 -20 43 -43v-85h-43v85h-85v43h85zM405 107v85h43v-85c0 -23 -20 -43 -43 -43h-85v43h85zM107 192v-85h85v-43h-85c-23 0 -43 20 -43 43v85h43zM64 405c0 23 20 43 43 43h85v-43h-85v-85h-43v85z" />
-    <glyph glyph-name="crop_landscape" unicode="crop_landscape" 
-d="M405 149v214h-298v-214h298zM405 405c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-298c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h298z" />
-    <glyph glyph-name="crop_original" unicode="crop_original" 
-d="M298 250l75 -101h-234l58 76l42 -51zM405 107v298h-298v-298h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="crop_portrait" unicode="crop_portrait" 
-d="M363 107v298h-214v-298h214zM363 448c23 0 42 -20 42 -43v-298c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v298c0 23 19 43 42 43h214z" />
-    <glyph glyph-name="crop_rotate" unicode="crop_rotate" 
-d="M171 171h256v-43h-43v-43h-43v43h-170c-24 0 -43 20 -43 43v170h-43v43h43v43h43v-256zM341 213v128h-128v43h128c23 0 43 -19 43 -43v-128h-43zM257 512c134 0 244 -104 255 -235h-32c-8 80 -57 148 -127 181l-29 -28l-81 81c5 0 9 1 14 1zM159 54l29 28l81 -81
-c-5 0 -9 -1 -14 -1c-134 0 -244 104 -255 235h32c8 -80 57 -148 127 -181z" />
-    <glyph glyph-name="crop_square" unicode="crop_square" 
-d="M384 128v256h-256v-256h256zM384 427c23 0 43 -20 43 -43v-256c0 -23 -20 -43 -43 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 43 43 43h256z" />
-    <glyph glyph-name="dashboard" unicode="dashboard" 
-d="M277 448h171v-128h-171v128zM277 64v213h171v-213h-171zM64 64v128h171v-128h-171zM64 235v213h171v-213h-171z" />
-    <glyph glyph-name="data_usage" unicode="data_usage" 
-d="M256 107c47 0 89 22 116 56l56 -33c-39 -53 -101 -87 -172 -87c-118 0 -213 95 -213 213c0 111 84 201 192 212v-64c-72 -10 -128 -73 -128 -148c0 -83 66 -149 149 -149zM277 468c108 -11 192 -101 192 -212c0 -31 -6 -61 -18 -87l-56 33c6 17 10 35 10 54
-c0 75 -56 138 -128 148v64z" />
-    <glyph glyph-name="date_range" unicode="date_range" 
-d="M405 85v235h-298v-235h298zM405 427c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-298c-24 0 -43 19 -43 42v299c0 23 19 43 43 43h21v42h43v-42h170v42h43v-42h21zM363 277v-42h-43v42h43zM277 277v-42h-42v42h42zM192 277v-42h-43v42h43z" />
-    <glyph glyph-name="dehaze" unicode="dehaze" 
-d="M43 395h426v-43h-426v43zM43 288h426v-43h-426v43zM43 181h426v-42h-426v42z" />
-    <glyph glyph-name="delete" unicode="delete" 
-d="M405 427v-43h-298v43h74l22 21h106l22 -21h74zM128 107v256h256v-256c0 -23 -20 -43 -43 -43h-170c-23 0 -43 20 -43 43z" />
-    <glyph glyph-name="delete_forever" unicode="delete_forever" 
-d="M331 427h74v-43h-298v43h74l22 21h106zM180 259l46 -46l-45 -45l30 -30l45 45l45 -45l30 30l-45 45l45 46l-30 30l-45 -46l-45 46zM128 107v256h256v-256c0 -23 -20 -43 -43 -43h-170c-23 0 -43 20 -43 43z" />
-    <glyph glyph-name="delete_sweep" unicode="delete_sweep" 
-d="M299 405v-42h-256v42h64l21 22h85l22 -22h64zM64 128v213h213v-213c0 -23 -19 -43 -42 -43h-128c-23 0 -43 20 -43 43zM320 256h128v-43h-128v43zM320 341h149v-42h-149v42zM320 171h85v-43h-85v43z" />
-    <glyph glyph-name="description" unicode="description" 
-d="M277 320h118l-118 117v-117zM341 213v43h-170v-43h170zM341 128v43h-170v-43h170zM299 469l128 -128v-256c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42l1 342c0 23 19 42 42 42h171z" />
-    <glyph glyph-name="desktop_mac" unicode="desktop_mac" 
-d="M448 213v214h-384v-214h384zM448 469c23 0 43 -19 43 -42v-256c0 -23 -20 -43 -43 -43h-149l42 -64v-21h-170v21l42 64h-149c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h384z" />
-    <glyph glyph-name="desktop_windows" unicode="desktop_windows" 
-d="M448 171v256h-384v-256h384zM448 469c23 0 43 -19 43 -42v-256c0 -23 -20 -43 -43 -43h-149v-43h42v-42h-170v42h42v43h-149c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h384z" />
-    <glyph glyph-name="details" unicode="details" 
-d="M136 384l120 -213l120 213h-240zM64 427h384l-192 -342z" />
-    <glyph glyph-name="developer_board" unicode="developer_board" 
-d="M256 277h85v-128h-85v128zM128 363h107v-107h-107v107zM256 363h85v-64h-85v64zM128 235h107v-86h-107v86zM384 107v298h-299v-298h299zM469 320h-42v-43h42v-42h-42v-43h42v-43h-42v-42c0 -23 -20 -43 -43 -43h-299c-23 0 -42 20 -42 43v298c0 23 19 43 42 43h299
-c23 0 43 -20 43 -43v-42h42v-43z" />
-    <glyph glyph-name="developer_mode" unicode="developer_mode" 
-d="M363 107v42h42v-85c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v85h42v-42h214zM213 188l-30 -30l-98 98l98 98l30 -30l-67 -68zM329 158l-30 30l67 68l-67 68l30 30l98 -98zM149 405v-42h-42v85c0 23 19 43 42 43l214 -1c23 0 42 -19 42 -42v-85h-42v42h-214z" />
-    <glyph glyph-name="device_hub" unicode="device_hub" 
-d="M363 171h85v-107h-107v65l-85 90l-85 -90v-65h-107v107h85l86 85v68c-25 9 -43 32 -43 60c0 35 29 64 64 64s64 -29 64 -64c0 -28 -18 -51 -43 -60v-68z" />
-    <glyph glyph-name="devices" unicode="devices" 
-d="M469 149v150h-85v-150h85zM491 341c12 0 21 -9 21 -21v-213c0 -12 -9 -22 -21 -22h-128c-12 0 -22 10 -22 22v213c0 12 10 21 22 21h128zM85 384v-235h214v-64h-299v64h43v235c0 23 19 43 42 43h384v-43h-384z" />
-    <glyph glyph-name="devices_other" unicode="devices_other" 
-d="M448 128v171h-85v-171h85zM469 341c11 0 22 -10 22 -21v-213c0 -11 -11 -22 -22 -22h-128c-11 0 -21 11 -21 22v213c0 11 10 21 21 21h128zM235 139c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM277 256v-38c13 -12 22 -28 22 -47s-9 -36 -22 -48
-v-38h-85v38c-13 12 -21 29 -21 48s8 35 21 47v38h85zM64 384v-256h85v-43h-85c-23 0 -43 20 -43 43v256c0 23 20 43 43 43h384v-43h-384z" />
-    <glyph glyph-name="dialer_sip" unicode="dialer_sip" 
-d="M427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -61 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12zM427 405v22h-22v-22h22z
-M384 448h64v-64h-43v-43h-21v107zM320 405v-64h-64v22h43v21h-43v64h64v-21h-43v-22h43zM363 448v-107h-22v107h22z" />
-    <glyph glyph-name="dialpad" unicode="dialpad" 
-d="M256 491c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM256 363c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM384 363c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM384 235c23 0 43 -20 43 -43
-s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM256 235c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM384 405c-23 0 -43 20 -43 43s20 43 43 43s43 -20 43 -43s-20 -43 -43 -43zM128 235c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43z
-M128 363c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM128 491c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM256 107c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43z" />
-    <glyph glyph-name="directions" unicode="directions" 
-d="M299 203l74 74l-74 75v-53h-107c-12 0 -21 -10 -21 -22v-85h42v64h86v-53zM463 271c8 -9 8 -22 0 -30l-192 -192c-8 -8 -22 -8 -30 0l-192 192c-8 8 -8 22 0 30l192 192c8 8 22 8 30 0z" />
-    <glyph glyph-name="directions_bike" unicode="directions_bike" 
-d="M405 75c41 0 75 33 75 74s-34 75 -75 75s-74 -34 -74 -75s33 -74 74 -74zM405 256c60 0 107 -47 107 -107s-47 -106 -107 -106s-106 46 -106 106s46 107 106 107zM230 288l47 -49v-132h-42v106l-69 60c-9 6 -12 17 -12 30c0 11 3 21 12 30l60 60c6 9 17 12 30 12
-s23 -3 34 -12l41 -41c19 -19 44 -32 76 -32v-43c-45 0 -80 17 -108 45l-17 17zM107 75c41 0 74 33 74 74s-33 75 -74 75s-75 -34 -75 -75s34 -74 75 -74zM107 256c60 0 106 -47 106 -107s-46 -106 -106 -106s-107 46 -107 106s47 107 107 107zM331 395c-23 0 -43 19 -43 42
-s20 43 43 43s42 -20 42 -43s-19 -42 -42 -42z" />
-    <glyph glyph-name="directions_boat" unicode="directions_boat" 
-d="M128 384v-85l128 42l128 -42v85h-256zM84 107l-40 142c-4.78212 14.3464 3.99001 23.6633 14 27l27 9v99c0 23 20 43 43 43h64v64h128v-64h64c23 0 43 -20 43 -43v-99l27 -9c10.0202 -3.34008 18.7871 -12.6386 14 -27l-40 -142h-1c-34 0 -65 18 -86 42
-c-21 -24 -51 -42 -85 -42s-64 18 -85 42c-21 -24 -52 -42 -86 -42h-1zM427 64h42v-43h-42c-29 0 -59 7 -86 21c-54 -28 -116 -28 -170 0c-27 -14 -57 -21 -86 -21h-42v43h42c30 0 60 10 86 28c52 -36 118 -36 170 0c26 -18 56 -28 86 -28z" />
-    <glyph glyph-name="directions_bus" unicode="directions_bus" 
-d="M384 277v107h-256v-107h256zM352 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM160 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM85 171v213c0 75 77 85 171 85s171 -10 171 -85v-213c0 -19 -9 -36 -22 -48v-38
-c0 -12 -9 -21 -21 -21h-21c-12 0 -22 9 -22 21v22h-170v-22c0 -12 -10 -21 -22 -21h-21c-12 0 -21 9 -21 21v38c-13 12 -22 29 -22 48z" />
-    <glyph glyph-name="directions_car" unicode="directions_car" 
-d="M107 277h298l-32 96h-234zM373 171c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 171c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM404 384l44 -128v-171c0 -12 -9 -21 -21 -21h-22c-12 0 -21 9 -21 21v22h-256v-22
-c0 -12 -9 -21 -21 -21h-22c-12 0 -21 9 -21 21v171l44 128c4 13 17 21 31 21h234c14 0 27 -8 31 -21z" />
-    <glyph glyph-name="directions_railway" unicode="directions_railway" 
-d="M384 299v106h-256v-106h256zM256 149c23 0 43 20 43 43s-20 43 -43 43s-43 -20 -43 -43s20 -43 43 -43zM85 181v224c0 75 77 86 171 86s171 -11 171 -86v-224c0 -41 -34 -74 -75 -74l32 -32v-11h-256v11l32 32c-41 0 -75 33 -75 74z" />
-    <glyph glyph-name="directions_run" unicode="directions_run" 
-d="M211 99l-149 29l8 43l105 -21l34 173l-39 -15v-73h-42v100l111 47c6 0 11 2 17 2c15 0 27 -8 36 -21l21 -34c17 -30 51 -51 92 -51v-43c-47 0 -89 21 -117 53l-13 -64l45 -42v-160h-43v128l-45 42zM288 395c-23 0 -43 20 -43 43s20 42 43 42s42 -19 42 -42
-s-19 -43 -42 -43z" />
-    <glyph glyph-name="directions_subway" unicode="directions_subway" 
-d="M384 277v107h-107v-107h107zM352 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM235 277v107h-107v-107h107zM160 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM256 469c94 0 171 -10 171 -85v-203c0 -41 -34 -74 -75 -74
-l32 -32v-11h-256v11l32 32c-41 0 -75 33 -75 74v203c0 75 77 85 171 85z" />
-    <glyph glyph-name="directions_transit" unicode="directions_transit" 
-d="M384 277v107h-107v-107h107zM352 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM235 277v107h-107v-107h107zM160 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM256 469c94 0 171 -10 171 -85v-203c0 -41 -34 -74 -75 -74
-l32 -32v-11h-256v11l32 32c-41 0 -75 33 -75 74v203c0 75 77 85 171 85z" />
-    <glyph glyph-name="directions_walk" unicode="directions_walk" 
-d="M209 322l-60 -301h45l39 171l44 -43v-128h43v160l-45 43l13 64c28 -32 70 -53 117 -53v42c-41 0 -74 22 -91 52l-22 34c-9 13 -21 21 -36 21c-6 0 -11 -2 -17 -2l-111 -47v-100h43v72l38 15zM288 395c-23 0 -43 19 -43 42s20 43 43 43s43 -20 43 -43s-20 -42 -43 -42z
-" />
-    <glyph glyph-name="disc_full" unicode="disc_full" 
-d="M213 213c23 0 43 20 43 43s-20 43 -43 43s-42 -20 -42 -43s19 -43 42 -43zM213 427c94 0 171 -77 171 -171s-77 -171 -171 -171s-170 77 -170 171s76 171 170 171zM427 363h42v-107h-42v107zM427 171v42h42v-42h-42z" />
-    <glyph glyph-name="dns" unicode="dns" 
-d="M149 320c23 0 43 20 43 43s-20 42 -43 42s-42 -19 -42 -42s19 -43 42 -43zM427 448c12 0 21 -9 21 -21v-128c0 -12 -9 -22 -21 -22h-342c-12 0 -21 10 -21 22v128c0 12 9 21 21 21h342zM149 107c23 0 43 19 43 42s-20 43 -43 43s-42 -20 -42 -43s19 -42 42 -42zM427 235
-c12 0 21 -10 21 -22v-128c0 -12 -9 -21 -21 -21h-342c-12 0 -21 9 -21 21v128c0 12 9 22 21 22h342z" />
-    <glyph glyph-name="do_not_disturb" unicode="do_not_disturb" 
-d="M391 151c23 29 36 66 36 105c0 94 -77 171 -171 171c-39 0 -76 -13 -105 -36zM256 85c39 0 76 13 105 36l-240 240c-23 -29 -36 -66 -36 -105c0 -94 77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="do_not_disturb_alt" unicode="do_not_disturb_alt" 
-d="M256 85c94 0 171 77 171 171c0 38 -14 75 -37 105l-239 -239c30 -23 67 -37 105 -37zM85 256c0 -38 14 -75 37 -105l239 239c-30 23 -67 37 -105 37c-94 0 -171 -77 -171 -171zM256 469c117 0 213 -96 213 -213s-96 -213 -213 -213s-213 96 -213 213s96 213 213 213z" />
-    <glyph glyph-name="do_not_disturb_off" unicode="do_not_disturb_off" 
-d="M149 235h74l-43 42h-31v-42zM48 464l416 -416l-28 -27l-59 60c-34 -24 -76 -38 -121 -38c-118 0 -213 95 -213 213c0 45 14 87 38 121l-60 59zM363 277h-74l-154 154c34 24 76 38 121 38c118 0 213 -95 213 -213c0 -45 -14 -87 -38 -121l-99 100h31v42z" />
-    <glyph glyph-name="do_not_disturb_on" unicode="do_not_disturb_on" 
-d="M363 235v42h-214v-42h214zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="dock" unicode="dock" 
-d="M341 192v213h-170v-213h170zM341 490c23 0 43 -19 43 -42v-299c0 -23 -20 -42 -43 -42h-170c-23 0 -43 19 -43 42v299c0 23 20 43 43 43zM171 21v43h170v-43h-170z" />
-    <glyph glyph-name="domain" unicode="domain" 
-d="M384 192v-43h-43v43h43zM384 277v-42h-43v42h43zM427 107v213h-171v-43h43v-42h-43v-43h43v-43h-43v-42h171zM213 363v42h-42v-42h42zM213 277v43h-42v-43h42zM213 192v43h-42v-43h42zM213 107v42h-42v-42h42zM128 363v42h-43v-42h43zM128 277v43h-43v-43h43zM128 192v43
-h-43v-43h43zM128 107v42h-43v-42h43zM256 363h213v-299h-426v384h213v-85z" />
-    <glyph glyph-name="done" unicode="done" 
-d="M192 166l226 227l30 -30l-256 -256l-119 119l29 30z" />
-    <glyph glyph-name="done_all" unicode="done_all" 
-d="M9 226l30 30l119 -119l-30 -30zM474 393l31 -30l-256 -256l-120 119l31 30l89 -89zM384 363l-135 -136l-30 30l135 136z" />
-    <glyph glyph-name="donut_large" unicode="donut_large" 
-d="M277 108c64 9 119 63 128 127h64c-10 -107 -85 -182 -192 -192v65zM405 277c-9 64 -64 118 -128 127v65c107 -10 182 -85 192 -192h-64zM235 404c-64 -10 -128 -73 -128 -148s64 -138 128 -148v-65c-107 11 -192 102 -192 213s85 202 192 213v-65z" />
-    <glyph glyph-name="donut_small" unicode="donut_small" 
-d="M277 195c21 6 33 22 40 40h152c-10 -101 -85 -182 -192 -192v152zM317 277c-7 18 -19 34 -40 40v152c107 -10 182 -91 192 -192h-152zM235 317c-21 -9 -43 -33 -43 -61s22 -52 43 -61v-152c-107 11 -192 102 -192 213s85 202 192 213v-152z" />
-    <glyph glyph-name="drafts" unicode="drafts" 
-d="M256 235l176 110l-176 103l-176 -103zM469 341v-213c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v213c0 15 8 30 20 37l193 113l193 -113c12 -7 20 -22 20 -37z" />
-    <glyph glyph-name="drag_handle" unicode="drag_handle" 
-d="M85 192v43h342v-43h-342zM427 320v-43h-342v43h342z" />
-    <glyph glyph-name="drive_eta" unicode="drive_eta" 
-d="M107 299h298l-32 96h-234zM373 192c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 192c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM404 405l44 -128v-170c0 -12 -9 -22 -21 -22h-22c-12 0 -21 10 -21 22v21h-256v-21
-c0 -12 -9 -22 -21 -22h-22c-12 0 -21 10 -21 22v170l44 128c4 13 17 22 31 22h234c14 0 27 -9 31 -22z" />
-    <glyph glyph-name="dvr" unicode="dvr" 
-d="M149 256v-43h-42v43h42zM149 341v-42h-42v42h42zM405 256v-43h-234v43h234zM405 341v-42h-234v42h234zM448 149v256h-384v-256h384zM448 448c23 0 43 -20 43 -43l-1 -256c0 -23 -19 -42 -42 -42h-107v-43h-170v43h-107c-23 0 -43 19 -43 42v256c0 23 20 43 43 43h384z
-" />
-    <glyph glyph-name="edit" unicode="edit" 
-d="M442 362l-39 -39l-80 80l39 39c8 8 22 8 30 0l50 -50c8 -8 8 -22 0 -30zM64 144l236 236l80 -80l-236 -236h-80v80z" />
-    <glyph glyph-name="edit_location" unicode="edit_location" 
-d="M318 351c3 3 3 8 0 11l-20 20c-3 3 -8 3 -11 0l-15 -15l31 -31zM223 256l71 71l-31 31l-71 -71v-31h31zM256 469c82 0 149 -67 149 -149c0 -112 -149 -277 -149 -277s-149 165 -149 277c0 82 67 149 149 149z" />
-    <glyph glyph-name="eject" unicode="eject" 
-d="M256 405l142 -213h-284zM107 149h298v-42h-298v42z" />
-    <glyph glyph-name="email" unicode="email" 
-d="M427 341v43l-171 -107l-171 107v-43l171 -106zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="enhanced_encryption" unicode="enhanced_encryption" 
-d="M341 171v42h-64v64h-42v-64h-64v-42h64v-64h42v64h64zM190 384v-43h132v43c0 36 -30 66 -66 66s-66 -30 -66 -66zM384 341c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h21v43c0 59 48 107 107 107s107 -48 107 -107
-v-43h21z" />
-    <glyph glyph-name="equalizer" unicode="equalizer" 
-d="M341 320h86v-235h-86v235zM85 85v171h86v-171h-86zM213 85v342h86v-342h-86z" />
-    <glyph glyph-name="error" unicode="error" 
-d="M277 235v128h-42v-128h42zM277 149v43h-42v-43h42zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="error_outline" unicode="error_outline" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM235 363h42v-128h-42v128zM235 192h42v-43h-42v43z" />
-    <glyph glyph-name="euro_symbol" unicode="euro_symbol" 
-d="M320 117c35 0 66 13 90 34l38 -38c-34 -31 -79 -49 -128 -49c-84 0 -155 54 -181 128h-75v43h65c-1 7 -1 14 -1 21s0 14 1 21h-65v43h75c26 74 97 128 181 128c49 0 94 -18 128 -49l-38 -38c-24 21 -56 34 -90 34c-53 0 -100 -31 -123 -75h123v-43h-137
-c-1 -7 -2 -14 -2 -21s1 -14 2 -21h137v-43h-123c23 -44 69 -75 123 -75z" />
-    <glyph glyph-name="ev_station" unicode="ev_station" 
-d="M171 128l85 149h-43v107l-85 -160h43v-96zM384 299c12 0 21 9 21 21s-9 21 -21 21s-21 -9 -21 -21s9 -21 21 -21zM422 358c10 -10 15 -23 15 -38v-203c0 -29 -24 -53 -53 -53s-53 24 -53 53v107h-32v-160h-214v341c0 23 20 43 43 43h128c23 0 43 -20 43 -43v-149h21
-c23 0 43 -20 43 -43v-96c0 -12 9 -21 21 -21s21 9 21 21v154c-7 -3 -13 -4 -21 -4c-29 0 -53 24 -53 53c0 23 14 42 34 50l-45 45l23 22z" />
-    <glyph glyph-name="event" unicode="event" 
-d="M405 107v234h-298v-234h298zM341 491h43v-43h21c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43zM363 256v-107h-107v107h107z" />
-    <glyph glyph-name="event_available" unicode="event_available" 
-d="M405 107v234h-298v-234h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43h43v-43h21zM353 276l-127 -127l-68 68l23 23l45 -45l104 104z" />
-    <glyph glyph-name="event_busy" unicode="event_busy" 
-d="M405 107v234h-298v-234h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43h43v-43h21zM199 149l-23 23l52 52l-52 52l23 23l52 -52l52 52l22 -23l-52 -52l52 -52l-22 -23l-52 52z" />
-    <glyph glyph-name="event_note" unicode="event_note" 
-d="M299 213v-42h-150v42h150zM405 107v234h-298v-234h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43h43v-43h21zM363 299v-43h-214v43h214z" />
-    <glyph glyph-name="event_seat" unicode="event_seat" 
-d="M363 235h-214v170c0 23 20 43 43 43h128c23 0 43 -20 43 -43v-170zM43 299h64v-64h-64v64zM405 299h64v-64h-64v64zM85 64v128h342v-128h-64v64h-214v-64h-64z" />
-    <glyph glyph-name="exit_to_app" unicode="exit_to_app" 
-d="M405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v85h43v-85h298v298h-298v-85h-43v85c0 23 19 43 43 43h298zM215 179l55 56h-206v42h206l-55 56l30 30l107 -107l-107 -107z" />
-    <glyph glyph-name="expand_less" unicode="expand_less" 
-d="M256 341l128 -128l-30 -30l-98 98l-98 -98l-30 30z" />
-    <glyph glyph-name="expand_more" unicode="expand_more" 
-d="M354 329l30 -30l-128 -128l-128 128l30 30l98 -98z" />
-    <glyph glyph-name="explicit" unicode="explicit" 
-d="M320 320v43h-128v-214h128v43h-85v43h85v42h-85v43h85zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="explore" unicode="explore" 
-d="M303 209l81 175l-175 -81l-81 -175zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM256 279c13 0 23 -10 23 -23s-10 -23 -23 -23s-23 10 -23 23s10 23 23 23z" />
-    <glyph glyph-name="exposure" unicode="exposure" 
-d="M427 85v342l-342 -342h342zM107 405v-42h128v42h-128zM427 469c23 0 42 -19 42 -42v-342c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v342c0 23 19 42 42 42h342zM320 149h-43v43h43v43h43v-43h42v-43h-42v-42h-43v42z" />
-    <glyph glyph-name="exposure_neg_1" unicode="exposure_neg_&#x31;" 
-d="M405 128h-42v227l-64 -22v36l100 36h6v-277zM85 277h171v-42h-171v42z" />
-    <glyph glyph-name="exposure_neg_2" unicode="exposure_neg_&#x32;" 
-d="M43 277h170v-42h-170v42zM351 405c51.6805 0 86 -23.4377 86 -75c0 -8 -1 -17 -4 -25s-6 -17 -11 -25c-10.9564 -17.5303 -25.11 -35.11 -40 -50l-61 -66h127v-36h-184v32l89 97c13.5256 13.5256 22.2329 25.3882 31 40c5.07755 8.46258 7 15.5272 7 28c0 6 0 13 -2 18
-c-5.9589 14.8973 -17.1504 26 -38 26c-30.4379 0 -46 -18.4676 -46 -49h-46c0 25.6678 10.3448 46.3448 24 60c15.6925 15.6925 36.8462 25 68 25z" />
-    <glyph glyph-name="exposure_plus_1" unicode="exposure_plus_&#x31;" 
-d="M427 128h-43v227l-64 -22v36l100 36h7v-277zM213 363v-86h86v-42h-86v-86h-42v86h-86v42h86v86h42z" />
-    <glyph glyph-name="exposure_plus_2" unicode="exposure_plus_&#x32;" 
-d="M171 363v-86h85v-42h-85v-86h-43v86h-85v42h85v86h43zM342 164h127v-36h-184v32l89 97c13.5256 13.5256 22.2329 25.3882 31 40c4.82857 8.04762 8 16.6883 8 28c0 13.988 -4.98597 22.9813 -11 31c-6.38798 8.51731 -15.0381 13 -30 13
-c-15.4008 0 -27.3364 -6.33642 -35 -14c-6.99604 -6.99604 -11 -21.7099 -11 -35h-46c0 25.6678 10.3448 46.3448 24 60c8 8 17 15 29 19s25 6 40 6c14 0 25 -2 36 -5c10 -4 20 -8 27 -15c13.4025 -11.4878 23 -30.9925 23 -55c0 -20.2222 -7.3586 -36.1738 -16 -50
-c-5 -8 -10 -17 -17 -25s-15 -17 -23 -25z" />
-    <glyph glyph-name="exposure_zero" unicode="exposure_zero" 
-d="M299 296c0 25.8021 -1.44348 42.6652 -11 57c-4 6 -9 9 -14 12s-11 4 -18 4s-13 -1 -18 -4s-10 -6 -14 -12c-9.53524 -14.3029 -11 -31.2267 -11 -57v-57c0 -34.3202 4.66098 -58.7966 25 -71c5 -3 11 -4 18 -4c16.7682 0 24.8052 6.20777 32 17
-c8.87006 13.3051 12 34.4084 12 58v57h-1zM168 289c0 68.5293 21.3782 116 88 116c46.5088 0 71.845 -23.9186 82 -62c4 -15 7 -32 7 -54v-44h-1c0 -39.7402 -7.68654 -69.0255 -24 -90c-8 -9 -17 -17 -28 -21s-23 -6 -36 -6s-25 2 -36 6s-20 12 -28 21
-c-17.4464 19.6272 -24 51.2554 -24 90v44z" />
-    <glyph glyph-name="extension" unicode="extension" 
-d="M437 277c29 0 54 -24 54 -53s-25 -53 -54 -53h-32v-86c0 -23 -19 -42 -42 -42h-81v32c0 32 -26 57 -58 57s-58 -25 -58 -57v-32h-81c-23 0 -42 19 -42 42v81h32c32 0 57 26 57 58s-25 58 -57 58h-32v81c0 23 19 42 42 42h86v32c0 29 24 54 53 54s53 -25 53 -54v-32h86
-c23 0 42 -19 42 -42v-86h32z" />
-    <glyph glyph-name="face" unicode="face" 
-d="M256 85c94 0 171 77 171 171c0 17 -3 33 -7 48c-15 -4 -31 -5 -48 -5c-72 0 -135 35 -174 90c-21 -51 -62 -93 -112 -115c-1 -6 -1 -12 -1 -18c0 -94 77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM320 261
-c15 0 27 -11 27 -26s-12 -27 -27 -27s-27 12 -27 27s12 26 27 26zM192 261c15 0 27 -11 27 -26s-12 -27 -27 -27s-27 12 -27 27s12 26 27 26z" />
-    <glyph glyph-name="fast_forward" unicode="fast_forward" 
-d="M277 384l182 -128l-182 -128v256zM85 128v256l182 -128z" />
-    <glyph glyph-name="fast_rewind" unicode="fast_rewind" 
-d="M245 256l182 128v-256zM235 128l-182 128l182 128v-256z" />
-    <glyph glyph-name="favorite" unicode="favorite" 
-d="M256 57l-31 28c-110 100 -182 165 -182 246c0 66 51 117 117 117c37 0 73 -18 96 -45c23 27 59 45 96 45c66 0 117 -51 117 -117c0 -81 -72 -147 -182 -247z" />
-    <glyph glyph-name="favorite_border" unicode="favorite_border" 
-d="M258 116c102 92 169 153 169 215c0 43 -32 74 -75 74c-33 0 -65 -21 -76 -50h-40c-11 29 -43 50 -76 50c-43 0 -75 -31 -75 -74c0 -62 67 -123 169 -215l2 -2zM352 448c66 0 117 -51 117 -117c0 -81 -72 -146 -182 -246l-31 -28l-31 27c-110 100 -182 166 -182 247
-c0 66 51 117 117 117c37 0 73 -18 96 -45c23 27 59 45 96 45z" />
-    <glyph glyph-name="featured_play_list" unicode="featured_play_list" 
-d="M256 363v42h-192v-42h192zM256 277v43h-192v-43h192zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="featured_video" unicode="featured_video" 
-d="M256 256v149h-192v-149h192zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="feedback" unicode="feedback" 
-d="M277 299v85h-42v-85h42zM277 213v43h-42v-43h42zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="fiber_dvr" unicode="fiber_dvr" 
-d="M448 267v21c0 18 -14 32 -32 32h-75v-128h32v43h25l18 -43h32l-19 45c11 5 19 17 19 30zM269 192l38 128h-32l-22 -73l-21 73h-32l37 -128h32zM171 224v64c0 18 -14 32 -32 32h-75v-128h75c18 0 32 14 32 32zM448 448c24 0 43 -19 43 -43v-298c0 -23 -19 -43 -43 -43
-h-384c-24 0 -43 20 -43 43v298c0 24 19 43 43 43h384zM96 288h43v-64h-43v64zM373 288h43v-21h-43v21z" />
-    <glyph glyph-name="fiber_manual_record" unicode="fiber_manual_record" 
-d="M85 256c0 94 77 171 171 171s171 -77 171 -171s-77 -171 -171 -171s-171 77 -171 171z" />
-    <glyph glyph-name="fiber_new" unicode="fiber_new" 
-d="M437 213v107h-26v-96h-24v75h-27v-75h-24v96h-27v-107c0 -12 10 -21 22 -21h85c12 0 21 9 21 21zM288 293v27h-85v-128h85v27h-53v23h53v27h-53v24h53zM181 192v128h-26v-75l-54 75h-26v-128h26v75l55 -75h25zM427 427c24 0 42 -19 42 -43v-256c0 -24 -18 -43 -42 -43
-h-342c-24 0 -42 19 -42 43v256c0 24 18 43 42 43h342z" />
-    <glyph glyph-name="fiber_pin" unicode="fiber_pin" 
-d="M427 192v128h-27v-75l-53 75h-27v-128h27v75l54 -75h26zM267 192v128h-32v-128h32zM192 267v21c0 18 -14 32 -32 32h-75v-128h32v43h43c18 0 32 14 32 32zM427 427c24 0 42 -19 42 -43v-256c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v256c0 24 18 43 42 43h342z
-M117 288h43v-21h-43v21z" />
-    <glyph glyph-name="fiber_smart_record" unicode="fiber_smart_record" 
-d="M363 421c74 -19 128 -85 128 -165s-54 -146 -128 -165v44c50 17 85 65 85 121s-35 104 -85 121v44zM21 256c0 94 77 171 171 171s171 -77 171 -171s-77 -171 -171 -171s-171 77 -171 171z" />
-    <glyph glyph-name="file_download" unicode="file_download" 
-d="M107 128h298v-43h-298v43zM405 320l-149 -149l-149 149h85v128h128v-128h85z" />
-    <glyph glyph-name="file_upload" unicode="file_upload" 
-d="M107 128h298v-43h-298v43zM192 171v128h-85l149 149l149 -149h-85v-128h-128z" />
-    <glyph glyph-name="filter" unicode="filter" 
-d="M448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43zM340 292l76 -100h-235l59 75l42 -50z" />
-    <glyph glyph-name="filter_1" unicode="filter_&#x31;" 
-d="M448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM299 192v171h-43v42h85v-213h-42zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_2" unicode="filter_&#x32;" 
-d="M363 235v-43h-128v85c0 24 19 43 42 43h43v43h-85v42h85c23 0 43 -18 43 -42v-43c0 -24 -20 -43 -43 -43h-43v-42h86zM448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM64 405
-v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_3" unicode="filter_&#x33;" 
-d="M363 235c0 -24 -20 -43 -43 -43h-85v43h85v42h-43v43h43v43h-85v42h85c23 0 43 -18 43 -42v-32c0 -18 -14 -32 -32 -32c18 0 32 -14 32 -32v-32zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43zM448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299
-c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299z" />
-    <glyph glyph-name="filter_4" unicode="filter_&#x34;" 
-d="M448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM320 192v85h-85v128h42v-85h43v85h43v-213h-43zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_5" unicode="filter_&#x35;" 
-d="M363 235c0 -24 -20 -43 -43 -43h-85v43h85v42h-85v128h128v-42h-86v-43h43c23 0 43 -19 43 -43v-42zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43zM448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299
-c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299z" />
-    <glyph glyph-name="filter_6" unicode="filter_&#x36;" 
-d="M277 277v-42h43v42h-43zM277 192c-23 0 -42 19 -42 43v128c0 24 19 42 42 42h86v-42h-86v-43h43c23 0 43 -19 43 -43v-42c0 -24 -20 -43 -43 -43h-43zM448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299
-c0 23 19 43 42 43h299zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_7" unicode="filter_&#x37;" 
-d="M277 192h-42l85 171h-85v42h128v-42zM448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_8" unicode="filter_&#x38;" 
-d="M277 277v-42h43v42h-43zM277 363v-43h43v43h-43zM277 192c-23 0 -42 19 -42 43v32c0 18 14 32 32 32c-18 0 -32 14 -32 32v32c0 24 19 42 42 42h43c23 0 43 -18 43 -42v-32c0 -18 -14 -32 -32 -32c18 0 32 -14 32 -32v-32c0 -24 -20 -43 -43 -43h-43zM448 149v299h-299
-v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_9" unicode="filter_&#x39;" 
-d="M320 320v43h-43v-43h43zM320 405c23 0 43 -18 43 -42v-128c0 -24 -20 -43 -43 -43h-85v43h85v42h-43c-23 0 -42 19 -42 43v43c0 24 19 42 42 42h43zM448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299
-c0 23 19 43 42 43h299zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_9_plus" unicode="filter_&#x39;_plus" 
-d="M448 320v128h-299v-299h299v128h-43v-42h-42v42h-43v43h43v43h42v-43h43zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM235 320h21v21h-21v-21zM299 256c0 -24 -20 -43 -43 -43h-64v43h64v21h-21
-c-23 0 -43 19 -43 43v21c0 24 20 43 43 43h21c23 0 43 -19 43 -43v-85zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_b_and_w" unicode="filter_b_and_w" 
-d="M405 107v298h-149v-128zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298zM256 277l-149 -170h149v170z" />
-    <glyph glyph-name="filter_center_focus" unicode="filter_center_focus" 
-d="M256 320c35 0 64 -29 64 -64s-29 -64 -64 -64s-64 29 -64 64s29 64 64 64zM405 107v85h43v-85c0 -23 -20 -43 -43 -43h-85v43h85zM405 448c23 0 43 -20 43 -43v-85h-43v85h-85v43h85zM107 405v-85h-43v85c0 23 20 43 43 43h85v-43h-85zM107 192v-85h85v-43h-85
-c-23 0 -43 20 -43 43v85h43z" />
-    <glyph glyph-name="filter_drama" unicode="filter_drama" 
-d="M405 128c35 0 64 29 64 64s-29 64 -64 64h-32v11c0 65 -52 117 -117 117c-38 0 -72 -18 -94 -47c54 -15 94 -65 94 -124h-43c0 47 -38 86 -85 86s-85 -39 -85 -86s38 -85 85 -85h277zM413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277
-c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="filter_frames" unicode="filter_frames" 
-d="M384 341h-256v-213h256zM427 85v299h-96l-74 75l-75 -75h-97v-299h342zM427 427c23 0 42 -20 42 -43v-299c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h86l85 85l85 -85h86z" />
-    <glyph glyph-name="filter_hdr" unicode="filter_hdr" 
-d="M299 384l192 -256h-470l128 171l96 -128l34 25l-60 81z" />
-    <glyph glyph-name="filter_list" unicode="filter_list" 
-d="M128 235v42h256v-42h-256zM64 384h384v-43h-384v43zM213 128v43h86v-43h-86z" />
-    <glyph glyph-name="filter_none" unicode="filter_none" 
-d="M448 149v299h-299v-299h299zM448 491c23 0 43 -20 43 -43v-299c0 -23 -20 -42 -43 -42h-299c-23 0 -42 19 -42 42v299c0 23 19 43 42 43h299zM64 405v-341h341v-43h-341c-23 0 -43 20 -43 43v341h43z" />
-    <glyph glyph-name="filter_tilt_shift" unicode="filter_tilt_shift" 
-d="M121 91l30 30c24 -18 53 -30 84 -34v-43c-43 4 -82 21 -114 47zM277 87c31 4 60 16 83 34l31 -30c-32 -26 -71 -43 -114 -47v43zM391 151c18 24 30 52 34 83h43c-4 -43 -21 -81 -47 -113zM320 256c0 -35 -29 -64 -64 -64s-64 29 -64 64s29 64 64 64s64 -29 64 -64z
-M87 235c4 -31 16 -60 34 -83l-30 -31c-26 32 -43 71 -47 114h43zM121 361c-18 -24 -30 -53 -34 -84h-43c4 43 21 82 47 114zM425 277c-4 31 -16 60 -34 84l30 30c26 -32 43 -71 47 -114h-43zM391 421l-30 -30c-24 18 -53 30 -84 34v43c43 -4 82 -21 114 -47zM235 425
-c-31 -4 -60 -16 -84 -34l-30 30c32 26 71 43 114 47v-43z" />
-    <glyph glyph-name="filter_vintage" unicode="filter_vintage" 
-d="M256 171c47 0 85 38 85 85s-38 85 -85 85s-85 -38 -85 -85s38 -85 85 -85zM49 137c0 49.2164 31.3621 102.121 82 119c-6 2 -12 6 -18 9c-41 24 -64 66 -64 110c38 22 87 24 128 0c6 -3 12 -7 17 -11c-1 7 -2 13 -2 20c0 47 26 89 64 111c38 -22 64 -64 64 -111
-c0 -7 -1 -13 -2 -20c5 4 11 8 17 11c41 24 90 22 128 0c0 -44 -23 -86 -64 -110c-6 -3 -12 -7 -18 -9c6 -2 12 -6 18 -9c41 -24 64 -66 64 -110c-38 -22 -87 -24 -128 0c-6 3 -12 7 -17 11c1 -7 2 -13 2 -20c0 -47 -26 -89 -64 -111c-38 22 -64 64 -64 111c0 7 1 13 2 20
-c-5 -4 -11 -8 -17 -11c-41 -24 -90 -22 -128 0z" />
-    <glyph glyph-name="find_in_page" unicode="find_in_page" 
-d="M192 235c0 35 29 64 64 64s64 -29 64 -64s-29 -64 -64 -64s-64 29 -64 64zM427 94l-82 82c11 17 18 37 18 59c0 59 -48 106 -107 106s-107 -47 -107 -106s48 -107 107 -107c22 0 42 7 59 18l94 -95c-7 -5 -15 -8 -25 -8h-256c-23 0 -43 19 -43 42l1 342c0 23 19 42 42 42
-h171l128 -128v-247z" />
-    <glyph glyph-name="find_replace" unicode="find_replace" 
-d="M355 189l103 -104l-31 -31l-104 103c-25 -18 -55 -29 -88 -29c-41 0 -79 17 -106 44l-44 -44v128h128l-54 -54c19 -19 47 -31 76 -31c52 0 94 36 104 85h43c-3 -25 -13 -48 -27 -67zM235 384c-52 0 -95 -36 -105 -85h-43c10 72 73 128 148 128c41 0 78 -17 105 -44l44 44
-v-128h-128l54 54c-19 19 -46 31 -75 31z" />
-    <glyph glyph-name="fingerprint" unicode="fingerprint" 
-d="M318 43h-3c-34 9 -56 22 -79 45c-30 30 -46 69 -46 111c0 35 29 63 65 63s66 -28 66 -63c0 -23 19 -41 44 -41s45 18 45 41c0 80 -70 146 -155 146c-61 0 -116 -34 -141 -86c-8 -17 -12 -38 -12 -60c0 -17 1 -43 14 -77c4.57857 -13.7357 -15.4693 -18.3268 -20 -7
-c-10 28 -16 55 -16 84c0 26 5 49 15 69c28 60 91 99 160 99c97 0 176 -76 176 -168c0 -35 -30 -62 -66 -62s-65 27 -65 62c0 23 -20 42 -45 42s-44 -19 -44 -42c0 -36 14 -70 40 -96c20 -20 40 -31 70 -39c6 -1 8 -7 7 -13c-1 -5 -6 -8 -10 -8zM265 199
-c0 -48.7573 40.2888 -91 96 -91c9.9641 0 32.7732 7.36098 35 -6c1 -6 -3 -12 -9 -13c-12 -2 -23 -2 -26 -2c-25 0 -48 6 -66 19c-32 22 -51 56 -51 93c0 6 5 11 11 11s10 -5 10 -11zM208 47c-3 0 -5 1 -7 3c-19 19 -29 31 -43 57c-15 26 -23 58 -23 92c0 63 54 115 121 115
-s121 -52 121 -115c0 -6 -5 -10 -11 -10s-11 4 -11 10c0 52 -44 94 -99 94s-99 -42 -99 -94c0 -31 6 -59 19 -82c14 -25 24 -35 40 -52c4 -4 4 -11 0 -15c-2 -2 -5 -3 -8 -3zM75 305c-8.81177 0 -13.8926 7.8456 -9 16c21 30 48 54 80 70c67 35 153 35 220 0
-c32 -16 59 -39 80 -69c3 -5 2 -12 -3 -15s-12 -2 -15 3c-19 27 -43 47 -72 62c-61 31 -139 32 -200 0c-29 -15 -54 -36 -73 -63c-2 -3 -5 -4 -8 -4zM380 417c-2 0 -4 0 -5 1c-41 21 -77 30 -119 30s-83 -10 -119 -30c-11.6907 -7.0144 -21.6392 12.0165 -10 19
-c40 22 83 32 129 32c45 0 85 -10 129 -32c9.10556 -5.46333 5.20303 -20 -5 -20z" />
-    <glyph glyph-name="first_page" unicode="first_page" 
-d="M128 384h43v-256h-43v256zM393 158l-30 -30l-128 128l128 128l30 -30l-98 -98z" />
-    <glyph glyph-name="fitness_center" unicode="fitness_center" 
-d="M439 195l30 -31l-45 -45l30 -31l-30 -30l-31 30l-45 -45l-31 30l-30 -30l-31 30l76 76l-183 183l-76 -76l-30 31l30 30l-30 31l45 45l-30 31l30 30l31 -30l45 45l31 -30l30 30l31 -30l-76 -76l183 -183l76 76l30 -31z" />
-    <glyph glyph-name="flag" unicode="flag" 
-d="M307 384h120v-213h-150l-8 42h-120v-149h-42v363h192z" />
-    <glyph glyph-name="flare" unicode="flare" 
-d="M235 21v128h42v-128h-42zM120 150l46 46l30 -30l-46 -46zM316 166l30 30l46 -46l-30 -30zM256 320c35 0 64 -29 64 -64s-29 -64 -64 -64s-64 29 -64 64s29 64 64 64zM363 277h128v-42h-128v42zM392 362l-46 -46l-30 30l46 46zM277 491v-128h-42v128h42zM196 346l-30 -30
-l-46 46l30 30zM149 277v-42h-128v42h128z" />
-    <glyph glyph-name="flash_auto" unicode="flash_auto" 
-d="M359 349h50l-25 78zM405 469l69 -192h-41l-15 43h-68l-15 -43h-41l69 192h42zM64 469h213l-85 -192h85l-149 -256v192h-64v256z" />
-    <glyph glyph-name="flash_off" unicode="flash_off" 
-d="M363 299l-33 -57l-181 181v46h214l-86 -170h86zM70 448l335 -336l-27 -27l-88 89l-77 -131v192h-64v79l-106 107z" />
-    <glyph glyph-name="flash_on" unicode="flash_on" 
-d="M149 469h214l-86 -170h86l-150 -256v192h-64v234z" />
-    <glyph glyph-name="flight" unicode="flight" 
-d="M217 320zM448 171l-171 53v-117l43 -32v-32l-75 21l-74 -21v32l42 32v117l-170 -53v42l170 107v117c0 18 14 32 32 32s32 -14 32 -32v-117l171 -107v-42z" />
-    <glyph glyph-name="flight_land" unicode="flight_land" 
-d="M299 204c-68.2362 18.7638 -137.045 36.9549 -206 55l-34 10v110l31 -8l20 -50l106 -28v176l41 -11l59 -192l113 -30c17 -5 27 -23 23 -40c-5 -17 -22 -26 -39 -22zM53 107h406v-43h-406v43z" />
-    <glyph glyph-name="flight_takeoff" unicode="flight_takeoff" 
-d="M471 306c4 -17 -6 -34 -23 -39c-68.7788 -18.2212 -137.501 -36.499 -206 -55l-113 -30l-34 -10c-18.76 31.9067 -37.3464 63.9869 -56 96l31 8l42 -32l106 28l-88 153l41 11l147 -137l114 30c17 5 35 -6 39 -23zM53 107h406v-43h-406v43z" />
-    <glyph glyph-name="flip" unicode="flip" 
-d="M405 64v43h43c0 -23 -20 -43 -43 -43zM405 235v42h43v-42h-43zM320 405v43h43v-43h-43zM405 149v43h43v-43h-43zM235 21v470h42v-470h-42zM405 448c23 0 43 -20 43 -43h-43v43zM64 405c0 23 20 43 43 43h85v-43h-85v-298h85v-43h-85c-23 0 -43 20 -43 43v298zM405 320v43
-h43v-43h-43zM320 64v43h43v-43h-43z" />
-    <glyph glyph-name="flip_to_back" unicode="flip_to_back" 
-d="M320 149v43h43v-43h-43zM320 405v43h43v-43h-43zM107 363v-256h256v-43h-256c-24 0 -43 20 -43 43v256h43zM405 149v43h43c0 -23 -20 -43 -43 -43zM405 320v43h43v-43h-43zM405 235v42h43v-42h-43zM192 149c-24 0 -43 20 -43 43h43v-43zM277 448v-43h-42v43h42zM405 448
-c23 0 43 -20 43 -43h-43v43zM277 192v-43h-42v43h42zM192 448v-43h-43c0 23 19 43 43 43zM192 277v-42h-43v42h43zM192 363v-43h-43v43h43z" />
-    <glyph glyph-name="flip_to_front" unicode="flip_to_front" 
-d="M149 64v43h43v-43h-43zM235 64v43h42v-43h-42zM405 192v213h-213v-213h213zM405 448c23 0 43 -20 43 -43v-213c0 -23 -20 -43 -43 -43h-213c-24 0 -43 20 -43 43v213c0 23 19 43 43 43h213zM320 64v43h43v-43h-43zM64 320v43h43v-43h-43zM107 64c-24 0 -43 20 -43 43h43
-v-43zM64 149v43h43v-43h-43zM64 235v42h43v-42h-43z" />
-    <glyph glyph-name="folder" unicode="folder" 
-d="M213 427l43 -43h171c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h128z" />
-    <glyph glyph-name="folder_open" unicode="folder_open" 
-d="M427 128v213h-342v-213h342zM427 384c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h128l43 -43h171z" />
-    <glyph glyph-name="folder_shared" unicode="folder_shared" 
-d="M405 149v22c0 28 -57 42 -85 42s-85 -14 -85 -42v-22h170zM320 320c-23 0 -43 -20 -43 -43s20 -42 43 -42s43 19 43 42s-20 43 -43 43zM427 384c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h128l43 -43h171z" />
-    <glyph glyph-name="folder_special" unicode="folder_special" 
-d="M383 149l-17 71l55 48l-72 6l-29 67l-29 -67l-72 -6l55 -48l-17 -71l63 37zM427 384c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h128l43 -43h171z" />
-    <glyph glyph-name="font_download" unicode="font_download" 
-d="M340 117h45l-109 278h-40l-109 -278h45l24 64h120zM427 469c23 0 42 -19 42 -42v-342c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v342c0 23 19 42 42 42h342zM212 224l44 118l44 -118h-88z" />
-    <glyph glyph-name="format_align_center" unicode="format_align_center" 
-d="M64 448h384v-43h-384v43zM149 363h214v-43h-214v43zM64 235v42h384v-42h-384zM64 64v43h384v-43h-384zM149 192h214v-43h-214v43z" />
-    <glyph glyph-name="format_align_justify" unicode="format_align_justify" 
-d="M64 448h384v-43h-384v43zM64 320v43h384v-43h-384zM64 235v42h384v-42h-384zM64 149v43h384v-43h-384zM64 64v43h384v-43h-384z" />
-    <glyph glyph-name="format_align_left" unicode="format_align_left" 
-d="M64 448h384v-43h-384v43zM64 64v43h384v-43h-384zM64 235v42h384v-42h-384zM320 363v-43h-256v43h256zM320 192v-43h-256v43h256z" />
-    <glyph glyph-name="format_align_right" unicode="format_align_right" 
-d="M64 448h384v-43h-384v43zM192 320v43h256v-43h-256zM64 235v42h384v-42h-384zM192 149v43h256v-43h-256zM64 64v43h384v-43h-384z" />
-    <glyph glyph-name="format_bold" unicode="format_bold" 
-d="M288 181c18 0 32 14 32 32s-14 32 -32 32h-75v-64h75zM213 373v-64h64c18 0 32 14 32 32s-14 32 -32 32h-64zM333 282c28 -13 46 -41 46 -73c0 -45 -34 -81 -79 -81h-151v299h134c48 0 85 -38 85 -86c0 -22 -14 -45 -35 -59z" />
-    <glyph glyph-name="format_clear" unicode="format_clear" 
-d="M128 405h299v-64h-124l-34 -80l-45 44l15 36h-51l-60 60v4zM70 405l6 -5l308 -309l-27 -27l-121 121l-33 -78h-64l52 123l-148 148z" />
-    <glyph glyph-name="format_color_fill" unicode="format_color_fill" 
-d="M0 85h512v-85h-512v85zM405 267c0 0 43 -47 43 -75c0 -23 -20 -43 -43 -43s-42 20 -42 43c0 28 42 75 42 75zM111 299h205l-103 102zM353 321c13 -13 13 -33 0 -45l-117 -117c-6 -6 -15 -10 -23 -10s-16 4 -22 10l-118 117c-13 12 -13 32 0 45l110 110l-51 51l31 30z" />
-    <glyph glyph-name="format_color_reset" unicode="format_color_reset" 
-d="M112 400l312 -312l-27 -27l-57 56c-23 -20 -52 -32 -84 -32c-71 0 -128 57 -128 128c0 26 12 57 28 88l-71 71zM384 213c0 -10 -1 -19 -3 -28l-183 184c30 43 58 75 58 75s128 -146 128 -231z" />
-    <glyph glyph-name="format_color_text" unicode="format_color_text" 
-d="M205 256h102l-51 135zM235 448h42l117 -299h-48l-23 64h-134l-24 -64h-48zM0 85h512v-85h-512v85z" />
-    <glyph glyph-name="format_indent_decrease" unicode="format_indent_decrease" 
-d="M235 235v42h213v-42h-213zM235 320v43h213v-43h-213zM64 448h384v-43h-384v43zM64 64v43h384v-43h-384zM64 256l85 85v-170zM235 149v43h213v-43h-213z" />
-    <glyph glyph-name="format_indent_increase" unicode="format_indent_increase" 
-d="M235 235v42h213v-42h-213zM235 320v43h213v-43h-213zM64 448h384v-43h-384v43zM235 149v43h213v-43h-213zM64 341l85 -85l-85 -85v170zM64 64v43h384v-43h-384z" />
-    <glyph glyph-name="format_italic" unicode="format_italic" 
-d="M213 427h171v-64h-60l-72 -171h47v-64h-171v64h60l72 171h-47v64z" />
-    <glyph glyph-name="format_line_spacing" unicode="format_line_spacing" 
-d="M213 235v42h256v-42h-256zM213 107v42h256v-42h-256zM213 405h256v-42h-256v42zM128 363v-214h53l-74 -74l-75 74h53v214h-53l75 74l74 -74h-53z" />
-    <glyph glyph-name="format_list_bulleted" unicode="format_list_bulleted" 
-d="M149 405h299v-42h-299v42zM149 235v42h299v-42h-299zM149 107v42h299v-42h-299zM85 160c18 0 32 -15 32 -32s-15 -32 -32 -32s-32 15 -32 32s14 32 32 32zM85 416c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM85 288c18 0 32 -14 32 -32
-s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32z" />
-    <glyph glyph-name="format_list_numbered" unicode="format_list_numbered" 
-d="M149 235v42h299v-42h-299zM149 107v42h299v-42h-299zM149 405h299v-42h-299v42zM43 277v22h64v-20l-39 -44h39v-22h-64v20l38 44h-38zM64 341v64h-21v22h42v-86h-21zM43 149v22h64v-86h-64v22h42v10h-21v22h21v10h-42z" />
-    <glyph glyph-name="format_paint" unicode="format_paint" 
-d="M384 427h64v-171h-171v-192c0 -12 -9 -21 -21 -21h-43c-12 0 -21 9 -21 21v235h213v85h-21v-21c0 -12 -9 -22 -21 -22h-256c-12 0 -22 10 -22 22v85c0 12 10 21 22 21h256c12 0 21 -9 21 -21v-21z" />
-    <glyph glyph-name="format_quote" unicode="format_quote" 
-d="M299 149l42 86h-64v128h128v-128l-42 -86h-64zM128 149l43 86h-64v128h128v-128l-43 -86h-64z" />
-    <glyph glyph-name="format_shapes" unicode="format_shapes" 
-d="M228 240h56l-28 82zM293 213h-75l-15 -42h-35l73 192h30l72 -192h-34zM405 405h43v43h-43v-43zM448 64v43h-43v-43h43zM363 107v42h42v214h-42v42h-214v-42h-42v-214h42v-42h214zM107 64v43h-43v-43h43zM64 448v-43h43v43h-43zM491 363h-43v-214h43v-128h-128v43h-214
-v-43h-128v128h43v214h-43v128h128v-43h214v43h128v-128z" />
-    <glyph glyph-name="format_size" unicode="format_size" 
-d="M64 256v64h192v-64h-64v-149h-64v149h-64zM192 427h277v-64h-106v-256h-64v256h-107v64z" />
-    <glyph glyph-name="format_strikethrough" unicode="format_strikethrough" 
-d="M64 213v43h384v-43h-384zM107 427h298v-64h-106v-64h-86v64h-106v64zM213 107v64h86v-64h-86z" />
-    <glyph glyph-name="format_textdirection_l_to_r" unicode="format_textdirection_l_to_r" 
-d="M448 128l-85 -85v64h-256v42h256v64zM192 299c-47 0 -85 38 -85 85s38 85 85 85h171v-42h-43v-235h-43v235h-42v-235h-43v107z" />
-    <glyph glyph-name="format_textdirection_r_to_l" unicode="format_textdirection_r_to_l" 
-d="M171 149h256v-42h-256v-64l-86 85l86 85v-64zM213 299c-47 0 -85 38 -85 85s38 85 85 85h171v-42h-43v-235h-42v235h-43v-235h-43v107z" />
-    <glyph glyph-name="format_underlined" unicode="format_underlined" 
-d="M107 107h298v-43h-298v43zM256 149c-71 0 -128 57 -128 128v171h53v-171c0 -41 34 -74 75 -74s75 33 75 74v171h53v-171c0 -71 -57 -128 -128 -128z" />
-    <glyph glyph-name="forum" unicode="forum" 
-d="M363 256c0 -12 -10 -21 -22 -21h-213l-85 -86v299c0 12 9 21 21 21h277c12 0 22 -9 22 -21v-192zM448 384c12 0 21 -9 21 -21v-320l-85 85h-235c-12 0 -21 9 -21 21v43h277v192h43z" />
-    <glyph glyph-name="forward" unicode="forward" 
-d="M256 341v86l171 -171l-171 -171v86h-171v170h171z" />
-    <glyph glyph-name="forward_10" unicode="forward_&#x31;&#x30;" 
-d="M282 188c0 -3.2653 6.32517 -7 10 -7c2 0 5 0 7 2l4 5s2 4 2 6v43c0 0 -2 4 -2 6c0 2.75261 -8.21183 7 -11 7c-2 0 -4 -1 -6 -3l-4 -4s-3 -4 -3 -6v-43s3 -4 3 -6zM322 209c0 -6 0 -13 -2 -17l-6 -13s-7 -6 -11 -6s-9 -2 -13 -2s-9 0 -13 2s-6 4 -10 6
-c-6.74403 3.37202 -9 19.7461 -9 30v15c0 6 0 13 2 17l7 13s6 6 10 6s9 2 13 2s9 0 13 -2s7 -4 11 -6s4 -7 6 -13s2 -11 2 -17v-15zM233 171h-20v70l-21 -6v15l38 12h3v-91zM85 235c0 94 77 170 171 170v86l107 -107l-107 -107v86c-70 0 -128 -58 -128 -128
-s58 -128 128 -128s128 58 128 128h43c0 -94 -77 -171 -171 -171s-171 77 -171 171z" />
-    <glyph glyph-name="forward_30" unicode="forward_&#x33;&#x30;" 
-d="M85 235c0 94 77 170 171 170v86l107 -107l-107 -107v86c-70 0 -128 -58 -128 -128s58 -128 128 -128s128 58 128 128h43c0 -94 -77 -171 -171 -171s-171 77 -171 171zM284 188c0 -3.2653 6.32517 -7 10 -7c2 0 5 0 7 2l4 5s2 4 2 6v43c0 0 -2 4 -2 6
-c0 2.75261 -8.21183 7 -11 7c-2 0 -4 -1 -6 -3l-4 -4s-2 -4 -2 -6v-43s2 -4 2 -6zM326 209c0 -6 0 -13 -2 -17l-6 -13s-7 -6 -11 -6s-9 -2 -13 -2c-10.126 0 -16.1493 4.57466 -23 8c-4 2 -4 7 -6 13s-3 11 -3 17v15c0 6 1 13 3 17l6 13s7 6 11 6s8 2 12 2s9 0 13 -2
-s7 -4 11 -6s4 -7 6 -13s2 -11 2 -17v-15zM213 224c8.11936 0 15 4.95913 15 13v4s-2 2 -2 4s-2 2 -4 2h-11s-2 -2 -4 -2s-2 -2 -2 -4v-4h-22c0 9.89385 8.81974 23 18 23c2 0 8 2 10 2c8.67272 0 17.6319 -2.81597 24 -6c5.06488 -2.53244 8 -12.109 8 -19v-7s-2 -4 -2 -6
-s-2 -4 -4 -4s-5 -3 -7 -5c4 -2 9 -4 11 -8s4 -9 4 -13s0 -9 -2 -11s-4 -6 -6 -8s-7 -4 -11 -4s-9 -2 -13 -2s-8 0 -10 2s-7 2 -11 4c-5.58093 2.79046 -9 13.5084 -9 21h18v-4s2 -2 2 -4s2 -2 4 -2h11s2 2 4 2s2 2 2 4v11s-2 2 -2 4s-2 2 -4 2h-13v15h8z" />
-    <glyph glyph-name="forward_5" unicode="forward_&#x35;" 
-d="M250 222c-1.79204 -0.716817 -7 -2.40231 -7 -4c0 -2 -2 -3 -2 -3h-13l5 47h51v-15h-37l-2 -19s2 0 2 2s3 1 3 3s2 0 4 0h4c4 0 9 -1 11 -3s6 -4 8 -6c4.43641 -4.43641 9 -13.6284 9 -23c0 -4 0 -9 -2 -11s-3 -7 -7 -11c-5.62284 -5.62284 -13.295 -8 -23 -8
-c-4 0 -9 0 -11 2s-6 2 -10 4c-5.5956 2.7978 -9 11.277 -9 19h17c0 -7.40446 5.29508 -10 13 -10c2 0 4 0 6 2l5 4s2 4 2 6v13l-2 4l-5 5s-4 2 -6 2h-4zM85 235c0 94 77 170 171 170v86l107 -107l-107 -107v86c-70 0 -128 -58 -128 -128s58 -128 128 -128s128 58 128 128h43
-c0 -94 -77 -171 -171 -171s-171 77 -171 171z" />
-    <glyph glyph-name="free_breakfast" unicode="free_breakfast" 
-d="M85 107h342v-43h-342v43zM427 341v64h-43v-64h43zM427 448c24 0 42 -19 42 -43v-64c0 -23 -18 -42 -42 -42h-43v-64c0 -47 -38 -86 -85 -86h-128c-47 0 -86 39 -86 86v213h342z" />
-    <glyph glyph-name="fullscreen" unicode="fullscreen" 
-d="M299 405h106v-106h-42v64h-64v42zM363 149v64h42v-106h-106v42h64zM107 299v106h106v-42h-64v-64h-42zM149 213v-64h64v-42h-106v106h42z" />
-    <glyph glyph-name="fullscreen_exit" unicode="fullscreen_exit" 
-d="M341 341h64v-42h-106v106h42v-64zM299 107v106h106v-42h-64v-64h-42zM171 341v64h42v-106h-106v42h64zM107 171v42h106v-106h-42v64h-64z" />
-    <glyph glyph-name="functions" unicode="functions" 
-d="M384 427v-64h-149l106 -107l-106 -107h149v-64h-256v43l139 128l-139 128v43h256z" />
-    <glyph glyph-name="g_translate" unicode="g_translate" 
-d="M448 85v278c0 12 -9 21 -21 21h-188l25 -86h41v22h23v-22h77v-22h-27c-7 -27 -22 -53 -41 -75l58 -57l-15 -16l-58 57l-19 -19l17 -59l-43 -43h150c12 0 21 9 21 21zM298 253c5 -10 13 -23 24 -36c26 31 33 59 33 59h-85l7 -23h21zM282 237l13 -47l12 11
-c-10 11 -18 23 -25 36zM237 286c0 4.92043 -0.140331 11.2807 -2 15h-84v-33h47c-3 -13 -16 -32 -45 -32c-28 0 -51 24 -51 52s23 52 51 52c16 0 26 -7 32 -13l2 -1l26 25l-2 1c-16 15 -36 23 -58 23c-48 0 -87 -39 -87 -87s39 -87 87 -87c49 0 84 35 84 85zM427 405
-c23 0 42 -19 42 -42v-278c0 -23 -19 -42 -42 -42h-171l-21 64h-150c-23 0 -42 19 -42 42v278c0 23 19 42 42 42h128l19 -64h195z" />
-    <glyph glyph-name="gamepad" unicode="gamepad" 
-d="M352 320h117v-128h-117l-64 64zM192 160l64 64l64 -64v-117h-128v117zM160 320l64 -64l-64 -64h-117v128h117zM320 352l-64 -64l-64 64v117h128v-117z" />
-    <glyph glyph-name="games" unicode="games" 
-d="M352 320h117v-128h-117l-64 64zM192 160l64 64l64 -64v-117h-128v117zM160 320l64 -64l-64 -64h-117v128h117zM320 352l-64 -64l-64 64v117h128v-117z" />
-    <glyph glyph-name="gavel" unicode="gavel" 
-d="M82 310l120 -121l-60 -60l-121 120zM263 491l120 -121l-60 -60l-121 120zM112 340l60 60l302 -302l-60 -60zM21 64h256v-43h-256v43z" />
-    <glyph glyph-name="gesture" unicode="gesture" 
-d="M296 116c15 0 40 18 46 75c-46 -12 -62 -46 -62 -59c0 -10 9 -16 16 -16zM98 365l-37 36c5 6 10 12 18 20c5 5 30 27 58 27c19 0 54 -15 54 -61c0 -29 -11 -46 -28 -70c-10 -14 -32 -52 -39 -75c-8 -23 -3 -41 7 -41c9 0 19 12 24 18c5 5 37 42 49 58c16 20 57 60 105 60
-c63 0 83 -54 86 -89h53v-53h-52c-9 -102 -66 -131 -101 -131c-38 0 -68 30 -68 66s34 101 115 115c-2 17 -3 38 -38 38c-27 0 -61 -41 -87 -73c-24 -29 -42 -52 -65 -59c-49.7758 -15.7187 -85 28.2434 -85 73c0 52 56 126 61 135c6 10 17 28 6 32c-7 3 -21 -11 -36 -26z
-" />
-    <glyph glyph-name="get_app" unicode="get_app" 
-d="M107 128h298v-43h-298v43zM405 320l-149 -149l-149 149h85v128h128v-128h85z" />
-    <glyph glyph-name="gif" unicode="gif" 
-d="M405 288h-64v-21h43v-32h-43v-43h-32v128h96v-32zM192 320c13 0 21 -10 21 -21v-11h-74v-64h42v32h32v-43c0 -11 -8 -21 -21 -21h-64c-13 0 -21 10 -21 21v86c0 11 8 21 21 21h64zM245 320h32v-128h-32v128z" />
-    <glyph glyph-name="goat" unicode="goat" 
-d="M511 318c1 -1 1 -4 0 -5l-25 -32c-1 -1 -3 -2 -4 -2l-15 3l-7 -22c-3 -5 -10 -5 -13 0l-14 30l-23 5l-47 -112l17 -136c0 -3 -2 -4 -4 -4h-20c-2 0 -3 1 -4 3l-20 81l-10 17l-25 -98c0 -2 -2 -3 -4 -3h-21c-2 0 -4 2 -4 4l23 135h-135l-35 -66l8 -68c1 -3 -1 -5 -4 -5
-h-20c-1 0 -3 0 -4 2l-28 102l-34 -39l6 -60c1 -3 -1 -5 -4 -5h-22c-2 0 -4 1 -4 2l-13 56l21 82v144s-23 9 -23 30h274c0 0 48 -1 95 33c0 0 -8 22 6 36c0 0 28 -20 36 -25c10 -6 17 5 14 14c-2 6 -9 28 -45 42c-4.57884 1.52628 -15.2106 2.3682 -13 9c0 2 2 3 4 3
-c44 -6 70 -42 77 -58c1 -2 20 -15 18 -38c0 -3 0 -5 2 -7z" />
-    <glyph glyph-name="golf_course" unicode="golf_course" 
-d="M363 386l-128 -66v-193c61 -3 106 -21 106 -42c0 -23 -57 -42 -128 -42s-128 19 -128 42c0 16 26 30 64 37v-37h43v384zM384 96c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32z" />
-    <glyph glyph-name="gps_fixed" unicode="gps_fixed" 
-d="M256 107c83 0 149 66 149 149s-66 149 -149 149s-149 -66 -149 -149s66 -149 149 -149zM447 277h44v-42h-44c-10 -89 -81 -160 -170 -170v-44h-42v44c-89 10 -160 81 -170 170h-44v42h44c10 89 81 160 170 170v44h42v-44c89 -10 160 -81 170 -170zM256 341
-c47 0 85 -38 85 -85s-38 -85 -85 -85s-85 38 -85 85s38 85 85 85z" />
-    <glyph glyph-name="gps_not_fixed" unicode="gps_not_fixed" 
-d="M256 107c83 0 149 66 149 149s-66 149 -149 149s-149 -66 -149 -149s66 -149 149 -149zM447 277h44v-42h-44c-10 -89 -81 -160 -170 -170v-44h-42v44c-89 10 -160 81 -170 170h-44v42h44c10 89 81 160 170 170v44h42v-44c89 -10 160 -81 170 -170z" />
-    <glyph glyph-name="gps_off" unicode="gps_off" 
-d="M347 138l-209 209c-19 -25 -31 -57 -31 -91c0 -83 66 -149 149 -149c34 0 66 12 91 31zM64 421l27 27l357 -357l-27 -27l-44 44c-28 -23 -62 -39 -100 -43v-44h-42v44c-89 10 -160 81 -170 170h-44v42h44c4 38 20 72 43 100zM447 277h44v-42h-44c-3 -24 -10 -48 -21 -68
-l-32 32c7 17 11 37 11 57c0 83 -66 149 -149 149c-20 0 -40 -4 -57 -11l-32 32c21 11 44 18 68 21v44h42v-44c89 -10 160 -81 170 -170z" />
-    <glyph glyph-name="grade" unicode="grade" 
-d="M256 144l-132 -80l35 150l-116 101l153 13l60 141l60 -141l153 -13l-116 -101l35 -150z" />
-    <glyph glyph-name="gradient" unicode="gradient" 
-d="M405 277v128h-298v-128h42v-42h43v-43h43v43h42v-43h43v43h43v42h42zM363 128v43h-43v-43h43zM277 128v43h-42v-43h42zM192 128v43h-43v-43h43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298zM149 320h43
-v-43h-43v43zM320 320h43v-43h-43v43zM235 320h42v-43h43v-42h-43v42h-42v-42h-43v42h43v43zM363 235v-43h42v43h-42zM149 235h-42v-43h42v43z" />
-    <glyph glyph-name="grain" unicode="grain" 
-d="M213 427c23 0 43 -20 43 -43s-20 -43 -43 -43s-42 20 -42 43s19 43 42 43zM299 341c23 0 42 -19 42 -42s-19 -43 -42 -43s-43 20 -43 43s20 42 43 42zM384 256c23 0 43 -20 43 -43s-20 -42 -43 -42s-43 19 -43 42s20 43 43 43zM299 171c23 0 42 -20 42 -43
-s-19 -43 -42 -43s-43 20 -43 43s20 43 43 43zM384 341c-23 0 -43 20 -43 43s20 43 43 43s43 -20 43 -43s-20 -43 -43 -43zM128 171c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM128 341c23 0 43 -19 43 -42s-20 -43 -43 -43s-43 20 -43 43s20 42 43 42z
-M213 256c23 0 43 -20 43 -43s-20 -42 -43 -42s-42 19 -42 42s19 43 42 43z" />
-    <glyph glyph-name="graphic_eq" unicode="graphic_eq" 
-d="M405 299h43v-86h-43v86zM320 128v256h43v-256h-43zM64 213v86h43v-86h-43zM235 43v426h42v-426h-42zM149 128v256h43v-256h-43z" />
-    <glyph glyph-name="grid_off" unicode="grid_off" 
-d="M341 85h31l-31 31v-31zM299 85v74l-12 12h-74v-86h86zM171 213v74l-12 12h-74v-86h86zM171 85v86h-86v-86h86zM85 372v-31h31zM213 244v-31h31zM27 485l458 -458l-27 -27l-43 43h-330c-23 0 -42 19 -42 42v330l-43 43zM341 427v-86h86v86h-86zM171 427h-31l-43 42h330
-c23 0 42 -19 42 -42v-330l-42 43v31h-31l-43 42h74v86h-86v-74l-42 43v31h-31l-43 42h74v86h-86v-74l-42 43v31z" />
-    <glyph glyph-name="grid_on" unicode="grid_on" 
-d="M427 341v86h-86v-86h86zM427 213v86h-86v-86h86zM427 85v86h-86v-86h86zM299 341v86h-86v-86h86zM299 213v86h-86v-86h86zM299 85v86h-86v-86h86zM171 341v86h-86v-86h86zM171 213v86h-86v-86h86zM171 85v86h-86v-86h86zM427 469c23 0 42 -19 42 -42v-342
-c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v342c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="group" unicode="group" 
-d="M341 235c50 0 150 -25 150 -75v-53h-128v53c0 32 -17 56 -42 74c7 1 14 1 20 1zM171 235c50 0 149 -25 149 -75v-53h-299v53c0 50 100 75 150 75zM171 277c-35 0 -64 29 -64 64s29 64 64 64s63 -29 63 -64s-28 -64 -63 -64zM341 277c-35 0 -64 29 -64 64s29 64 64 64
-s64 -29 64 -64s-29 -64 -64 -64z" />
-    <glyph glyph-name="group_add" unicode="group_add" 
-d="M277 235c43 0 128 -21 128 -64v-43h-256v43c0 43 85 64 128 64zM419 231c43 -7 93 -27 93 -60v-43h-64v43c0 25 -11 44 -29 60zM277 277c-35 0 -64 29 -64 64s29 64 64 64s64 -29 64 -64s-29 -64 -64 -64zM384 277c-7 0 -13 1 -19 3c12 17 19 38 19 61s-7 44 -19 61
-c6 2 12 3 19 3c35 0 64 -29 64 -64s-29 -64 -64 -64zM171 299v-43h-64v-64h-43v64h-64v43h64v64h43v-64h64z" />
-    <glyph glyph-name="group_work" unicode="group_work" 
-d="M341 139c29 0 54 24 54 53s-25 53 -54 53s-53 -24 -53 -53s24 -53 53 -53zM203 341c0 -29 24 -53 53 -53s53 24 53 53s-24 54 -53 54s-53 -25 -53 -54zM171 139c29 0 53 24 53 53s-24 53 -53 53s-54 -24 -54 -53s25 -53 54 -53zM256 469c118 0 213 -95 213 -213
-s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="hd" unicode="hd" 
-d="M309 224v64h43v-64h-43zM277 320v-128h86c12 0 21 9 21 21v86c0 12 -9 21 -21 21h-86zM235 192v128h-32v-53h-43v53h-32v-128h32v43h43v-43h32zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="hdr_off" unicode="hdr_off" 
-d="M53 459c135.424 -135.909 271.816 -270.85 408 -406l-24 -23l-162 162h-72v73l-32 32v-105h-32v53h-43v-53h-32v128h32v-43h43v43h8l-117 117zM277 288h-8l-32 32h40c17 0 32 -15 32 -32v-41l-32 32v9zM373 288v-21h43v21h-43zM373 192h-8l-24 23v105h75
-c17 0 32 -15 32 -32v-21c0 -13 -8 -26 -19 -30l19 -45h-32l-19 43h-24v-43z" />
-    <glyph glyph-name="hdr_on" unicode="hdr_on" 
-d="M277 224v64h-42v-64h42zM277 320c17 0 32 -15 32 -32v-64c0 -17 -15 -32 -32 -32h-74v128h74zM139 277v43h32v-128h-32v53h-43v-53h-32v128h32v-43h43zM416 267v21h-43v-21h43zM448 267c0 -13 -8 -24 -19 -30l19 -45h-32l-19 43h-24v-43h-32v128h75c17 0 32 -15 32 -32
-v-21z" />
-    <glyph glyph-name="hdr_strong" unicode="hdr_strong" 
-d="M107 213c23 0 42 20 42 43s-19 43 -42 43s-43 -20 -43 -43s20 -43 43 -43zM107 341c47 0 85 -38 85 -85s-38 -85 -85 -85s-86 38 -86 85s39 85 86 85zM363 384c71 0 128 -57 128 -128s-57 -128 -128 -128s-128 57 -128 128s57 128 128 128z" />
-    <glyph glyph-name="hdr_weak" unicode="hdr_weak" 
-d="M363 171c47 0 85 38 85 85s-38 85 -85 85s-86 -38 -86 -85s39 -85 86 -85zM363 384c71 0 128 -57 128 -128s-57 -128 -128 -128s-128 57 -128 128s57 128 128 128zM107 341c47 0 85 -38 85 -85s-38 -85 -85 -85s-86 38 -86 85s39 85 86 85z" />
-    <glyph glyph-name="headset" unicode="headset" 
-d="M256 491c106 0 192 -86 192 -192v-150c0 -35 -29 -64 -64 -64h-64v171h85v43c0 83 -66 149 -149 149s-149 -66 -149 -149v-43h85v-171h-64c-35 0 -64 29 -64 64v150c0 106 86 192 192 192z" />
-    <glyph glyph-name="headset_mic" unicode="headset_mic" 
-d="M256 491c106 0 192 -86 192 -192v-214c0 -35 -29 -64 -64 -64h-128v43h149v21h-85v171h85v43c0 83 -66 149 -149 149s-149 -66 -149 -149v-43h85v-171h-64c-35 0 -64 29 -64 64v150c0 106 86 192 192 192z" />
-    <glyph glyph-name="healing" unicode="healing" 
-d="M355 78l78 78l-78 77l-77 -78zM299 277c-12 0 -22 -9 -22 -21s10 -21 22 -21s21 9 21 21s-9 21 -21 21zM256 192c12 0 21 9 21 21s-9 22 -21 22s-21 -10 -21 -22s9 -21 21 -21zM213 235c12 0 22 9 22 21s-10 21 -22 21s-21 -9 -21 -21s9 -21 21 -21zM156 278l77 78
-l-77 77l-78 -78zM256 320c-12 0 -21 -9 -21 -21s9 -22 21 -22s21 10 21 22s-9 21 -21 21zM378 256l85 -85c8 -8 8 -22 0 -30l-92 -93c-4 -4 -9 -6 -15 -6s-12 2 -16 6l-84 85l-85 -85c-8 -8 -22 -8 -30 0l-93 93c-8 8 -8 22 0 30l85 85l-85 84c-8 8 -8 23 0 31l93 92
-c4 4 10 6 15 6c6 0 11 -2 15 -6l85 -85l84 85c8 8 23 8 31 0l92 -92c8 -8 8 -23 0 -31z" />
-    <glyph glyph-name="hearing" unicode="hearing" 
-d="M245 320c0 29 25 53 54 53s53 -24 53 -53s-24 -53 -53 -53s-54 24 -54 53zM163 456c-35 -35 -56 -83 -56 -136s21 -101 56 -136l-30 -30c-42 42 -69 101 -69 166s27 124 69 166zM363 85c23 0 42 20 42 43h43c0 -47 -38 -85 -85 -85c-12 0 -24 2 -35 7
-c-29 15 -46 37 -59 76c-7 21 -19 31 -36 44c-19 14 -42 32 -61 67c-15 27 -23 56 -23 83c0 84 66 149 150 149s149 -65 149 -149h-43c0 60 -46 107 -106 107s-107 -47 -107 -107c0 -20 6 -43 17 -63c15 -28 33 -41 50 -54c20 -15 40 -31 51 -64c11 -32 21 -42 36 -50
-c4 -2 11 -4 17 -4z" />
-    <glyph glyph-name="help" unicode="help" 
-d="M321 272c12 12 20 29 20 48c0 47 -38 85 -85 85s-85 -38 -85 -85h42c0 23 20 43 43 43s43 -20 43 -43c0 -12 -5 -22 -13 -30l-26 -27c-15 -16 -25 -37 -25 -60v-11h42c0 32 10 44 25 60zM277 107v42h-42v-42h42zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213
-s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="help_outline" unicode="help_outline" 
-d="M256 384c47 0 85 -38 85 -85c0 -53 -64 -59 -64 -107h-42c0 69 64 64 64 107c0 23 -20 42 -43 42s-43 -19 -43 -42h-42c0 47 38 85 85 85zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213
-s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM235 128v43h42v-43h-42z" />
-    <glyph glyph-name="high_quality" unicode="high_quality" 
-d="M309 224v64h43v-64h-43zM384 213v86c0 12 -9 21 -21 21h-64c-12 0 -22 -9 -22 -21v-86c0 -12 10 -21 22 -21h16v-32h32v32h16c12 0 21 9 21 21zM235 192v128h-32v-53h-43v53h-32v-128h32v43h43v-43h32zM405 427c23 0 43 -20 43 -43v-256c0 -23 -20 -43 -43 -43h-298
-c-24 0 -43 20 -43 43v256c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="highlight" unicode="highlight" 
-d="M362 372l45 45l30 -30l-45 -46zM75 387l30 30l45 -45l-30 -31zM235 469h42v-64h-42v64zM128 213v107h256v-107l-64 -64v-106h-128v106z" />
-    <glyph glyph-name="highlight_off" unicode="highlight_off" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM311 341l30 -30l-55 -55l55 -55l-30 -30l-55 55l-55 -55l-30 30l55 55l-55 55l30 30l55 -55z
-" />
-    <glyph glyph-name="history" unicode="history" 
-d="M256 341h32v-90l75 -45l-16 -26l-91 55v106zM277 448c106 0 192 -86 192 -192s-86 -192 -192 -192c-53 0 -100 21 -135 56l30 31c27 -27 64 -44 105 -44c83 0 150 66 150 149s-67 149 -150 149s-149 -66 -149 -149h64l-86 -86l-2 3l-83 83h64c0 106 86 192 192 192z" />
-    <glyph glyph-name="home" unicode="home" 
-d="M213 85h-106v171h-64l213 192l213 -192h-64v-171h-106v128h-86v-128z" />
-    <glyph glyph-name="hot_tub" unicode="hot_tub" 
-d="M313 387c22 -21 31 -50 27 -79l-1 -9h-41l3 12c3.05626 17.3188 -3.40602 35.406 -16 48c-22 22 -32 51 -28 80l1 9h41l-2 -13c-3 -17 2 -34 14 -47zM398 387c22 -21 32 -50 28 -79l-2 -9h-40l2 12c3 17 -2 34 -14 47l-2 1c-22 22 -32 51 -28 80l2 9h40l-2 -13
-c-3 -17 2 -34 14 -47zM405 85v128h-42v-128h42zM320 85v128h-43v-128h43zM235 85v128h-43v-128h43zM149 85v128h-42v-128h42zM238 256h231v-171c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v171h64v16c0 26 22 48 48 48c15.3845 0 28.1542 -8.15417 36 -16l29 -33
-c5 -6 11 -10 18 -15zM107 384c0 24 18 43 42 43s43 -19 43 -43s-19 -43 -43 -43s-42 19 -42 43z" />
-    <glyph glyph-name="hotel" unicode="hotel" 
-d="M405 363c47 0 86 -39 86 -86v-192h-43v64h-384v-64h-43v320h43v-192h171v150h170zM149 235c-35 0 -64 29 -64 64s29 64 64 64s64 -29 64 -64s-29 -64 -64 -64z" />
-    <glyph glyph-name="hourglass_empty" unicode="hourglass_empty" 
-d="M256 267l85 85v75h-170v-75zM341 160l-85 85l-85 -85v-75h170v75zM128 469h256v-128l-85 -85l85 -85v-128h-256v128l85 85l-85 85v128z" />
-    <glyph glyph-name="hourglass_full" unicode="hourglass_full" 
-d="M128 469h256v-128l-85 -85l85 -85v-128h-256v128l85 85l-85 85v128z" />
-    <glyph glyph-name="http" unicode="http" 
-d="M459 267v21h-43v-21h43zM459 320c17 0 32 -15 32 -32v-21c0 -17 -15 -32 -32 -32h-43v-43h-32v128h75zM267 288v32h96v-32h-32v-96h-32v96h-32zM149 288v32h96v-32h-32v-96h-32v96h-32zM96 277v43h32v-128h-32v53h-43v-53h-32v128h32v-43h43z" />
-    <glyph glyph-name="https" unicode="https" 
-d="M322 341v43c0 36 -30 66 -66 66s-66 -30 -66 -66v-43h132zM256 149c23 0 43 20 43 43s-20 43 -43 43s-43 -20 -43 -43s20 -43 43 -43zM384 341c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h21v43c0 59 48 107 107 107
-s107 -48 107 -107v-43h21z" />
-    <glyph glyph-name="image" unicode="image" 
-d="M181 224l-74 -96h298l-96 128l-74 -96zM448 107c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298c23 0 43 -20 43 -43v-298z" />
-    <glyph glyph-name="image_aspect_ratio" unicode="image_aspect_ratio" 
-d="M427 128v256h-342v-256h342zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342zM256 299v-43h-43v43h43zM171 299v-43h-43v43h43zM341 213v-42h-42v42h42zM341 299v-43h-42v43h42z" />
-    <glyph glyph-name="import_contacts" unicode="import_contacts" 
-d="M448 117v246c-23 7 -49 10 -75 10c-36 0 -88 -14 -117 -32v-245c29 18 81 32 117 32c26 0 52 -4 75 -11zM373 416c44.2046 0 90.7488 -11.0375 118 -32v-311c0 -5 -6 -11 -11 -11c-2 0 -3 0 -5 1c-30 16 -67 22 -102 22c-36 0 -88 -14 -117 -32c-31 23 -75 32 -117 32
-c-31 0 -73 -9 -102 -23c-2 0 -3 -1 -5 -1c-5 0 -11 5 -11 10v313c31 23 76 32 118 32s86 -9 117 -32c31 23 75 32 117 32z" />
-    <glyph glyph-name="import_export" unicode="import_export" 
-d="M341 149h64l-85 -85l-85 85h64v150h42v-150zM192 448l85 -85h-64v-150h-42v150h-64z" />
-    <glyph glyph-name="important_devices" unicode="important_devices" 
-d="M255 320h65l-53 -38l20 -62l-52 39l-53 -39l20 62l-53 38h65l21 64zM427 469c23 0 42 -18 42 -42v-107h-42v107h-384v-256h277v-43h-43v-43h43v-42h-171v42h43v43h-149c-24 0 -43 20 -43 43v256c0 24 19 42 43 42h384zM491 85v150h-107v-150h107zM491 277
-c12 0 21 -9 21 -21v-192c0 -12 -9 -21 -21 -21h-107c-12 0 -21 9 -21 21v192c0 12 9 21 21 21h107z" />
-    <glyph glyph-name="inbox" unicode="inbox" 
-d="M405 192v213h-299v-213h86c0 -35 29 -64 64 -64s64 29 64 64h85zM405 448c23 0 43 -19 43 -43v-298c0 -23 -20 -43 -43 -43h-299c-24 0 -42 20 -42 43v298c0 24 18 43 42 43h299z" />
-    <glyph glyph-name="indeterminate_check_box" unicode="indeterminate_check_box" 
-d="M363 235v42h-214v-42h214zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="info" unicode="info" 
-d="M277 320v43h-42v-43h42zM277 149v128h-42v-128h42zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="info_outline" unicode="info_outline" 
-d="M235 320v43h42v-43h-42zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM235 149v128h42v-128h-42z" />
-    <glyph glyph-name="input" unicode="input" 
-d="M235 171v64h-214v42h214v64l85 -85zM448 448c23 0 43 -19 43 -43v-299c0 -23 -20 -42 -43 -42h-384c-23 0 -43 19 -43 42v86h43v-86h384v300h-384v-86h-43v85c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="insert_chart" unicode="insert_chart" 
-d="M363 149v86h-43v-86h43zM277 149v214h-42v-214h42zM192 149v150h-43v-150h43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="insert_comment" unicode="insert_comment" 
-d="M384 341v43h-256v-43h256zM384 277v43h-256v-43h256zM384 213v43h-256v-43h256zM427 469c23 0 42 -19 42 -42v-384l-85 85h-299c-23 0 -42 20 -42 43v256c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="insert_drive_file" unicode="insert_drive_file" 
-d="M277 320h118l-118 117v-117zM128 469h171l128 -128v-256c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42l1 342c0 23 19 42 42 42z" />
-    <glyph glyph-name="insert_emoticon" unicode="insert_emoticon" 
-d="M256 139c-50 0 -92 30 -109 74h218c-17 -44 -59 -74 -109 -74zM181 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM331 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM256 85c94 0 171 77 171 171s-77 171 -171 171
-s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="insert_invitation" unicode="insert_invitation" 
-d="M405 107v234h-298v-234h298zM341 491h43v-43h21c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43zM363 256v-107h-107v107h107z" />
-    <glyph glyph-name="insert_link" unicode="insert_link" 
-d="M363 363c59 0 106 -48 106 -107s-47 -107 -106 -107h-86v41h86c36 0 66 30 66 66s-30 66 -66 66h-86v41h86zM171 235v42h170v-42h-170zM83 256c0 -36 30 -66 66 -66h86v-41h-86c-59 0 -106 48 -106 107s47 107 106 107h86v-41h-86c-36 0 -66 -30 -66 -66z" />
-    <glyph glyph-name="insert_photo" unicode="insert_photo" 
-d="M181 224l-74 -96h298l-96 128l-74 -96zM448 107c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298c23 0 43 -20 43 -43v-298z" />
-    <glyph glyph-name="invert_colors" unicode="invert_colors" 
-d="M256 94v309l-90 -90c-24 -24 -38 -57 -38 -91c0 -68.7916 59.1998 -128 128 -128zM377 343c67 -67 67 -174 0 -241c-33 -33 -77 -50 -121 -50s-88 17 -121 50c-67 67 -67 174 0 241l121 121z" />
-    <glyph glyph-name="invert_colors_off" unicode="invert_colors_off" 
-d="M256 403l-49 -48l-30 30l79 79l121 -121c52 -52 63 -129 34 -192l-155 154v98zM256 94v103l-102 102c-17 -22 -26 -49 -26 -77c0 -68.7916 59.1998 -128 128 -128zM441 67l7 -8l-27 -27l-58 58c-31 -25 -69 -38 -107 -38c-44 0 -88 17 -121 50c-62 63 -66 161 -12 228
-l-59 59l27 27c116.495 -116.495 232.353 -233.66 350 -349z" />
-    <glyph glyph-name="iso" unicode="iso" 
-d="M363 149h-107v32h107v-32zM405 107v298l-298 -298h298zM117 352v-32h43v-43h32v43h43v32h-43v43h-32v-43h-43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="keyboard" unicode="keyboard" 
-d="M405 299v42h-42v-42h42zM405 235v42h-42v-42h42zM341 299v42h-42v-42h42zM341 235v42h-42v-42h42zM341 149v43h-170v-43h170zM149 299v42h-42v-42h42zM149 235v42h-42v-42h42zM171 277v-42h42v42h-42zM171 341v-42h42v42h-42zM235 277v-42h42v42h-42zM235 341v-42h42v42
-h-42zM427 405c23 0 42 -19 42 -42v-214c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v214c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="keyboard_arrow_down" unicode="keyboard_arrow_down" 
-d="M158 345l98 -98l98 98l30 -30l-128 -128l-128 128z" />
-    <glyph glyph-name="keyboard_arrow_left" unicode="keyboard_arrow_left" 
-d="M329 169l-30 -30l-128 128l128 128l30 -30l-98 -98z" />
-    <glyph glyph-name="keyboard_arrow_right" unicode="keyboard_arrow_right" 
-d="M183 163l98 98l-98 98l30 30l128 -128l-128 -128z" />
-    <glyph glyph-name="keyboard_arrow_up" unicode="keyboard_arrow_up" 
-d="M158 183l-30 30l128 128l128 -128l-30 -30l-98 98z" />
-    <glyph glyph-name="keyboard_backspace" unicode="keyboard_backspace" 
-d="M448 277v-42h-302l76 -77l-30 -30l-128 128l128 128l30 -30l-76 -77h302z" />
-    <glyph glyph-name="keyboard_capslock" unicode="keyboard_capslock" 
-d="M128 128v43h256v-43h-256zM256 333l-98 -98l-30 30l128 128l128 -128l-30 -30z" />
-    <glyph glyph-name="keyboard_hide" unicode="keyboard_hide" 
-d="M256 21l-85 86h170zM405 341v43h-42v-43h42zM405 277v43h-42v-43h42zM341 341v43h-42v-43h42zM341 277v43h-42v-43h42zM341 192v43h-170v-43h170zM149 341v43h-42v-43h42zM149 277v43h-42v-43h42zM171 320v-43h42v43h-42zM171 384v-43h42v43h-42zM235 320v-43h42v43h-42z
-M235 384v-43h42v43h-42zM427 448c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v213c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="keyboard_return" unicode="keyboard_return" 
-d="M405 363h43v-128h-324l77 -77l-30 -30l-128 128l128 128l30 -30l-77 -77h281v86z" />
-    <glyph glyph-name="keyboard_tab" unicode="keyboard_tab" 
-d="M427 384h42v-256h-42v256zM247 354l30 30l128 -128l-128 -128l-30 30l77 77h-303v42h303z" />
-    <glyph glyph-name="keyboard_voice" unicode="keyboard_voice" 
-d="M369 256h36c0 -73 -58 -133 -128 -143v-70h-42v70c-70 10 -128 70 -128 143h36c0 -64 54 -109 113 -109s113 45 113 109zM256 192c-35 0 -64 29 -64 64v128c0 35 29 64 64 64s64 -29 64 -64v-128c0 -35 -29 -64 -64 -64z" />
-    <glyph glyph-name="kitchen" unicode="kitchen" 
-d="M171 256h42v-107h-42v107zM171 405h42v-64h-42v64zM384 320v107h-256v-107h256zM384 85v193h-256v-193h256zM384 469c23 0 43 -18 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v342c0 24 20 42 43 42h256z" />
-    <glyph glyph-name="label" unicode="label" 
-d="M376 387l93 -131l-93 -131c-8 -11 -21 -18 -35 -18h-234c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h234c14 0 27 -7 35 -18z" />
-    <glyph glyph-name="label_outline" unicode="label_outline" 
-d="M341 149l76 107l-76 107h-234v-214h234zM376 387l93 -131l-93 -131c-8 -11 -21 -18 -35 -18h-234c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h234c14 0 27 -7 35 -18z" />
-    <glyph glyph-name="landscape" unicode="landscape" 
-d="M299 384l192 -256h-470l128 171l96 -128l34 25l-60 81z" />
-    <glyph glyph-name="language" unicode="language" 
-d="M349 213h72c3 14 6 28 6 43s-3 29 -6 43h-72c2 -14 3 -28 3 -43s-1 -29 -3 -43zM311 95c39 13 73 41 93 76h-63c-7 -27 -17 -52 -30 -76zM306 213c2 14 3 28 3 43s-1 29 -3 43h-100c-2 -14 -3 -28 -3 -43s1 -29 3 -43h100zM256 86c18 26 32 54 41 85h-82
-c9 -31 23 -59 41 -85zM171 341c7 27 17 52 30 76c-39 -13 -73 -41 -93 -76h63zM108 171c20 -35 54 -63 93 -76c-13 24 -23 49 -30 76h-63zM91 213h72c-2 14 -3 28 -3 43s1 29 3 43h-72c-3 -14 -6 -28 -6 -43s3 -29 6 -43zM256 426c-18 -26 -32 -54 -41 -85h82
-c-9 31 -23 59 -41 85zM404 341c-20 35 -54 63 -93 76c13 -24 23 -49 30 -76h63zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="laptop" unicode="laptop" 
-d="M85 384v-213h342v213h-342zM427 128h85v-43h-512v43h85c-23 0 -42 20 -42 43v213c0 23 19 43 42 43h342c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43z" />
-    <glyph glyph-name="laptop_chromebook" unicode="laptop_chromebook" 
-d="M427 192v213h-342v-213h342zM299 128v21h-86v-21h86zM469 128h43v-43h-512v43h43v320h426v-320z" />
-    <glyph glyph-name="laptop_mac" unicode="laptop_mac" 
-d="M256 107c12 0 21 9 21 21s-9 21 -21 21s-21 -9 -21 -21s9 -21 21 -21zM85 405v-234h342v234h-342zM427 128h85c0 -23 -20 -43 -43 -43h-426c-23 0 -43 20 -43 43h85c-23 0 -42 20 -42 43v234c0 23 19 43 42 43h342c23 0 42 -20 42 -43v-234c0 -23 -19 -43 -42 -43z" />
-    <glyph glyph-name="laptop_windows" unicode="laptop_windows" 
-d="M85 405v-213h342v213h-342zM427 128h85v-43h-512v43h85v21c-23 0 -42 20 -42 43v213c0 23 19 43 42 43h342c23 0 42 -20 42 -43v-213c0 -23 -19 -43 -42 -43v-21z" />
-    <glyph glyph-name="last_page" unicode="last_page" 
-d="M341 384h43v-256h-43v256zM119 354l30 30l128 -128l-128 -128l-30 30l98 98z" />
-    <glyph glyph-name="launch" unicode="launch" 
-d="M299 448h149v-149h-43v76l-209 -209l-30 30l209 209h-76v43zM405 107v149h43v-149c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h149v-43h-149v-298h298z" />
-    <glyph glyph-name="layers" unicode="layers" 
-d="M256 171c-64.012 49.6547 -127.813 99.5201 -192 149l192 149l192 -149c-64.1875 -49.4791 -127.987 -99.3464 -192 -149zM256 116l157 123l35 -27l-192 -149l-192 149l35 27z" />
-    <glyph glyph-name="layers_clear" unicode="layers_clear" 
-d="M70 491l399 -400l-27 -27l-80 81l-106 -82l-192 149l35 27l157 -123l75 59l-30 30l-45 -34c-64.012 49.6547 -127.813 99.5201 -192 149l69 54l-90 90zM448 320c-28.8803 -22.1197 -57.4315 -44.5685 -86 -67l-168 168l62 48zM423 192l-31 31l25 19l31 -30z" />
-    <glyph glyph-name="leak_add" unicode="leak_add" 
-d="M299 64c0 83 66 149 149 149v-42c-59 0 -107 -48 -107 -107h-42zM384 64c0 35 29 64 64 64v-64h-64zM213 64c0 129 106 235 235 235v-43c-106 0 -192 -86 -192 -192h-43zM213 448c0 -83 -66 -149 -149 -149v42c59 0 107 48 107 107h42zM299 448
-c0 -129 -105 -235 -235 -235v43c106 0 192 86 192 192h43zM128 448c0 -35 -29 -64 -64 -64v64h64z" />
-    <glyph glyph-name="leak_remove" unicode="leak_remove" 
-d="M328 265c35 21 76 34 120 34v-43c-32 0 -62 -8 -89 -22zM425 168l-34 34c17 7 37 11 57 11v-42c-8 0 -16 -1 -23 -3zM299 448c0 -44 -13 -85 -34 -120l-31 31c14 27 22 57 22 89h43zM64 421l27 27l357 -357l-27 -27l-61 61c-12 -17 -19 -38 -19 -61h-42c0 34 12 66 31 91
-l-31 30c-27 -33 -43 -75 -43 -121h-43c0 58 21 111 56 152l-53 53c-41 -35 -94 -56 -152 -56v43c46 0 89 16 122 43l-31 31c-25 -19 -57 -31 -91 -31v42c23 0 44 7 61 19zM213 448c0 -20 -4 -40 -11 -57l-34 34c2 7 3 15 3 23h42z" />
-    <glyph glyph-name="lens" unicode="lens" 
-d="M256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="library_add" unicode="library_add" 
-d="M405 277v43h-85v85h-43v-85h-85v-43h85v-85h43v85h85zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42z" />
-    <glyph glyph-name="library_books" unicode="library_books" 
-d="M405 363v42h-213v-42h213zM320 192v43h-128v-43h128zM405 277v43h-213v-43h213zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42z" />
-    <glyph glyph-name="library_music" unicode="library_music" 
-d="M85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42zM384 363v42h-85v-117c-9 7 -20 11 -32 11c-29 0 -54 -25 -54 -54s25 -53 54 -53s53 24 53 53v118h64zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42
-h256z" />
-    <glyph glyph-name="lightbulb_outline" unicode="lightbulb_outline" 
-d="M317 233c29 20 46 52 46 87c0 59 -48 107 -107 107s-107 -48 -107 -107c0 -35 17 -67 46 -87l18 -13v-49h86v49zM256 469c82 0 149 -67 149 -149c0 -51 -25 -95 -64 -122v-49c0 -12 -9 -21 -21 -21h-128c-12 0 -21 9 -21 21v49c-39 27 -64 71 -64 122
-c0 82 67 149 149 149zM192 64v21h128v-21c0 -12 -9 -21 -21 -21h-86c-12 0 -21 9 -21 21z" />
-    <glyph glyph-name="line_style" unicode="line_style" 
-d="M64 427h384v-86h-384v86zM277 256v43h171v-43h-171zM64 256v43h171v-43h-171zM405 85v43h43v-43h-43zM320 85v43h43v-43h-43zM235 85v43h42v-43h-42zM149 85v43h43v-43h-43zM64 85v43h43v-43h-43zM341 171v42h107v-42h-107zM203 171v42h106v-42h-106zM64 171v42h107v-42
-h-107z" />
-    <glyph glyph-name="line_weight" unicode="line_weight" 
-d="M64 427h384v-86h-384v86zM64 235v64h384v-64h-384zM64 85v22h384v-22h-384zM64 149v43h384v-43h-384z" />
-    <glyph glyph-name="linear_scale" unicode="linear_scale" 
-d="M416 309c29 0 53 -24 53 -53s-24 -53 -53 -53c-22 0 -41 13 -49 32h-62c-8 -19 -27 -32 -49 -32s-41 13 -49 32h-62c-8 -19 -27 -32 -49 -32c-29 0 -53 24 -53 53s24 53 53 53c22 0 41 -13 49 -32h62c8 19 27 32 49 32s41 -13 49 -32h62c8 19 27 32 49 32z" />
-    <glyph glyph-name="link" unicode="link" 
-d="M363 363c59 0 106 -48 106 -107s-47 -107 -106 -107h-86v41h86c36 0 66 30 66 66s-30 66 -66 66h-86v41h86zM171 235v42h170v-42h-170zM83 256c0 -36 30 -66 66 -66h86v-41h-86c-59 0 -106 48 -106 107s47 107 106 107h86v-41h-86c-36 0 -66 -30 -66 -66z" />
-    <glyph glyph-name="linked_camera" unicode="linked_camera" 
-d="M341 384c24 0 43 -19 43 -43h28c0 39 -32 71 -71 71v-28zM256 107c59 0 107 47 107 106s-48 107 -107 107s-107 -48 -107 -107s48 -106 107 -106zM363 320h106v-235c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v256c0 23 19 43 42 43h68l39 43h128v-64
-c24 0 43 -19 43 -43zM341 441v28c71 0 128 -57 128 -128h-28c0 55 -45 100 -100 100zM188 213c0 38 30 69 68 69s68 -31 68 -69s-30 -68 -68 -68s-68 30 -68 68z" />
-    <glyph glyph-name="list" unicode="list" 
-d="M149 363h299v-43h-299v43zM149 149v43h299v-43h-299zM149 235v42h299v-42h-299zM64 320v43h43v-43h-43zM64 149v43h43v-43h-43zM64 235v42h43v-42h-43z" />
-    <glyph glyph-name="live_help" unicode="live_help" 
-d="M321 293c12 12 20 29 20 48c0 47 -38 86 -85 86s-85 -39 -85 -86h42c0 23 20 43 43 43s43 -20 43 -43c0 -12 -5 -22 -13 -30l-26 -27c-15 -16 -25 -37 -25 -60v-11h42c0 32 10 45 25 61zM277 128v43h-42v-43h42zM405 469c23 0 43 -19 43 -42v-299c0 -23 -20 -43 -43 -43
-h-85l-64 -64l-64 64h-85c-24 0 -43 20 -43 43v299c0 23 19 42 43 42h298z" />
-    <glyph glyph-name="live_tv" unicode="live_tv" 
-d="M192 299l149 -86l-149 -85v171zM448 85v256h-384v-256h384zM448 384c23 0 43 -19 43 -43v-256c0 -23 -20 -42 -43 -42h-384c-23 0 -43 19 -43 42v256c0 24 20 43 43 43h162l-70 70l15 15l85 -85l85 85l15 -15l-70 -70h162z" />
-    <glyph glyph-name="local_activity" unicode="local_activity" 
-d="M332 154l-23 87l70 58l-90 5l-33 84l-33 -84l-91 -5l71 -58l-23 -87l76 49zM427 256c0 -23 19 -43 42 -43v-85c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v85c24 0 42 20 42 43s-19 43 -42 43v85c0 23 19 43 42 43h342c23 0 42 -20 42 -43v-85
-c-23 0 -42 -20 -42 -43z" />
-    <glyph glyph-name="local_airport" unicode="local_airport" 
-d="M448 171l-171 53v-117l43 -32v-32l-75 21l-74 -21v32l42 32v117l-170 -53v42l170 107v117c0 18 14 32 32 32s32 -14 32 -32v-117l171 -107v-42z" />
-    <glyph glyph-name="local_atm" unicode="local_atm" 
-d="M427 128v256h-342v-256h342zM427 427c24 0 42 -19 42 -43v-256c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v256c0 24 18 43 42 43h342zM235 149v22h-43v42h85v22h-64c-12 0 -21 9 -21 21v64c0 12 9 21 21 21h22v22h42v-22h43v-42h-85v-22h64c12 0 21 -9 21 -21v-64
-c0 -12 -9 -21 -21 -21h-22v-22h-42z" />
-    <glyph glyph-name="local_bar" unicode="local_bar" 
-d="M159 363h194l38 42h-270zM448 405l-171 -192v-106h107v-43h-256v43h107v106l-171 192v43h384v-43z" />
-    <glyph glyph-name="local_cafe" unicode="local_cafe" 
-d="M43 64v43h384v-43h-384zM427 341v64h-43v-64h43zM427 448c24 0 42 -19 42 -43v-64c0 -24 -18 -42 -42 -42h-43v-64c0 -47 -38 -86 -85 -86h-128c-47 0 -86 39 -86 86v213h342z" />
-    <glyph glyph-name="local_car_wash" unicode="local_car_wash" 
-d="M107 235h298l-32 96h-234zM373 128c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 128c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM404 341l44 -128v-170c0 -12 -9 -22 -21 -22h-22c-12 0 -21 10 -21 22v21h-256v-21
-c0 -12 -9 -22 -21 -22h-22c-12 0 -21 10 -21 22v170l44 128c4 13 17 22 31 22h234c14 0 27 -9 31 -22zM149 405c-18 0 -32 14 -32 32c0 21 32 58 32 58s32 -37 32 -58c0 -18 -14 -32 -32 -32zM256 405c-18 0 -32 14 -32 32c0 21 32 58 32 58s32 -37 32 -58
-c0 -18 -14 -32 -32 -32zM363 405c-18 0 -32 14 -32 32c0 21 32 58 32 58s32 -37 32 -58c0 -18 -14 -32 -32 -32z" />
-    <glyph glyph-name="local_convenience_store" unicode="local_convenience_store" 
-d="M341 256v107h-21v-43h-21v43h-22v-64h43v-43h21zM235 299v64h-64v-22h42v-21h-42v-64h64v21h-43v22h43zM405 363h64v-278h-170v86h-86v-86h-170v278h64v64h298v-64z" />
-    <glyph glyph-name="local_dining" unicode="local_dining" 
-d="M317 266l-31 -31l147 -147l-30 -30l-147 147l-147 -147l-30 30l208 208c-15 33 -4 79 30 113c41 41 99 48 130 17s24 -90 -17 -131c-34 -34 -80 -44 -113 -29zM173 227l-90 90c-33 33 -33 87 0 120l150 -149z" />
-    <glyph glyph-name="local_drink" unicode="local_drink" 
-d="M391 341l9 86h-288l9 -86h270zM256 107c35 0 64 29 64 64c0 43 -64 115 -64 115s-64 -72 -64 -115c0 -35 29 -64 64 -64zM64 469h384l-43 -389c-3 -21 -20 -37 -42 -37h-214c-22 0 -39 16 -42 37z" />
-    <glyph glyph-name="local_florist" unicode="local_florist" 
-d="M256 395c-29 0 -53 -25 -53 -54s24 -53 53 -53s53 24 53 53s-24 54 -53 54zM119 293c0 21 13 39 31 48c-18 9 -31 27 -31 48c0 29 25 54 54 54c11 0 21 -4 30 -10v4c0 29 24 54 53 54s53 -25 53 -54v-4c9 6 19 10 30 10c29 0 54 -25 54 -54c0 -21 -13 -39 -31 -48
-c18 -9 31 -27 31 -48c0 -29 -25 -53 -54 -53c-11 0 -21 3 -30 9v-4c0 -29 -24 -53 -53 -53s-53 24 -53 53v4c-9 -6 -19 -9 -30 -9c-29 0 -54 24 -54 53zM256 43c-106 0 -192 86 -192 192c106 0 192 -86 192 -192zM256 43c0 106 86 192 192 192c0 -106 -86 -192 -192 -192z
-" />
-    <glyph glyph-name="local_gas_station" unicode="local_gas_station" 
-d="M384 299c12 0 21 9 21 21s-9 21 -21 21s-21 -9 -21 -21s9 -21 21 -21zM256 299v106h-128v-106h128zM422 358c10 -10 15 -23 15 -38v-203c0 -29 -24 -53 -53 -53s-53 24 -53 53v107h-32v-160h-214v341c0 23 20 43 43 43h128c23 0 43 -20 43 -43v-149h21
-c23 0 43 -20 43 -43v-96c0 -12 9 -21 21 -21s21 9 21 21v154c-7 -3 -13 -4 -21 -4c-29 0 -53 24 -53 53c0 23 14 42 34 50l-45 45l23 22z" />
-    <glyph glyph-name="local_grocery_store" unicode="local_grocery_store" 
-d="M363 128c23 0 42 -20 42 -43s-19 -42 -42 -42s-43 19 -43 42s20 43 43 43zM21 469h70l20 -42h316c12 0 21 -10 21 -22c0 -4 -1 -7 -3 -10l-76 -138c-7 -13 -21 -22 -37 -22h-159l-19 -35l-1 -3c0 -3 2 -5 5 -5h247v-43h-256c-23 0 -42 20 -42 43c0 7 2 14 5 20l29 53
-l-77 162h-43v42zM149 128c23 0 43 -20 43 -43s-20 -42 -43 -42s-42 19 -42 42s19 43 42 43z" />
-    <glyph glyph-name="local_hospital" unicode="local_hospital" 
-d="M384 213v86h-85v85h-86v-85h-85v-86h85v-85h86v85h85zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="local_hotel" unicode="local_hotel" 
-d="M405 363c47 0 86 -39 86 -86v-192h-43v64h-384v-64h-43v320h43v-192h171v150h170zM149 235c-35 0 -64 29 -64 64s29 64 64 64s64 -29 64 -64s-29 -64 -64 -64z" />
-    <glyph glyph-name="local_laundry_service" unicode="local_laundry_service" 
-d="M256 85c71 0 128 57 128 128s-57 128 -128 128s-128 -57 -128 -128s57 -128 128 -128zM149 427c-12 0 -21 -10 -21 -22s9 -21 21 -21s22 9 22 21s-10 22 -22 22zM213 427c-12 0 -21 -10 -21 -22s9 -21 21 -21s22 9 22 21s-10 22 -22 22zM384 469c24 0 43 -18 43 -42v-342
-c0 -24 -19 -42 -43 -42h-256c-24 0 -43 18 -43 42v342c0 24 19 42 43 42h256zM196 153l120 121c33 -33 33 -88 0 -121s-87 -33 -120 0z" />
-    <glyph glyph-name="local_library" unicode="local_library" 
-d="M256 341c-35 0 -64 29 -64 64s29 64 64 64s64 -29 64 -64s-29 -64 -64 -64zM256 266c50 47 118 75 192 75v-234c-74 0 -142 -29 -192 -76c-50 47 -118 76 -192 76v234c74 0 142 -28 192 -75z" />
-    <glyph glyph-name="local_mall" unicode="local_mall" 
-d="M256 235c59 0 107 47 107 106h-43c0 -35 -29 -64 -64 -64s-64 29 -64 64h-43c0 -59 48 -106 107 -106zM256 448c-35 0 -64 -29 -64 -64h128c0 35 -29 64 -64 64zM405 384c23 0 43 -20 43 -43v-256c0 -23 -20 -42 -43 -42h-298c-23 0 -43 19 -43 42v256c0 23 20 43 43 43
-h42c0 59 48 107 107 107s107 -48 107 -107h42z" />
-    <glyph glyph-name="local_movies" unicode="local_movies" 
-d="M384 320v43h-43v-43h43zM384 235v42h-43v-42h43zM384 149v43h-43v-43h43zM171 320v43h-43v-43h43zM171 235v42h-43v-42h43zM171 149v43h-43v-43h43zM384 448h43v-384h-43v43h-43v-43h-170v43h-43v-43h-43v384h43v-43h43v43h170v-43h43v43z" />
-    <glyph glyph-name="local_offer" unicode="local_offer" 
-d="M117 363c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM457 265c8 -8 12 -18 12 -30s-4 -22 -12 -30l-150 -150c-8 -8 -18 -12 -30 -12s-22 4 -30 12l-192 192c-8 8 -12 18 -12 30v150c0 23 19 42 42 42h150c12 0 22 -4 30 -12z" />
-    <glyph glyph-name="local_parking" unicode="local_parking" 
-d="M282 277c23 0 42 20 42 43s-19 43 -42 43h-69v-86h69zM277 448c71 0 128 -57 128 -128s-57 -128 -128 -128h-64v-128h-85v384h149z" />
-    <glyph glyph-name="local_pharmacy" unicode="local_pharmacy" 
-d="M341 213v43h-64v64h-42v-64h-64v-43h64v-64h42v64h64zM448 405v-42l-43 -128l43 -128v-43h-384v43l43 128l-43 128v42h271l31 86l50 -19l-24 -67h56z" />
-    <glyph glyph-name="local_phone" unicode="local_phone" 
-d="M141 282c31 -60 81 -110 141 -141l47 47c6 6 15 8 22 5c24 -8 50 -12 76 -12c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22z" />
-    <glyph glyph-name="local_pizza" unicode="local_pizza" 
-d="M256 192c23 0 43 20 43 43s-20 42 -43 42s-43 -19 -43 -42s20 -43 43 -43zM149 363c0 -23 20 -43 43 -43s43 20 43 43s-20 42 -43 42s-43 -19 -43 -42zM256 469c76 0 145 -33 192 -85l-192 -341l-192 341c47 52 116 85 192 85z" />
-    <glyph glyph-name="local_play" unicode="local_play" 
-d="M332 154l-23 87l70 58l-90 5l-33 84l-33 -84l-91 -5l71 -58l-23 -87l76 49zM427 256c0 -23 19 -43 42 -43v-85c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v85c24 0 42 20 42 43s-19 43 -42 43v85c0 23 19 43 42 43h342c23 0 42 -20 42 -43v-85
-c-23 0 -42 -20 -42 -43z" />
-    <glyph glyph-name="local_post_office" unicode="local_post_office" 
-d="M427 341v43l-171 -107l-171 107v-43l171 -106zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="local_printshop" unicode="local_printshop" 
-d="M384 448v-85h-256v85h256zM405 256c12 0 22 9 22 21s-10 22 -22 22s-21 -10 -21 -22s9 -21 21 -21zM341 107v106h-170v-106h170zM405 341c35 0 64 -29 64 -64v-128h-85v-85h-256v85h-85v128c0 35 29 64 64 64h298z" />
-    <glyph glyph-name="local_see" unicode="local_see" 
-d="M256 149c59 0 107 48 107 107s-48 107 -107 107s-107 -48 -107 -107s48 -107 107 -107zM192 469h128l39 -42h68c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h68zM188 256c0 38 30 68 68 68s68 -30 68 -68
-s-30 -68 -68 -68s-68 30 -68 68z" />
-    <glyph glyph-name="local_shipping" unicode="local_shipping" 
-d="M384 117c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM416 309h-53v-53h95zM128 117c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM427 341l64 -85v-107h-43c0 -35 -29 -64 -64 -64s-64 29 -64 64h-128c0 -35 -29 -64 -64 -64
-s-64 29 -64 64h-43v235c0 23 20 43 43 43h299v-86h64z" />
-    <glyph glyph-name="local_taxi" unicode="local_taxi" 
-d="M107 277h298l-32 96h-234zM373 171c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 171c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM404 384l44 -128v-171c0 -12 -9 -21 -21 -21h-22c-12 0 -21 9 -21 21v22h-256v-22
-c0 -12 -9 -21 -21 -21h-22c-12 0 -21 9 -21 21v171l44 128c4 13 17 21 31 21h53v43h128v-43h53c14 0 27 -8 31 -21z" />
-    <glyph glyph-name="location_city" unicode="location_city" 
-d="M405 192v43h-42v-43h42zM405 107v42h-42v-42h42zM277 363v42h-42v-42h42zM277 277v43h-42v-43h42zM277 192v43h-42v-43h42zM277 107v42h-42v-42h42zM149 277v43h-42v-43h42zM149 192v43h-42v-43h42zM149 107v42h-42v-42h42zM320 277h128v-213h-384v299h128v42l64 64
-l64 -64v-128z" />
-    <glyph glyph-name="location_disabled" unicode="location_disabled" 
-d="M347 138l-209 209c-19 -25 -31 -57 -31 -91c0 -83 66 -149 149 -149c34 0 66 12 91 31zM64 421l27 27l357 -357l-27 -27l-44 44c-28 -23 -62 -39 -100 -43v-44h-42v44c-89 10 -160 81 -170 170h-44v42h44c4 38 20 72 43 100zM447 277h44v-42h-44c-3 -24 -10 -48 -21 -68
-l-32 32c7 17 11 37 11 57c0 83 -66 149 -149 149c-20 0 -40 -4 -57 -11l-32 32c21 11 44 18 68 21v44h42v-44c89 -10 160 -81 170 -170z" />
-    <glyph glyph-name="location_off" unicode="location_off" 
-d="M250 267c59.1765 -58.4901 118.284 -117.049 177 -176l-27 -27l-72 71c-36 -53 -72 -92 -72 -92s-149 165 -149 277c0 11 2 22 4 33l-68 68l27 27l178 -178zM256 373c-16 0 -29 -7 -39 -18l-69 68c27 28 66 46 108 46c83 0 149 -66 149 -149c0 -36 -15 -77 -36 -117
-l-77 78c11 10 17 23 17 39c0 29 -24 53 -53 53z" />
-    <glyph glyph-name="location_on" unicode="location_on" 
-d="M256 267c29 0 53 24 53 53s-24 53 -53 53s-53 -24 -53 -53s24 -53 53 -53zM256 469c83 0 149 -66 149 -149c0 -112 -149 -277 -149 -277s-149 165 -149 277c0 83 66 149 149 149z" />
-    <glyph glyph-name="location_searching" unicode="location_searching" 
-d="M256 107c83 0 149 66 149 149s-66 149 -149 149s-149 -66 -149 -149s66 -149 149 -149zM447 277h44v-42h-44c-10 -89 -81 -160 -170 -170v-44h-42v44c-89 10 -160 81 -170 170h-44v42h44c10 89 81 160 170 170v44h42v-44c89 -10 160 -81 170 -170z" />
-    <glyph glyph-name="lock" unicode="lock" 
-d="M322 341v43c0 36 -30 66 -66 66s-66 -30 -66 -66v-43h132zM256 149c23 0 43 20 43 43s-20 43 -43 43s-43 -20 -43 -43s20 -43 43 -43zM384 341c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h21v43c0 59 48 107 107 107
-s107 -48 107 -107v-43h21z" />
-    <glyph glyph-name="lock_open" unicode="lock_open" 
-d="M384 85v214h-256v-214h256zM384 341c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h194v43c0 36 -30 66 -66 66s-66 -30 -66 -66h-41c0 59 48 107 107 107s107 -48 107 -107v-43h21zM256 149c-23 0 -43 20 -43 43
-s20 43 43 43s43 -20 43 -43s-20 -43 -43 -43z" />
-    <glyph glyph-name="lock_outline" unicode="lock_outline" 
-d="M384 85v214h-256v-214h256zM190 384v-43h132v43c0 36 -30 66 -66 66s-66 -30 -66 -66zM384 341c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h21v43c0 59 48 107 107 107s107 -48 107 -107v-43h21zM256 149
-c-23 0 -43 20 -43 43s20 43 43 43s43 -20 43 -43s-20 -43 -43 -43z" />
-    <glyph glyph-name="looks" unicode="looks" 
-d="M256 384c129 0 235 -106 235 -235h-43c0 106 -86 192 -192 192s-192 -86 -192 -192h-43c0 129 106 235 235 235zM256 299c82 0 149 -68 149 -150h-42c0 59 -48 107 -107 107s-107 -48 -107 -107h-42c0 82 67 150 149 150z" />
-    <glyph glyph-name="looks_3" unicode="looks_&#x33;" 
-d="M320 288v32c0 24 -19 43 -42 43h-86v-43h86v-43h-43v-42h43v-43h-86v-43h86c23 0 42 19 42 43v32c0 18 -14 32 -32 32c18 0 32 14 32 32zM406 448c23 0 42 -20 42 -43v-298c0 -23 -19 -43 -42 -43h-299c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h299z" />
-    <glyph glyph-name="looks_4" unicode="looks_&#x34;" 
-d="M320 149v214h-43v-86h-42v86h-43v-128h85v-86h43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="looks_5" unicode="looks_&#x35;" 
-d="M320 320v43h-128v-128h85v-43h-85v-43h85c23 0 43 19 43 43v43c0 24 -20 42 -43 42h-42v43h85zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="looks_6" unicode="looks_&#x36;" 
-d="M320 320v43h-85c-23 0 -43 -19 -43 -43v-128c0 -24 20 -43 43 -43h42c23 0 43 19 43 43v43c0 24 -20 42 -43 42h-42v43h85zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298zM235 192v43h42v-43h-42z" />
-    <glyph glyph-name="looks_one" unicode="looks_one" 
-d="M299 149v214h-86v-43h43v-171h43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="looks_two" unicode="looks_two" 
-d="M320 277v43c0 24 -20 43 -43 43h-85v-43h85v-43h-42c-23 0 -43 -18 -43 -42v-86h128v43h-85v43h42c23 0 43 18 43 42zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="loop" unicode="loop" 
-d="M256 128v64l85 -85l-85 -86v64c-94 0 -171 77 -171 171c0 33 10 65 27 91l31 -31c-10 -18 -15 -38 -15 -60c0 -71 57 -128 128 -128zM256 427c94 0 171 -77 171 -171c0 -33 -10 -65 -27 -91l-31 31c10 18 15 38 15 60c0 71 -57 128 -128 128v-64l-85 85l85 86v-64z" />
-    <glyph glyph-name="loupe" unicode="loupe" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213v-171c0 -23 -19 -42 -42 -42h-171c-118 0 -213 95 -213 213s95 213 213 213zM277 363v-86h86v-42h-86v-86h-42v86h-86v42h86v86h42z" />
-    <glyph glyph-name="low_priority" unicode="low_priority" 
-d="M43 267c0 76 62 138 138 138h75v-42h-75c-53 0 -96 -43 -96 -96s43 -96 96 -96h11v42l64 -64l-64 -64v43h-11c-76 0 -138 63 -138 139zM299 171h170v-43h-170v43zM299 288h170v-43h-170v43zM299 405h170v-42h-170v42z" />
-    <glyph glyph-name="loyalty" unicode="loyalty" 
-d="M368 186c10 10 16 23 16 38c0 29 -24 53 -53 53c-15 0 -28 -5 -38 -15l-16 -16l-15 16c-10 10 -23 15 -38 15c-29 0 -53 -24 -53 -53c0 -15 5 -28 15 -38l91 -91zM117 363c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM457 265c8 -8 12 -18 12 -30
-s-4 -22 -12 -30l-150 -150c-8 -8 -18 -12 -30 -12s-22 4 -30 12l-192 192c-8 8 -12 18 -12 30v150c0 23 19 42 42 42h150c12 0 22 -4 30 -12z" />
-    <glyph glyph-name="mail" unicode="mail" 
-d="M427 341v43l-171 -107l-171 107v-43l171 -106zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="mail_outline" unicode="mail_outline" 
-d="M256 277l171 107h-342zM427 128v213l-171 -106l-171 106v-213h342zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="map" unicode="map" 
-d="M320 107v253l-128 45v-253zM437 448c6 0 11 -5 11 -11v-322c0 -5 -4 -9 -8 -10l-120 -41l-128 45l-114 -44l-3 -1c-6 0 -11 5 -11 11v322c0 5 4 9 8 10l120 41l128 -45l114 44z" />
-    <glyph glyph-name="markunread" unicode="markunread" 
-d="M427 341v43l-171 -107l-171 107v-43l171 -106zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="markunread_mailbox" unicode="markunread_mailbox" 
-d="M427 384c23 0 42 -20 42 -43v-256c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v256c0 23 19 43 42 43h43v128h171v-85h-128v-171h42v128h214z" />
-    <glyph glyph-name="memory" unicode="memory" 
-d="M363 149v214h-214v-214h214zM448 277h-43v-42h43v-43h-43v-43c0 -23 -19 -42 -42 -42h-43v-43h-43v43h-42v-43h-43v43h-43c-23 0 -42 19 -42 42v43h-43v43h43v42h-43v43h43v43c0 23 19 42 42 42h43v43h43v-43h42v43h43v-43h43c23 0 42 -19 42 -42v-43h43v-43zM277 235v42
-h-42v-42h42zM320 320v-128h-128v128h128z" />
-    <glyph glyph-name="menu" unicode="menu" 
-d="M64 384h384v-43h-384v43zM64 235v42h384v-42h-384zM64 128v43h384v-43h-384z" />
-    <glyph glyph-name="merge_type" unicode="merge_type" 
-d="M160 341l96 96l96 -96h-75v-136l-128 -128l-30 30l116 115v119h-75zM363 77l-73 72l30 30l73 -72z" />
-    <glyph glyph-name="message" unicode="message" 
-d="M384 341v43h-256v-43h256zM384 277v43h-256v-43h256zM384 213v43h-256v-43h256zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="mic" unicode="mic" 
-d="M369 277h36c0 -73 -58 -133 -128 -143v-70h-42v70c-70 10 -128 70 -128 143h36c0 -64 54 -108 113 -108s113 44 113 108zM256 213c-35 0 -64 29 -64 64v128c0 35 29 64 64 64s64 -29 64 -64v-128c0 -35 -29 -64 -64 -64z" />
-    <glyph glyph-name="mic_none" unicode="mic_none" 
-d="M369 277h36c0 -73 -58 -133 -128 -143v-70h-42v70c-70 10 -128 70 -128 143h36c0 -64 54 -108 113 -108s113 44 113 108zM230 407v-132c0 -14 12 -25 26 -25s25 11 25 25l1 132c0 14 -12 26 -26 26s-26 -12 -26 -26zM256 213c-35 0 -64 29 -64 64v128c0 35 29 64 64 64
-s64 -29 64 -64v-128c0 -35 -29 -64 -64 -64z" />
-    <glyph glyph-name="mic_off" unicode="mic_off" 
-d="M91 448l357 -357l-27 -27l-89 89c-16 -10 -36 -16 -55 -19v-70h-42v70c-70 10 -128 70 -128 143h36c0 -64 54 -108 113 -108c17 0 34 4 49 11l-35 35c-4 -1 -9 -2 -14 -2c-35 0 -64 29 -64 64v16l-128 128zM320 274l-128 127v4c0 35 29 64 64 64s64 -29 64 -64v-131z
-M405 277c0 -25 -7 -49 -19 -70l-26 27c6 13 9 27 9 43h36z" />
-    <glyph glyph-name="mms" unicode="mms" 
-d="M107 213h298l-96 128l-74 -96l-54 64zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="mode_comment" unicode="mode_comment" 
-d="M469 427v-384l-85 85h-299c-23 0 -42 20 -42 43v256c0 23 19 42 42 42h342c23 0 42 -19 42 -42z" />
-    <glyph glyph-name="mode_edit" unicode="mode_edit" 
-d="M442 362l-39 -39l-80 80l39 39c8 8 22 8 30 0l50 -50c8 -8 8 -22 0 -30zM64 144l236 236l80 -80l-236 -236h-80v80z" />
-    <glyph glyph-name="monetization_on" unicode="monetization_on" 
-d="M286 126c37 7 67 28 67 67c0 54 -47 73 -90 84s-56 23 -56 41c0 20 19 35 51 35c34 0 46 -16 47 -40h42c-1 33 -21 62 -61 72v42h-57v-42c-37 -8 -66 -31 -66 -68c0 -44 36 -65 89 -78c48 -11 57 -28 57 -46c0 -13 -9 -34 -51 -34c-39 0 -55 18 -57 40h-42
-c2 -41 34 -64 70 -72v-42h57v41zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="money_off" unicode="money_off" 
-d="M114 425l311 -312l-27 -27l-47 48c-13 -12 -32 -20 -52 -24v-46h-64v46c-41 9 -76 35 -79 82h47c2 -25 20 -45 64 -45c29 0 44 10 51 20l-75 74c-50 15 -83 40 -83 84l-73 73zM267 365c-13 0 -24 -2 -33 -6l-31 31c10 5 21 9 32 12v46h64v-47c45 -11 67 -44 68 -81h-47
-c-1 27 -15 45 -53 45z" />
-    <glyph glyph-name="monochrome_photos" unicode="monochrome_photos" 
-d="M427 107v256h-171v-22c60 0 107 -46 107 -106s-47 -107 -107 -107v38c-38 0 -68 31 -68 69s30 68 68 68v-137c38 0 68 31 68 69s-30 68 -68 68v38c-60 0 -107 -46 -107 -106s47 -107 107 -107v-21h171zM427 405c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-342
-c-23 0 -42 20 -42 43v256c0 23 19 42 42 42h69l38 43h128l38 -43h69z" />
-    <glyph glyph-name="mood" unicode="mood" 
-d="M256 139c-50 0 -92 30 -109 74h218c-17 -44 -59 -74 -109 -74zM181 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM331 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM256 85c94 0 171 77 171 171s-77 171 -171 171
-s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="mood_bad" unicode="mood_bad" 
-d="M256 213c50 0 92 -30 109 -74h-218c17 44 59 74 109 74zM181 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM331 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM256 85c94 0 171 77 171 171s-77 171 -171 171
-s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="more" unicode="more" 
-d="M405 224c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM299 224c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM192 224c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM469 448c23 0 43 -20 43 -43v-298
-c0 -23 -20 -43 -43 -43h-318c-15 0 -28 8 -36 19l-115 173l115 173c8 11 19 19 34 19h320z" />
-    <glyph glyph-name="more_horiz" unicode="more_horiz" 
-d="M256 299c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM384 299c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM128 299c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43z" />
-    <glyph glyph-name="more_vert" unicode="more_vert" 
-d="M256 171c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM256 299c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM256 341c-23 0 -43 20 -43 43s20 43 43 43s43 -20 43 -43s-20 -43 -43 -43z" />
-    <glyph glyph-name="motorcycle" unicode="motorcycle" 
-d="M405 149c35 0 64 29 64 64s-29 64 -64 64s-64 -29 -64 -64s29 -64 64 -64zM167 192h-60v43h60c-9 25 -33 42 -60 42c-35 0 -64 -29 -64 -64s29 -64 64 -64c27 0 51 18 60 43zM415 319c55 -4 97 -49 97 -106c0 -60 -47 -106 -107 -106s-106 46 -106 106c0 13 2 26 6 38
-l-59 -59h-35c-10 -49 -52 -85 -104 -85c-60 0 -107 46 -107 106s47 107 107 107h247l-43 43h-76v42h94z" />
-    <glyph glyph-name="mouse" unicode="mouse" 
-d="M235 489v-169h-150c0 87 66 159 150 169zM85 192v85h342v-85c0 -94 -77 -171 -171 -171s-171 77 -171 171zM277 489c84 -10 150 -82 150 -169h-150v169z" />
-    <glyph glyph-name="move_to_inbox" unicode="move_to_inbox" 
-d="M341 299l-85 -86l-85 86h42v64h86v-64h42zM405 192v213h-299v-213h86c0 -35 29 -64 64 -64s64 29 64 64h85zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-299c-24 0 -42 20 -42 43v298c0 23 18 43 42 43h299z" />
-    <glyph glyph-name="movie" unicode="movie" 
-d="M384 427h85v-299c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h22l42 -86h64l-42 86h42l43 -86h64l-43 86h43l43 -86h64z" />
-    <glyph glyph-name="movie_creation" unicode="movie_creation" 
-d="M384 427h85v-299c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h22l42 -86h64l-42 86h42l43 -86h64l-43 86h43l43 -86h64z" />
-    <glyph glyph-name="movie_filter" unicode="movie_filter" 
-d="M361 257l44 20l-44 20l-20 44l-20 -44l-44 -20l44 -20l20 -44zM240 187l59 26l-59 27l-27 59l-26 -59l-59 -27l59 -26l26 -59zM384 427h85v-299c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h22l42 -64h64l-42 64h42l43 -64h64l-43 64h43
-l43 -64h64z" />
-    <glyph glyph-name="multiline_chart" unicode="multiline_chart" 
-d="M469 364l-65 -73c23 -37 39 -82 44 -131h-43c-4 35 -15 68 -31 97l-86 -97l-85 86l-128 -128l-32 32l160 160l85 -86l61 70c-36 42 -86 69 -144 69c-50 0 -96 -20 -132 -52l-30 30c44 39 100 64 162 64c69 0 129 -30 173 -79l61 68z" />
-    <glyph glyph-name="music_note" unicode="music_note" 
-d="M256 448h128v-85h-85v-214c0 -47 -39 -85 -86 -85s-85 38 -85 85s38 86 85 86c16 0 30 -5 43 -12v225z" />
-    <glyph glyph-name="music_video" unicode="music_video" 
-d="M171 192c0 35 29 64 64 64c7 0 14 -2 21 -4v132h107v-43h-64v-150c0 -35 -29 -63 -64 -63s-64 29 -64 64zM448 107v298h-384v-298h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="my_location" unicode="my_location" 
-d="M256 107c83 0 149 66 149 149s-66 149 -149 149s-149 -66 -149 -149s66 -149 149 -149zM447 277h44v-42h-44c-10 -89 -81 -160 -170 -170v-44h-42v44c-89 10 -160 81 -170 170h-44v42h44c10 89 81 160 170 170v44h42v-44c89 -10 160 -81 170 -170zM256 341
-c47 0 85 -38 85 -85s-38 -85 -85 -85s-85 38 -85 85s38 85 85 85z" />
-    <glyph glyph-name="nature" unicode="nature" 
-d="M277 168v-83h128v-42h-298v42h128v84c-71 12 -125 73 -125 147c0 83 67 150 150 150s149 -67 149 -150c0 -77 -58 -139 -132 -148z" />
-    <glyph glyph-name="nature_people" unicode="nature_people" 
-d="M96 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM473 316c0 -77 -58 -139 -132 -148v-83h64v-42h-341v106h-21v86c0 12 9 21 21 21h64c12 0 21 -9 21 -21v-86h-21v-64h171v84c-71 12 -125 73 -125 147c0 83 67 150 150 150s149 -67 149 -150z
-" />
-    <glyph glyph-name="navigate_before" unicode="navigate_before" 
-d="M329 354l-98 -98l98 -98l-30 -30l-128 128l128 128z" />
-    <glyph glyph-name="navigate_next" unicode="navigate_next" 
-d="M213 384l128 -128l-128 -128l-30 30l98 98l-98 98z" />
-    <glyph glyph-name="navigation" unicode="navigation" 
-d="M256 469l160 -390l-15 -15l-145 64l-145 -64l-15 15z" />
-    <glyph glyph-name="near_me" unicode="near_me" 
-d="M448 448l-161 -384h-21l-56 146l-146 56v21z" />
-    <glyph glyph-name="network_cell" unicode="network_cell" 
-d="M469 43h-426l426 426v-426z" />
-    <glyph glyph-name="network_check" unicode="network_check" 
-d="M107 235c43 43 100 63 156 61l-28 -61c-31 -4 -62 -19 -86 -43zM363 192c-8 8 -17 15 -26 21l12 62c20 -10 39 -23 56 -40zM448 277c-26 26 -56 46 -88 59l11 60c44 -16 85 -41 120 -76zM21 320c80 80 190 110 293 92l-25 -57c-80 10 -164 -17 -225 -78zM339 405
-c6 0 11 -4 11 -10l-52 -275v-1c-4 -19 -22 -34 -42 -34c-24 0 -43 19 -43 43c0 7 2 15 5 21l111 248c1.57297 4.7189 4.56186 8 10 8z" />
-    <glyph glyph-name="network_locked" unicode="network_locked" 
-d="M448 171v32c0 18 -14 32 -32 32s-32 -14 -32 -32v-32h64zM469 171c12 0 22 -10 22 -22v-85c0 -12 -10 -21 -22 -21h-106c-12 0 -22 9 -22 21v85c0 12 10 22 22 22v32c0 29 24 53 53 53s53 -24 53 -53v-32zM416 299c-53 0 -96 -43 -96 -96v-6c-13 -12 -21 -29 -21 -48v-64
-h-278l406 406v-193c-4 0 -7 1 -11 1z" />
-    <glyph glyph-name="network_wifi" unicode="network_wifi" 
-d="M436.25 278.586c0.284113 -0.222489 0.53415 -0.418301 0.749753 -0.585993l-181 -224l-181 224c0.215604 0.167692 0.46564 0.363504 0.749753 0.585993l-67.7498 84.414c10 7 105 85 248 85s238 -78 248 -85z" />
-    <glyph glyph-name="new_releases" unicode="new_releases" 
-d="M277 235v128h-42v-128h42zM277 149v43h-42v-43h42zM491 256l-52 -59l7 -79l-77 -17l-40 -68l-73 31l-73 -31l-40 67l-77 18l7 79l-52 59l52 60l-7 78l77 17l40 68l73 -31l73 31l40 -68l77 -17l-7 -79z" />
-    <glyph glyph-name="next_week" unicode="next_week" 
-d="M235 117l85 86l-85 85l-22 -21l64 -64l-64 -64zM213 405v-42h86v42h-86zM299 448c23.3225 0 42 -19.4985 42 -43v-42h86c23 0 42 -20 42 -43v-235c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v235c0 23 19 43 42 43h86v42c0 23 19 43 42 43h86z" />
-    <glyph glyph-name="nfc" unicode="nfc" 
-d="M384 384v-256h-256v256h85v-43h-42v-170h170v170h-64v-48c13 -7 22 -21 22 -37c0 -23 -20 -43 -43 -43s-43 20 -43 43c0 16 9 30 22 37v48c0 23 19 43 42 43h107zM427 85v342h-342v-342h342zM427 469c23 0 42 -19 42 -42v-342c0 -23 -19 -42 -42 -42h-342
-c-23 0 -42 19 -42 42v342c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="no_encryption" unicode="no_encryption" 
-d="M190 384v-26l-39 39c6 53 50 94 105 94c59 0 107 -48 107 -107v-43h21c23 0 43 -19 43 -42v-178l-221 220h116v43c0 36 -30 66 -66 66s-66 -30 -66 -66zM448 47l-26 -26l-24 24c-4 -1 -9 -2 -14 -2h-256c-23 0 -43 19 -43 42v214c0 16 10 30 23 37l-44 43l26 26z" />
-    <glyph glyph-name="no_sim" unicode="no_sim" 
-d="M78 429l373 -372l-28 -28l-40 41c-6 -3 -13 -6 -20 -6h-214c-23 0 -42 20 -42 43v239l-56 56zM405 405v-249l-242 242l50 50h150c23 0 42 -20 42 -43z" />
-    <glyph glyph-name="not_interested" unicode="not_interested" 
-d="M391 151c23 29 36 66 36 105c0 94 -77 171 -171 171c-39 0 -76 -13 -105 -36zM256 85c39 0 76 13 105 36l-240 240c-23 -29 -36 -66 -36 -105c0 -94 77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="note" unicode="note" 
-d="M320 395v-118h117zM469 299v-171c0 -23 -19 -42 -42 -42l-342 -1c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h256z" />
-    <glyph glyph-name="note_add" unicode="note_add" 
-d="M277 320h118l-118 117v-117zM341 171v42h-64v64h-42v-64h-64v-42h64v-64h42v64h64zM299 469l128 -128v-256c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42l1 342c0 23 19 42 42 42h171z" />
-    <glyph glyph-name="notifications" unicode="notifications" 
-d="M384 171l43 -43v-21h-342v21l43 43v106c0 66 35 120 96 135v15c0 18 14 32 32 32s32 -14 32 -32v-15c61 -15 96 -70 96 -135v-106zM256 43c-24 0 -43 19 -43 42h86c0 -23 -20 -42 -43 -42z" />
-    <glyph glyph-name="notifications_active" unicode="notifications_active" 
-d="M256 43c-24 0 -43 19 -43 42h85c0 -24.8376 -18.6125 -42 -42 -42zM384 277v-106l43 -43v-21h-342v21l43 43v106c0 66 35 120 96 135v15c0 18 14 32 32 32s32 -14 32 -32v-15c61 -15 96 -70 96 -135zM426 288c-3 57 -32 106 -75 137l30 30c51 -39 85 -99 88 -167h-43z
-M162 425c-44 -31 -73 -80 -76 -137h-43c3 68 37 128 88 167z" />
-    <glyph glyph-name="notifications_none" unicode="notifications_none" 
-d="M341 149v128c0 53 -32 96 -85 96s-85 -43 -85 -96v-128h170zM384 171l43 -43v-21h-342v21l43 43v106c0 66 35 120 96 135v15c0 18 14 32 32 32s32 -14 32 -32v-15c61 -15 96 -70 96 -135v-106zM256 43c-23 0 -43 19 -43 42h86c0 -23 -20 -42 -43 -42z" />
-    <glyph glyph-name="notifications_off" unicode="notifications_off" 
-d="M384 199l-191 201c5 2 10 5 15 7h1l6 3c3 1 6 1 9 2v15c0 18 14 32 32 32s32 -14 32 -32v-15c61 -15 96 -69 96 -135v-78zM256 43c-24 0 -43 18 -43 42h86c0 -24 -19 -42 -43 -42zM167 381c93.6174 -96.7159 187.67 -192.997 281 -290l-27 -27l-43 43h-293v21l43 43v107
-c0 27 6 52 17 73l-60 59l27 28z" />
-    <glyph glyph-name="notifications_paused" unicode="notifications_paused" 
-d="M309 303v38h-106v-38h59l-59 -73v-38h106v38h-59zM384 171l43 -43v-21h-342v21l43 43v106c0 65 35 120 96 135v15c0 18 14 32 32 32s32 -14 32 -32v-15c61 -15 96 -70 96 -135v-106zM256 43c-24 0 -43 19 -43 42h86c0 -23 -20 -42 -43 -42z" />
-    <glyph glyph-name="offline_pin" unicode="offline_pin" 
-d="M220 213l143 143l-30 30l-113 -113l-41 41l-30 -30zM363 128v43h-214v-43h214zM256 469c117 0 213 -96 213 -213s-96 -213 -213 -213s-213 96 -213 213s96 213 213 213z" />
-    <glyph glyph-name="ondemand_video" unicode="ondemand_video" 
-d="M341 277l-149 -85v171zM448 149v256h-384v-256h384zM448 448c23 0 43 -19 43 -43l-1 -256c0 -23 -19 -42 -42 -42h-107v-43h-170v43h-107c-24 0 -43 19 -43 42v256c0 24 19 43 43 43h384z" />
-    <glyph glyph-name="opacity" unicode="opacity" 
-d="M128 213h256c0 43 -14 69 -38 93l-90 94l-90 -93c-24 -24 -38 -51 -38 -94zM377 341c33 -33 50 -77 50 -120s-17 -88 -50 -121s-77 -50 -121 -50s-88 17 -121 50s-50 78 -50 121s17 87 50 120l121 121z" />
-    <glyph glyph-name="open_in_browser" unicode="open_in_browser" 
-d="M256 299l85 -86h-64v-128h-42v128h-64zM405 427c24 0 43 -20 43 -43v-256c0 -23 -20 -43 -43 -43h-85v43h85v213h-298v-213h85v-43h-85c-24 0 -43 20 -43 43v256c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="open_in_new" unicode="open_in_new" 
-d="M299 448h149v-149h-43v76l-209 -209l-30 30l209 209h-76v43zM405 107v149h43v-149c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h149v-43h-149v-298h298z" />
-    <glyph glyph-name="open_with" unicode="open_with" 
-d="M299 192v-64h64l-107 -107l-107 107h64v64h86zM491 256l-107 -107v64h-64v86h64v64zM192 299v-86h-64v-64l-107 107l107 107v-64h64zM213 320v64h-64l107 107l107 -107h-64v-64h-86z" />
-    <glyph glyph-name="pages" unicode="pages" 
-d="M405 448c23 0 43 -20 43 -43v-128h-107l22 86l-86 -22v107h128zM363 149l-22 86h107v-128c0 -23 -20 -43 -43 -43h-128v107zM171 235l-22 -86l86 22v-107h-128c-23 0 -43 20 -43 43v128h107zM64 405c0 23 20 43 43 43h128v-107l-86 22l22 -86h-107v128z" />
-    <glyph glyph-name="pageview" unicode="pageview" 
-d="M358 124l30 30l-62 62c9 15 15 32 15 51c0 53 -43 96 -96 96s-96 -43 -96 -96s43 -96 96 -96c19 0 36 6 51 15zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342zM245 320c29 0 54 -24 54 -53
-s-25 -54 -54 -54s-53 25 -53 54s24 53 53 53z" />
-    <glyph glyph-name="palette" unicode="palette" 
-d="M373 256c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM309 341c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM203 341c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 256c18 0 32 14 32 32s-14 32 -32 32
-s-32 -14 -32 -32s14 -32 32 -32zM256 448c106 0 192 -77 192 -171c0 -59 -48 -106 -107 -106h-37c-18 0 -32 -14 -32 -32c0 -8 3 -15 8 -21s8 -14 8 -22c0 -18 -14 -32 -32 -32c-106 0 -192 86 -192 192s86 192 192 192z" />
-    <glyph glyph-name="pan_tool" unicode="pan_tool" 
-d="M491 395v-310c0 -47 -39 -85 -86 -85h-155c-23 0 -45 9 -61 25l-168 171s27 26 28 26c5 4 11 6 17 6c5 0 9 -1 13 -3c1 0 92 -52 92 -52v254c0 18 14 32 32 32s32 -14 32 -32v-150h21v203c0 18 14 32 32 32s32 -14 32 -32v-203h21v182c0 18 14 32 32 32s32 -14 32 -32
-v-182h22v118c0 18 14 32 32 32s32 -14 32 -32z" />
-    <glyph glyph-name="panorama" unicode="panorama" 
-d="M181 245l-74 -96h298l-96 128l-74 -96zM491 128c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v256c0 23 20 43 43 43h384c23 0 43 -20 43 -43v-256z" />
-    <glyph glyph-name="panorama_fish_eye" unicode="panorama_fish_eye" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="panorama_horizontal" unicode="panorama_horizontal" 
-d="M457 427c7 0 12 -5 12 -14v-314c0 -9 -5 -14 -12 -14c-2 0 -4 1 -6 2c-63 23 -129 35 -195 35s-132 -12 -195 -35c-2 -1 -4 -2 -6 -2c-7 0 -12 6 -12 14v314c0 9 5 14 12 14c2 0 4 -1 6 -2c63 -23 129 -35 195 -35s132 12 195 35c2 1 4 2 6 2zM427 372
-c-55 -17 -113 -24 -171 -24s-116 8 -171 24v-232c55 16 113 24 171 24s116 -8 171 -24v232z" />
-    <glyph glyph-name="panorama_vertical" unicode="panorama_vertical" 
-d="M140 85h232c-16 55 -24 113 -24 171s8 116 24 171h-232c16 -55 24 -113 24 -171s-8 -116 -24 -171zM425 61c1 -2 2 -4 2 -6c0 -7 -6 -12 -14 -12h-314c-9 0 -14 5 -14 12c0 2 1 4 2 6c23 63 35 129 35 195s-12 132 -35 195c-1 2 -2 4 -2 6c0 7 5 12 14 12h314
-c9 0 14 -5 14 -12c0 -2 -1 -4 -2 -6c-23 -63 -35 -129 -35 -195s12 -132 35 -195z" />
-    <glyph glyph-name="panorama_wide_angle" unicode="panorama_wide_angle" 
-d="M256 427c58 0 112 -6 170 -16l19 -3l6 -19c12 -44 18 -89 18 -133s-6 -89 -18 -133l-6 -19l-19 -3c-58 -10 -112 -16 -170 -16s-112 6 -170 16l-19 3l-6 19c-12 44 -18 89 -18 133s6 89 18 133l6 19l19 3c58 10 112 16 170 16zM256 384c-52 0 -101 -5 -156 -14
-c-10 -38 -15 -76 -15 -114s5 -76 15 -114c55 -9 104 -14 156 -14s101 5 156 14c10 38 15 76 15 114s-5 76 -15 114c-55 9 -104 14 -156 14z" />
-    <glyph glyph-name="party_mode" unicode="party_mode" 
-d="M256 149c59 0 107 48 107 107c0 7 -1 14 -2 21h-45c2 -7 4 -14 4 -21c0 -35 -29 -64 -64 -64h-85c20 -26 50 -43 85 -43zM256 363c-59 0 -107 -48 -107 -107c0 -7 1 -14 2 -21h45c-2 7 -4 14 -4 21c0 35 29 64 64 64h85c-20 26 -50 43 -85 43zM427 427
-c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h68l39 42h128l39 -42h68z" />
-    <glyph glyph-name="pause" unicode="pause" 
-d="M299 405h85v-298h-85v298zM128 107v298h85v-298h-85z" />
-    <glyph glyph-name="pause_circle_filled" unicode="pause_circle_filled" 
-d="M320 171v170h-43v-170h43zM235 171v170h-43v-170h43zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="pause_circle_outline" unicode="pause_circle_outline" 
-d="M277 171v170h43v-170h-43zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM192 171v170h43v-170h-43z" />
-    <glyph glyph-name="payment" unicode="payment" 
-d="M427 341v43h-342v-43h342zM427 128v128h-342v-128h342zM427 427c24 0 42 -19 42 -43v-256c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v256c0 24 18 43 42 43h342z" />
-    <glyph glyph-name="people" unicode="people" 
-d="M341 235c50 0 150 -25 150 -75v-53h-128v53c0 32 -17 56 -42 74c7 1 14 1 20 1zM171 235c50 0 149 -25 149 -75v-53h-299v53c0 50 100 75 150 75zM171 277c-35 0 -64 29 -64 64s29 64 64 64s63 -29 63 -64s-28 -64 -63 -64zM341 277c-35 0 -64 29 -64 64s29 64 64 64
-s64 -29 64 -64s-29 -64 -64 -64z" />
-    <glyph glyph-name="people_outline" unicode="people_outline" 
-d="M352 373c-23 0 -43 -19 -43 -42s20 -43 43 -43s43 20 43 43s-20 42 -43 42zM352 256c-41 0 -75 34 -75 75s34 74 75 74s75 -33 75 -74s-34 -75 -75 -75zM160 373c-23 0 -43 -19 -43 -42s20 -43 43 -43s43 20 43 43s-20 42 -43 42zM160 256c-41 0 -75 34 -75 75
-s34 74 75 74s75 -33 75 -74s-34 -75 -75 -75zM459 139v26c0 12 -55 38 -107 38c-23 0 -45 -6 -64 -12c7 -8 11 -16 11 -26v-26h160zM267 139v26c0 12 -55 38 -107 38s-107 -26 -107 -38v-26h214zM352 235c46 0 139 -24 139 -70v-58h-470v58c0 46 93 70 139 70
-c26 0 65 -8 96 -22c31 14 70 22 96 22z" />
-    <glyph glyph-name="perm_camera_mic" unicode="perm_camera_mic" 
-d="M299 235v85c0 23 -20 43 -43 43s-43 -20 -43 -43v-85c0 -23 20 -43 43 -43s43 20 43 43zM427 405c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-150v45c60 10 107 63 107 126h-43c0 -47 -38 -86 -85 -86s-85 39 -85 86h-43c0 -63 47 -116 107 -126v-45h-150
-c-23 0 -42 20 -42 43v256c0 23 19 42 42 42h68l39 43h128l39 -43h68z" />
-    <glyph glyph-name="perm_contact_calendar" unicode="perm_contact_calendar" 
-d="M384 128v21c0 43 -85 66 -128 66s-128 -23 -128 -66v-21h256zM256 384c-35 0 -64 -29 -64 -64s29 -64 64 -64s64 29 64 64s-29 64 -64 64zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43
-h43v-43h21z" />
-    <glyph glyph-name="perm_data_setting" unicode="perm_data_setting" 
-d="M405 75c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM484 96l23 -17c2 -2 2 -5 1 -7l-21 -37c-1 -2 -5 -4 -7 -3l-26 11c-5 -4 -12 -7 -18 -10l-4 -29c0 -3 -3 -4 -6 -4h-42c-3 0 -6 1 -6 4l-4 29c-7 3 -12 6 -18 10l-26 -11c-3 -1 -6 1 -7 3l-21 37
-c-1 2 -1 5 1 7l23 17c0 3 -1 7 -1 11s1 7 1 10l-23 18c-2 2 -2 5 -1 7l21 37c1 2 5 3 7 2l26 -11c6 4 12 8 18 11l4 28c0 3 3 4 6 4h42c3 0 6 -1 6 -4l4 -28c7 -3 12 -7 18 -11l26 11c3 1 6 0 7 -2l21 -37c1 -2 1 -5 -1 -7l-23 -18c1 -3 1 -6 1 -10s-1 -8 -1 -11zM405 267
-c-88 0 -160 -72 -160 -160c0 -7 1 -15 2 -22h-247l427 427l-1 -247c-7 1 -14 2 -21 2z" />
-    <glyph glyph-name="perm_device_information" unicode="perm_device_information" 
-d="M363 107v298h-214v-298h214zM363 490c23 0 42 -19 42 -42v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43zM277 277v-128h-42v128h42zM277 363v-43h-42v43h42z" />
-    <glyph glyph-name="perm_identity" unicode="perm_identity" 
-d="M256 235c57 0 171 -29 171 -86v-64h-342v64c0 57 114 86 171 86zM256 427c47 0 85 -39 85 -86s-38 -85 -85 -85s-85 38 -85 85s38 86 85 86zM256 194c-63 0 -130 -31 -130 -45v-23h260v23c0 14 -67 45 -130 45zM256 386c-25 0 -45 -20 -45 -45s20 -44 45 -44s45 19 45 44
-s-20 45 -45 45z" />
-    <glyph glyph-name="perm_media" unicode="perm_media" 
-d="M149 192h299l-75 96l-53 -64l-75 96zM469 427c23 0 43 -20 43 -43v-213c0 -23 -20 -43 -43 -43h-341c-23 0 -43 20 -43 43l1 256c0 23 19 42 42 42h128l43 -42h170zM43 384v-299h384v-42h-384c-23 0 -43 19 -43 42v299h43z" />
-    <glyph glyph-name="perm_phone_msg" unicode="perm_phone_msg" 
-d="M256 448h192v-149h-128l-64 -64v213zM427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -60 81 -110 141 -141l47 47c6 6 15 7 22 5
-c24 -8 49 -12 76 -12z" />
-    <glyph glyph-name="perm_scan_wifi" unicode="perm_scan_wifi" 
-d="M235 341h42v43h-42v-43zM277 171v128h-42v-128h42zM256 448c108 0 189 -40 256 -91l-256 -314l-256 315c67 51 148 90 256 90z" />
-    <glyph glyph-name="person" unicode="person" 
-d="M256 213c57 0 171 -28 171 -85v-43h-342v43c0 57 114 85 171 85zM256 256c-47 0 -85 38 -85 85s38 86 85 86s85 -39 85 -86s-38 -85 -85 -85z" />
-    <glyph glyph-name="person_add" unicode="person_add" 
-d="M320 213c57 0 171 -28 171 -85v-43h-342v43c0 57 114 85 171 85zM128 299h64v-43h-64v-64h-43v64h-64v43h64v64h43v-64zM320 256c-47 0 -85 38 -85 85s38 86 85 86s85 -39 85 -86s-38 -85 -85 -85z" />
-    <glyph glyph-name="person_outline" unicode="person_outline" 
-d="M256 235c57 0 171 -29 171 -86v-64h-342v64c0 57 114 86 171 86zM256 427c47 0 85 -39 85 -86s-38 -85 -85 -85s-85 38 -85 85s38 86 85 86zM256 194c-63 0 -130 -31 -130 -45v-23h260v23c0 14 -67 45 -130 45zM256 386c-25 0 -45 -20 -45 -45s20 -44 45 -44s45 19 45 44
-s-20 45 -45 45z" />
-    <glyph glyph-name="person_pin" unicode="person_pin" 
-d="M384 171v19c0 43 -85 66 -128 66s-128 -23 -128 -66v-19h256zM256 399c-32 0 -58 -26 -58 -58s26 -57 58 -57s58 25 58 57s-26 58 -58 58zM405 469c23 0 43 -19 43 -42v-299c0 -23 -20 -43 -43 -43h-85l-64 -64l-64 64h-85c-24 0 -43 20 -43 43v299c0 23 19 42 43 42h298
-z" />
-    <glyph glyph-name="person_pin_circle" unicode="person_pin_circle" 
-d="M256 213c36 0 67 18 85 46c0 28 -57 44 -85 44s-85 -16 -85 -44c18 -28 49 -46 85 -46zM256 427c-23 0 -43 -20 -43 -43c0 -24 20 -43 43 -43s43 19 43 43c0 23 -20 43 -43 43zM256 469c82 0 149 -67 149 -149c0 -112 -149 -277 -149 -277s-149 165 -149 277
-c0 82 67 149 149 149z" />
-    <glyph glyph-name="personal_video" unicode="personal_video" 
-d="M448 149v256h-384v-256h384zM448 448c23 0 43 -19 43 -43l-1 -256c0 -23 -19 -42 -42 -42h-107v-43h-170v43h-107c-24 0 -43 19 -43 42v256c0 24 19 43 43 43h384z" />
-    <glyph glyph-name="pets" unicode="pets" 
-d="M370 195c28 -28 63 -58 56 -102c-6 -22 -22 -44 -50 -50c-16 -3 -65 9 -118 9h-4c-53 0 -102 -12 -118 -9c-28 6 -44 28 -50 50c-6 43 28 74 56 102c19 22 34 40 53 62c10 12 22 23 37 28c2 1 5 2 7 2c6 1 11 1 17 1s12 0 17 -1c2 0 5 -1 7 -2c15 -5 27 -16 37 -28
-c19 -22 34 -40 53 -62zM363 309c0 29 24 54 53 54s53 -25 53 -54s-24 -53 -53 -53s-53 24 -53 53zM267 395c0 29 24 53 53 53s53 -24 53 -53s-24 -54 -53 -54s-53 25 -53 54zM139 395c0 29 24 53 53 53s53 -24 53 -53s-24 -54 -53 -54s-53 25 -53 54zM43 309
-c0 29 24 54 53 54s53 -25 53 -54s-24 -53 -53 -53s-53 24 -53 53z" />
-    <glyph glyph-name="phone" unicode="phone" 
-d="M141 282c31 -60 81 -110 141 -141l47 47c6 6 15 8 22 5c24 -8 50 -12 76 -12c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22z" />
-    <glyph glyph-name="phone_android" unicode="phone_android" 
-d="M368 128v299h-224v-299h224zM299 64v21h-86v-21h86zM341 491c35 0 64 -29 64 -64v-342c0 -35 -29 -64 -64 -64h-170c-35 0 -64 29 -64 64v342c0 35 29 64 64 64h170z" />
-    <glyph glyph-name="phone_bluetooth_speaker" unicode="phone_bluetooth_speaker" 
-d="M427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -61 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12zM384 358v-40l20 20zM384 450
-v-40l20 20zM314 309l-15 15l59 60l-59 60l15 15l49 -49v81h10l61 -61l-46 -46l46 -46l-61 -61h-10v81z" />
-    <glyph glyph-name="phone_forwarded" unicode="phone_forwarded" 
-d="M427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -61 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12zM384 277v64h-85v86h85v64
-l107 -107z" />
-    <glyph glyph-name="phone_in_talk" unicode="phone_in_talk" 
-d="M320 256c0 35 -29 64 -64 64v43c59 0 107 -48 107 -107h-43zM405 256c0 83 -66 149 -149 149v43c106 0 192 -86 192 -192h-43zM427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76
-c2 -7 1 -16 -5 -22l-47 -47c31 -61 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12z" />
-    <glyph glyph-name="phone_iphone" unicode="phone_iphone" 
-d="M341 128v299h-192v-299h192zM245 43c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM331 491c29 0 53 -25 53 -54v-362c0 -29 -24 -54 -53 -54h-171c-29 0 -53 25 -53 54v362c0 29 24 54 53 54h171z" />
-    <glyph glyph-name="phone_locked" unicode="phone_locked" 
-d="M410 427v10c0 20 -17 37 -37 37s-36 -17 -36 -37v-10h73zM427 427c12 0 21 -10 21 -22v-85c0 -12 -9 -21 -21 -21h-107c-12 0 -21 9 -21 21v85c0 12 9 22 21 22v10c0 29 24 54 53 54s54 -25 54 -54v-10zM427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21
-c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -61 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12z" />
-    <glyph glyph-name="phone_missed" unicode="phone_missed" 
-d="M506 156c4 -4 6 -9 6 -15s-2 -11 -6 -15l-53 -53c-4 -4 -9 -6 -15 -6s-11 2 -15 6c-17 16 -36 30 -57 40c-7 3 -12 11 -12 19v66c-31 10 -64 15 -98 15s-67 -5 -98 -15v-66c0 -9 -5 -17 -12 -20c-21 -10 -40 -23 -57 -39c-4 -4 -9 -6 -15 -6s-11 2 -15 6l-53 53
-c-4 4 -6 9 -6 15s2 11 6 15c65 62 153 100 250 100s185 -38 250 -100zM139 395v-75h-32v128h128v-32h-75l96 -96l128 128l21 -21l-149 -150z" />
-    <glyph glyph-name="phone_paused" unicode="phone_paused" 
-d="M405 448h43v-149h-43v149zM427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -61 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12z
-M363 448v-149h-43v149h43z" />
-    <glyph glyph-name="phonelink" unicode="phonelink" 
-d="M469 149v150h-85v-150h85zM491 341c12 0 21 -9 21 -21v-213c0 -12 -9 -22 -21 -22h-128c-12 0 -22 10 -22 22v213c0 12 10 21 22 21h128zM85 384v-235h214v-64h-299v64h43v235c0 23 19 43 42 43h384v-43h-384z" />
-    <glyph glyph-name="phonelink_erase" unicode="phonelink_erase" 
-d="M405 491c23 0 43 -20 43 -43v-384c0 -23 -20 -43 -43 -43h-213c-23 0 -43 20 -43 43v64h43v-43h213v342h-213v-43h-43v64c0 23 20 43 43 43h213zM277 337l-85 -85l85 -86l-21 -21l-85 85l-86 -85l-21 21l85 86l-85 85l21 21l86 -85l85 85z" />
-    <glyph glyph-name="phonelink_lock" unicode="phonelink_lock" 
-d="M203 277v32c0 17 -15 28 -32 28s-32 -11 -32 -28v-32h64zM230 277c13 0 26 -12 26 -27v-75c0 -13 -13 -26 -28 -26h-117c-13 0 -26 13 -26 28v75c0 13 13 25 26 25v32c0 30 30 54 60 54s59 -24 59 -54v-32zM405 491c23 0 43 -20 43 -43v-384c0 -23 -20 -43 -43 -43h-213
-c-23 0 -43 20 -43 43v64h43v-43h213v342h-213v-43h-43v64c0 23 20 43 43 43h213z" />
-    <glyph glyph-name="phonelink_off" unicode="phonelink_off" 
-d="M491 341c12 0 21 -9 21 -21v-213c0 -12 -9 -22 -21 -22h-4l-64 64h46v150h-85v-111l-43 43v89c0 12 10 21 22 21h128zM85 378v-229h229zM41 477c138.107 -138.226 275.985 -276.682 414 -415l-27 -27l-50 50h-378v64h43v235c0 10 4 20 10 27l-39 39zM469 384h-281l-43 43
-h324v-43z" />
-    <glyph glyph-name="phonelink_ring" unicode="phonelink_ring" 
-d="M299 85v342h-214v-342h214zM299 491c23 0 42 -20 42 -43v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43h214zM384 303c26 -28 26 -66 0 -92l-21 22c11 15 11 34 0 49zM429 348c53 -51 53 -133 0 -182l-22 22c38 41 38 100 0 138z" />
-    <glyph glyph-name="phonelink_setup" unicode="phonelink_setup" 
-d="M405 491c23 0 43 -20 43 -43v-384c0 -23 -20 -43 -43 -43h-213c-23 0 -43 20 -43 43v64h43v-43h213v342h-213v-43h-43v64c0 23 20 43 43 43h213zM171 213c23 0 42 20 42 43s-19 43 -42 43s-43 -20 -43 -43s20 -43 43 -43zM252 245l23 -19c2 -2 4 -4 2 -6l-21 -37
-c-2 -2 -4 -2 -6 -2l-28 11c-6 -4 -13 -9 -19 -11l-5 -27c-2 -2 -4 -5 -6 -5h-43c-2 0 -6 3 -4 5l-4 27c-6 2 -13 7 -19 11l-30 -9c-2 -2 -5 1 -7 3l-21 36c0 2 0 4 2 8l24 17v22l-24 17c-2 2 -4 4 -2 6l21 37c2 2 5 2 7 2l27 -11c6 4 14 9 20 11l4 27c2 2 4 5 6 5h43
-c4 0 6 -3 6 -5l5 -27c6 -2 13 -7 19 -11l28 9c2 2 4 -1 6 -3l21 -36c0 -2 0 -4 -2 -6l-23 -17v-22z" />
-    <glyph glyph-name="photo" unicode="photo" 
-d="M181 224l-74 -96h298l-96 128l-74 -96zM448 107c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298c23 0 43 -20 43 -43v-298z" />
-    <glyph glyph-name="photo_album" unicode="photo_album" 
-d="M128 107h256l-82 109l-64 -82l-46 55zM128 427v-171l53 32l54 -32v171h-107zM384 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v342c0 23 20 42 43 42h256z" />
-    <glyph glyph-name="photo_camera" unicode="photo_camera" 
-d="M256 149c59 0 107 48 107 107s-48 107 -107 107s-107 -48 -107 -107s48 -107 107 -107zM192 469h128l39 -42h68c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h68zM188 256c0 38 30 68 68 68s68 -30 68 -68
-s-30 -68 -68 -68s-68 30 -68 68z" />
-    <glyph glyph-name="photo_filter" unicode="photo_filter" 
-d="M283 283l58 -27l-58 -27l-27 -58l-27 58l-58 27l58 27l27 58zM363 299l-20 44l-44 20l44 20l20 44l20 -44l44 -20l-44 -20zM406 299h42v-192c0 -23 -19 -43 -42 -43h-299c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h192v-43h-192v-298h299v192z" />
-    <glyph glyph-name="photo_library" unicode="photo_library" 
-d="M43 384h42v-299h299v-42h-299c-23 0 -42 19 -42 42v299zM235 256l-64 -85h256l-86 106l-63 -79zM469 171c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256c23 0 42 -19 42 -42v-256z" />
-    <glyph glyph-name="photo_size_select_actual" unicode="photo_size_select_actual" 
-d="M107 149h298l-96 128l-74 -96l-54 64zM448 448c21 0 43 -22 43 -43v-298c0 -21 -22 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 21 22 43 43 43h384z" />
-    <glyph glyph-name="photo_size_select_large" unicode="photo_size_select_large" 
-d="M64 107h213l-68 91l-53 -69l-39 46zM21 277h299v-213h-256c-23 0 -43 20 -43 43v170zM107 448h42v-43h-42v43zM192 448h43v-43h-43v43zM64 448v-43h-43c0 21 22 43 43 43zM363 107h42v-43h-42v43zM363 448h42v-43h-42v43zM21 363h43v-43h-43v43zM448 448
-c21 0 43 -22 43 -43h-43v43zM448 363h43v-43h-43v43zM277 448h43v-43h-43v43zM491 107c0 -21 -22 -43 -43 -43v43h43zM448 277h43v-42h-43v42zM448 192h43v-43h-43v43z" />
-    <glyph glyph-name="photo_size_select_small" unicode="photo_size_select_small" 
-d="M149 448v-43h-42v43h42zM235 448v-43h-43v43h43zM64 277v-42h-43v42h43zM64 448v-43h-43c0 21 22 43 43 43zM405 107v-43h-42v43h42zM405 448v-43h-42v43h42zM320 107v-43h-43v43h43zM64 363v-43h-43v43h43zM64 64c-23 0 -43 20 -43 43v85h214v-128h-171zM448 448
-c21 0 43 -22 43 -43h-43v43zM491 363v-43h-43v43h43zM320 448v-43h-43v43h43zM491 107c0 -21 -22 -43 -43 -43v43h43zM491 277v-42h-43v42h43zM491 192v-43h-43v43h43z" />
-    <glyph glyph-name="picture_as_pdf" unicode="picture_as_pdf" 
-d="M299 267v64h21v-64h-21zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42zM192 309v22h21v-22h-21zM437 331v32h-64v-128h32v42h32v32h-32v22h32zM352 267v64c0 18 -14 32 -32 32h-53v-128h53c18 0 32 14 32 32zM245 309v22c0 18 -14 32 -32 32h-53v-128h32v42h21
-c18 0 32 14 32 32zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256z" />
-    <glyph glyph-name="picture_in_picture" unicode="picture_in_picture" 
-d="M448 106v300h-384v-300h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384zM405 363v-128h-170v128h170z" />
-    <glyph glyph-name="picture_in_picture_alt" unicode="picture_in_picture_alt" 
-d="M448 106v300h-384v-300h384zM491 107c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v299c0 23 20 42 43 42h384c23 0 43 -19 43 -42v-299zM405 277v-128h-170v128h170z" />
-    <glyph glyph-name="pie_chart" unicode="pie_chart" 
-d="M278 234h191c-10 -101 -90 -181 -191 -191v191zM278 469c101 -10 181 -90 191 -191h-191v191zM235 469v-426c-108 11 -192 102 -192 213s84 202 192 213z" />
-    <glyph glyph-name="pie_chart_outlined" unicode="pie_chart_outlined" 
-d="M277 87c77 10 138 71 148 148h-148v-148zM85 256c0 -87 66 -158 150 -169v338c-84 -10 -150 -82 -150 -169zM277 425v-148h148c-10 77 -71 138 -148 148zM256 469c117 0 213 -96 213 -213s-96 -213 -213 -213s-213 96 -213 213s96 213 213 213z" />
-    <glyph glyph-name="pin_drop" unicode="pin_drop" 
-d="M107 85h298v-42h-298v42zM213 341c0 -23 20 -42 43 -42c24 0 43 19 43 42s-20 43 -43 43s-43 -20 -43 -43zM384 341c0 -96 -128 -234 -128 -234s-128 138 -128 234c0 71 57 128 128 128s128 -57 128 -128z" />
-    <glyph glyph-name="place" unicode="place" 
-d="M256 267c29 0 53 24 53 53s-24 53 -53 53s-53 -24 -53 -53s24 -53 53 -53zM256 469c83 0 149 -66 149 -149c0 -112 -149 -277 -149 -277s-149 165 -149 277c0 83 66 149 149 149z" />
-    <glyph glyph-name="play_arrow" unicode="play_arrow" 
-d="M171 405l234 -149l-234 -149v298z" />
-    <glyph glyph-name="play_circle_filled" unicode="play_circle_filled" 
-d="M213 160l128 96l-128 96v-192zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="play_circle_outline" unicode="play_circle_outline" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM213 160v192l128 -96z" />
-    <glyph glyph-name="play_for_work" unicode="play_for_work" 
-d="M128 213h43c0 -47 38 -85 85 -85s85 38 85 85h43c0 -71 -57 -128 -128 -128s-128 57 -128 128zM235 405h42v-119h75l-96 -96l-96 96h75v119z" />
-    <glyph glyph-name="playlist_add" unicode="playlist_add" 
-d="M43 171v42h170v-42h-170zM384 213h85v-42h-85v-86h-43v86h-85v42h85v86h43v-86zM299 384v-43h-256v43h256zM299 299v-43h-256v43h256z" />
-    <glyph glyph-name="playlist_add_check" unicode="playlist_add_check" 
-d="M459 267l32 -32l-149 -150l-97 96l32 32l65 -64zM43 171v42h170v-42h-170zM299 384v-43h-256v43h256zM299 299v-43h-256v43h256z" />
-    <glyph glyph-name="playlist_play" unicode="playlist_play" 
-d="M363 235l106 -64l-106 -64v128zM43 192v43h277v-43h-277zM405 405v-42h-362v42h362zM405 320v-43h-362v43h362z" />
-    <glyph glyph-name="plus_one" unicode="plus_one" 
-d="M309 382l96 23v-277h-42v226l-54 -11v39zM213 341v-85h86v-43h-86v-85h-42v85h-86v43h86v85h42z" />
-    <glyph glyph-name="poll" unicode="poll" 
-d="M363 149v86h-43v-86h43zM277 149v214h-42v-214h42zM192 149v150h-43v-150h43zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="polymer" unicode="polymer" 
-d="M405 427l96 -171l-96 -171h-85l96 171l-56 99l-168 -270h-85l-96 171l96 171h85l-96 -171l56 -99l168 270h85z" />
-    <glyph glyph-name="pool" unicode="pool" 
-d="M299 395c0 29 24 53 53 53s53 -24 53 -53s-24 -54 -53 -54s-53 25 -53 54zM185 256c-12 0 -17 3 -25 8c-4 3 -9 5 -16 8l69 69l-21 22c-24 24 -46 32 -85 32v53c53 0 84 -10 117 -43l137 -136c-3 -2 -6 -4 -9 -5c-8 -5 -13 -8 -25 -8s-16 3 -24 8c-10 6 -23 13 -47 13
-s-37 -7 -47 -13c-8 -5 -12 -8 -24 -8zM469 160c-24 0 -36 8 -46 14c-8 5 -13 7 -25 7s-16 -2 -24 -7c-10 -6 -23 -14 -47 -14s-36 8 -46 14c-8 5 -13 7 -25 7s-16 -2 -24 -7c-10 -6 -23 -14 -47 -14s-36 8 -46 14c-8 5 -13 7 -25 7s-16 -2 -24 -7c-10 -6 -23 -14 -47 -14v43
-c12 0 16 2 24 7c10 6 23 14 47 14s36 -8 46 -14c8 -5 13 -7 25 -7s16 2 24 7c10 6 23 14 47 14s36 -8 46 -14c8 -5 13 -7 25 -7s16 2 24 7c10 6 23 14 47 14s36 -8 46 -14c8 -5 13 -7 25 -7v-43zM469 64c-24 0 -36 8 -46 14c-8 5 -13 7 -25 7s-16 -2 -24 -7
-c-10 -6 -23 -14 -47 -14s-36 8 -46 14c-8 5 -13 7 -25 7s-16 -2 -24 -7c-10 -6 -23 -14 -47 -14s-37 8 -47 14c-8 5 -12 7 -24 7s-17 -2 -25 -7c-10 -6 -22 -14 -46 -14v43c12 0 16 2 24 7c10 6 23 14 47 14s36 -8 46 -14c8 -5 13 -7 25 -7s16 2 24 7c10 6 23 14 47 14
-s37 -8 47 -14c8 -5 12 -7 24 -7s17 2 25 7c10 6 22 14 46 14s37 -8 47 -14c8 -5 12 -7 24 -7v-43z" />
-    <glyph glyph-name="portable_wifi_off" unicode="portable_wifi_off" 
-d="M70 459l21 -22l357 -357l-27 -27l-160 161h-1l-4 -1c-23 0 -43 20 -43 43l1 4l-34 34c-6 -12 -9 -24 -9 -38c0 -32 17 -59 42 -74l-21 -37c-38 22 -64 64 -64 111c0 26 7 49 20 69l-30 31c-20 -28 -33 -62 -33 -100c0 -63 34 -118 85 -148l-21 -37
-c-64 37 -106 106 -106 185c0 49 16 95 44 131l-44 45zM256 427c-29 0 -56 -7 -80 -20l-31 31c32 20 70 31 111 31c118 0 213 -95 213 -213c0 -41 -11 -79 -31 -111l-32 31c13 24 21 51 21 80c0 94 -77 171 -171 171zM375 208l-35 35c1 4 1 9 1 13c0 47 -38 85 -85 85
-c-4 0 -9 0 -13 -1l-35 35c15 6 31 9 48 9c71 0 128 -57 128 -128c0 -17 -3 -33 -9 -48z" />
-    <glyph glyph-name="portrait" unicode="portrait" 
-d="M405 107v298h-298v-298h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298zM352 165v-16h-192v16c0 32 64 48 96 48s96 -16 96 -48zM256 251c-26 0 -48 22 -48 48s22 48 48 48s48 -22 48 -48
-s-22 -48 -48 -48z" />
-    <glyph glyph-name="power" unicode="power" 
-d="M342 363c21 0 42 -22 42 -43v-117l-75 -75v-64h-106v64l-75 75v117c0 21 21 43 42 43h1v85h42v-85h86v85h42z" />
-    <glyph glyph-name="power_input" unicode="power_input" 
-d="M341 192v43h107v-43h-107zM192 192v43h107v-43h-107zM43 192v43h106v-43h-106zM43 320h405v-43h-405v43z" />
-    <glyph glyph-name="power_settings_new" unicode="power_settings_new" 
-d="M380 402c41 -35 68 -88 68 -146c0 -106 -86 -192 -192 -192s-192 86 -192 192c0 58 27 111 68 146l30 -30c-33 -27 -55 -69 -55 -116c0 -83 66 -149 149 -149s149 66 149 149c0 47 -21 88 -55 115zM277 448v-213h-42v213h42z" />
-    <glyph glyph-name="pregnant_woman" unicode="pregnant_woman" 
-d="M341 235v-86h-64v-106h-64v106h-42v150c0 35 29 64 64 64s64 -29 64 -64c25 -10 42 -35 42 -64zM192 427c0 24 19 42 43 42s42 -18 42 -42s-18 -43 -42 -43s-43 19 -43 43z" />
-    <glyph glyph-name="present_to_all" unicode="present_to_all" 
-d="M213 256h-42l85 85l85 -85h-42v-85h-86v85zM448 106v300h-384v-300h384zM448 448c24 0 43 -19 43 -43v-298c0 -24 -19 -43 -43 -43h-384c-24 0 -43 19 -43 43v298c0 24 19 43 43 43h384z" />
-    <glyph glyph-name="print" unicode="print" 
-d="M384 448v-85h-256v85h256zM405 256c12 0 22 9 22 21s-10 22 -22 22s-21 -10 -21 -22s9 -21 21 -21zM341 107v106h-170v-106h170zM405 341c35 0 64 -29 64 -64v-128h-85v-85h-256v85h-85v128c0 35 29 64 64 64h298z" />
-    <glyph glyph-name="priority_high" unicode="priority_high" 
-d="M213 448h86v-256h-86v256zM213 107c0 24 19 42 43 42s43 -18 43 -42s-19 -43 -43 -43s-43 19 -43 43z" />
-    <glyph glyph-name="public" unicode="public" 
-d="M382 141c28 30 45 71 45 115c0 71 -44 133 -107 158v-9c0 -23 -20 -42 -43 -42h-42v-43c0 -12 -10 -21 -22 -21h-42v-43h128c12 0 21 -9 21 -21v-64h21c19 0 35 -13 41 -30zM235 87v41c-23 0 -43 20 -43 43v21l-102 102c-3 -12 -5 -25 -5 -38c0 -87 66 -159 150 -169z
-M256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="publish" unicode="publish" 
-d="M107 213l149 150l149 -150h-85v-128h-128v128h-85zM107 427h298v-43h-298v43z" />
-    <glyph glyph-name="query_builder" unicode="query_builder" 
-d="M267 363v-112l96 -57l-16 -27l-112 68v128h32zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="question_answer" unicode="question_answer" 
-d="M363 256c0 -12 -10 -21 -22 -21h-213l-85 -86v299c0 12 9 21 21 21h277c12 0 22 -9 22 -21v-192zM448 384c12 0 21 -9 21 -21v-320l-85 85h-235c-12 0 -21 9 -21 21v43h277v192h43z" />
-    <glyph glyph-name="queue" unicode="queue" 
-d="M405 277v43h-85v85h-43v-85h-85v-43h85v-85h43v85h85zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42z" />
-    <glyph glyph-name="queue_music" unicode="queue_music" 
-d="M363 384h106v-43h-64v-192c0 -35 -29 -64 -64 -64s-64 29 -64 64s29 64 64 64c7 0 15 -2 22 -4v175zM64 171v42h171v-42h-171zM320 299v-43h-256v43h256zM320 384v-43h-256v43h256z" />
-    <glyph glyph-name="queue_play_next" unicode="queue_play_next" 
-d="M512 128l-96 -96l-32 32l64 64l-64 64l32 32zM277 299h64v-43h-64v-64h-42v64h-64v43h64v64h42v-64zM448 448c23 0 43 -19 43 -43v-170h-43v170h-384v-256h320v-42h-43v-43h-170v43h-107c-24 0 -43 19 -43 42v256c0 24 19 43 43 43h384z" />
-    <glyph glyph-name="radio" unicode="radio" 
-d="M427 256v85h-342v-85h256v43h43v-43h43zM149 85c35 0 64 29 64 64s-29 64 -64 64s-64 -29 -64 -64s29 -64 64 -64zM69 381l270 110l14 -36l-176 -71h250c24 0 42 -19 42 -43v-256c0 -23 -18 -42 -42 -42h-342c-24 0 -42 19 -42 42v256c0 18 10 34 26 40z" />
-    <glyph glyph-name="radio_button_checked" unicode="radio_button_checked" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM256 363c59 0 107 -48 107 -107s-48 -107 -107 -107s-107 48 -107 107s48 107 107 107z" />
-    <glyph glyph-name="radio_button_unchecked" unicode="radio_button_unchecked" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="rate_review" unicode="rate_review" 
-d="M384 213v43h-117l-43 -43h160zM128 213h53l147 147c4 4 4 11 0 15l-38 38c-4 4 -11 4 -15 0l-147 -147v-53zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="receipt" unicode="receipt" 
-d="M64 43v426l32 -32l32 32l32 -32l32 32l32 -32l32 32l32 -32l32 32l32 -32l32 32l32 -32l32 32v-426l-32 32l-32 -32l-32 32l-32 -32l-32 32l-32 -32l-32 32l-32 -32l-32 32l-32 -32l-32 32zM384 320v43h-256v-43h256zM384 235v42h-256v-42h256zM384 149v43h-256v-43h256z
-" />
-    <glyph glyph-name="recent_actors" unicode="recent_actors" 
-d="M267 149v16c0 32 -64 48 -96 48s-96 -16 -96 -48v-16h192zM171 347c-26 0 -48 -22 -48 -48s22 -48 48 -48s48 22 48 48s-22 48 -48 48zM299 405c12 0 21 -9 21 -21v-256c0 -12 -9 -21 -21 -21h-256c-12 0 -22 9 -22 21v256c0 12 10 21 22 21h256zM363 107v298h42v-298
-h-42zM448 405h43v-298h-43v298z" />
-    <glyph glyph-name="record_voice_over" unicode="record_voice_over" 
-d="M428 469c83 -86 83 -215 0 -298l-35 34c59 68 59 166 0 230zM358 398c43 -47 43 -112 0 -155l-36 36c18 25 18 58 0 83zM192 192c57 0 171 -28 171 -85v-43h-342v43c0 57 114 85 171 85zM107 320c0 47 38 85 85 85s85 -38 85 -85s-38 -85 -85 -85s-85 38 -85 85z" />
-    <glyph glyph-name="redeem" unicode="redeem" 
-d="M427 213v128h-109l45 -60l-35 -25c-24.0378 32.6288 -48.3187 65.0147 -72 98c-23.6829 -32.9837 -47.9614 -65.3719 -72 -98l-35 25l45 60h-109v-128h342zM427 107v42h-342v-42h342zM192 427c-12 0 -21 -10 -21 -22s9 -21 21 -21s21 9 21 21s-9 22 -21 22zM320 427
-c-12 0 -21 -10 -21 -22s9 -21 21 -21s21 9 21 21s-9 22 -21 22zM427 384c24 0 42 -19 42 -43v-234c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v234c0 24 18 43 42 43h47c-2 7 -4 14 -4 21c0 35 29 64 64 64c22 0 41 -11 53 -28l11 -15l11 15c12 17 31 28 53 28
-c35 0 64 -29 64 -64c0 -7 -2 -14 -4 -21h47z" />
-    <glyph glyph-name="redo" unicode="redo" 
-d="M393 286l76 77v-192h-192l78 77c-30 25 -68 40 -110 40c-76 0 -140 -49 -162 -117l-50 16c29 89 113 154 212 154c57 0 109 -21 148 -55z" />
-    <glyph glyph-name="refresh" unicode="refresh" 
-d="M377 377l50 50v-150h-150l69 69c-23 23 -55 38 -90 38c-71 0 -128 -57 -128 -128s57 -128 128 -128c56 0 104 35 121 85h44c-19 -74 -85 -128 -165 -128c-94 0 -170 77 -170 171s76 171 170 171c47 0 90 -19 121 -50z" />
-    <glyph glyph-name="remove" unicode="remove" 
-d="M405 235h-298v42h298v-42z" />
-    <glyph glyph-name="remove_circle" unicode="remove_circle" 
-d="M363 235v42h-214v-42h214zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="remove_circle_outline" unicode="remove_circle_outline" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM149 277h214v-42h-214v42z" />
-    <glyph glyph-name="remove_from_queue" unicode="remove_from_queue" 
-d="M341 299v-43h-170v43h170zM448 149v256h-384v-256h384zM448 448c23 0 43 -19 43 -43l-1 -256c0 -23 -19 -42 -42 -42h-107v-43h-170v43h-107c-24 0 -43 19 -43 42v256c0 24 19 43 43 43h384z" />
-    <glyph glyph-name="remove_red_eye" unicode="remove_red_eye" 
-d="M256 320c35 0 64 -29 64 -64s-29 -64 -64 -64s-64 29 -64 64s29 64 64 64zM256 149c59 0 107 48 107 107s-48 107 -107 107s-107 -48 -107 -107s48 -107 107 -107zM256 416c107 0 198 -66 235 -160c-37 -94 -128 -160 -235 -160s-198 66 -235 160c37 94 128 160 235 160z
-" />
-    <glyph glyph-name="remove_shopping_cart" unicode="remove_shopping_cart" 
-d="M149 128c23 0 43 -20 43 -43s-20 -42 -43 -42s-42 19 -42 42s19 43 42 43zM332 235l-192 192h287c12 0 21 -10 21 -22c0 -4 -1 -7 -3 -10l-76 -138c-7 -13 -21 -22 -37 -22zM158 192h108l-43 43h-50l-19 -35l-1 -3c0 -3 2 -5 5 -5zM485 27l-27 -27l-61 61
-c-8 -11 -20 -18 -34 -18c-23 0 -43 19 -43 42c0 14 7 27 18 35l-30 29h-159c-23 0 -42 20 -42 43c0 7 2 14 5 20l29 53l-47 99l-94 94l27 27z" />
-    <glyph glyph-name="reorder" unicode="reorder" 
-d="M64 405h384v-42h-384v42zM64 277v43h384v-43h-384zM64 107v42h384v-42h-384zM64 192v43h384v-43h-384z" />
-    <glyph glyph-name="repeat" unicode="repeat" 
-d="M363 149v86h42v-128h-256v-64l-85 85l85 85v-64h214zM149 363v-86h-42v128h256v64l85 -85l-85 -85v64h-214z" />
-    <glyph glyph-name="repeat_one" unicode="repeat_one" 
-d="M277 192h-32v85h-32v22l43 21h21v-128zM363 149v86h42v-128h-256v-64l-85 85l85 85v-64h214zM149 363v-86h-42v128h256v64l85 -85l-85 -85v64h-214z" />
-    <glyph glyph-name="replay" unicode="replay" 
-d="M256 405c94 0 171 -76 171 -170s-77 -171 -171 -171s-171 77 -171 171h43c0 -71 57 -128 128 -128s128 57 128 128s-57 128 -128 128v-86l-107 107l107 107v-86z" />
-    <glyph glyph-name="replay_10" unicode="replay_&#x31;&#x30;" 
-d="M282 188c0 -3.2653 6.32517 -7 10 -7c2 0 5 0 7 2l4 5s2 4 2 6v43c0 0 -2 4 -2 6c0 2.75261 -8.21183 7 -11 7c-2 0 -4 -1 -6 -3l-4 -4s-3 -4 -3 -6v-43s3 -4 3 -6zM324 209c0 -6 0 -13 -2 -17l-6 -13s-7 -6 -11 -6s-9 -2 -13 -2s-9 0 -13 2s-6 4 -10 6
-c-6.74403 3.37202 -9 19.7461 -9 30v15c0 6 0 13 2 17l7 13s6 6 10 6s9 2 13 2s9 0 13 -2s7 -4 11 -6s4 -7 6 -13s2 -11 2 -17v-15zM233 171h-20v70l-21 -6v15l38 12h3v-91zM256 405c94 0 171 -76 171 -170s-77 -171 -171 -171s-171 77 -171 171h43c0 -70 58 -128 128 -128
-s128 58 128 128s-58 128 -128 128v-86l-107 107l107 107v-86z" />
-    <glyph glyph-name="replay_30" unicode="replay_&#x33;&#x30;" 
-d="M286 188c0 -3.76553 6.92157 -7 11 -7c2 0 4 0 6 2l4 5s2 4 2 6v43c0 2 -2 4 -2 6c0 2.33563 -7.56075 7 -10 7c-2 0 -5 -1 -7 -3l-4 -4s-2 -4 -2 -6v-43s2 -4 2 -6zM326 209c0 -6 0 -13 -2 -17l-6 -13s-7 -6 -11 -6s-9 -2 -13 -2c-10.126 0 -16.1493 4.57466 -23 8
-c-4 2 -4 7 -6 13s-3 11 -3 17v15c0 6 1 13 3 17l6 13s7 6 11 6s8 2 12 2s9 0 13 -2s7 -4 11 -6s4 -7 6 -13s2 -11 2 -17v-15zM213 224c8.11936 0 15 4.95913 15 13v4s-2 2 -2 4s-2 2 -4 2h-11s-2 -2 -4 -2s-2 -2 -2 -4v-4h-22c0 9.89385 8.81974 23 18 23c2 0 8 2 10 2
-c8.67272 0 17.6319 -2.81597 24 -6c5.06488 -2.53244 8 -12.109 8 -19v-7s-2 -4 -2 -6s-2 -4 -4 -4s-5 -3 -7 -5c4 -2 9 -4 11 -8s4 -9 4 -13s0 -9 -2 -11s-4 -6 -6 -8s-7 -4 -11 -4s-9 -2 -13 -2s-8 0 -10 2s-7 2 -11 4c-5.58093 2.79046 -9 13.5084 -9 21h18v-4s2 -2 2 -4
-s2 -2 4 -2h11s2 2 4 2s2 2 2 4v11s-2 2 -2 4s-2 2 -4 2h-13v15h8zM256 405c94 0 171 -76 171 -170s-77 -171 -171 -171s-171 77 -171 171h43c0 -70 58 -128 128 -128s128 58 128 128s-58 128 -128 128v-86l-107 107l107 107v-86z" />
-    <glyph glyph-name="replay_5" unicode="replay_&#x35;" 
-d="M252 222c-1.79204 -0.716817 -7 -2.40231 -7 -4c0 -2 -2 -3 -2 -3h-15l5 47h51v-15h-37l-2 -19s2 0 2 2s3 1 3 3s2 0 4 0h4c4 0 9 -1 11 -3s6 -4 8 -6c4.43641 -4.43641 9 -13.6284 9 -23c0 -4 0 -9 -2 -11s-3 -7 -7 -11s-6 -4 -8 -6s-9 -2 -13 -2s-9 0 -11 2s-6 2 -10 4
-c-5.5956 2.7978 -9 11.277 -9 19h17c0 -7.40446 5.29508 -10 13 -10c2 0 4 0 6 2l5 4s2 4 2 6v13l-2 4l-5 5s-4 2 -6 2h-4zM256 405c94 0 171 -76 171 -170s-77 -171 -171 -171s-171 77 -171 171h43c0 -70 58 -128 128 -128s128 58 128 128s-58 128 -128 128v-86l-107 107
-l107 107v-86z" />
-    <glyph glyph-name="reply" unicode="reply" 
-d="M213 320c149 -21 214 -128 235 -235c-53 75 -128 109 -235 109v-87l-149 149l149 149v-85z" />
-    <glyph glyph-name="reply_all" unicode="reply_all" 
-d="M277 320c149 -21 214 -128 235 -235c-53 75 -128 109 -235 109v-87l-149 149l149 149v-85zM149 341l-85 -85l85 -85v-64l-149 149l149 149v-64z" />
-    <glyph glyph-name="report" unicode="report" 
-d="M277 235v128h-42v-128h42zM256 143c15 0 28 13 28 28s-13 27 -28 27s-28 -12 -28 -27s13 -28 28 -28zM336 448l112 -112v-160l-112 -112h-160l-112 112v160l112 112h160z" />
-    <glyph glyph-name="report_problem" unicode="report_problem" 
-d="M277 213v86h-42v-86h42zM277 128v43h-42v-43h42zM21 64l235 405l235 -405h-470z" />
-    <glyph glyph-name="restaurant" unicode="restaurant" 
-d="M341 384c0 38 48 85 107 85v-426h-53v170h-54v171zM235 320v149h42v-149c0 -45 -35 -82 -80 -85v-192h-53v192c-45 3 -80 40 -80 85v149h43v-149h42v149h43v-149h43z" />
-    <glyph glyph-name="restaurant_menu" unicode="restaurant_menu" 
-d="M317 266l-31 -31l147 -147l-30 -30l-147 147l-147 -147l-30 30l208 208c-15 33 -4 79 30 113c41 41 99 48 130 17s24 -90 -17 -131c-34 -34 -80 -44 -113 -29zM173 227l-90 90c-33 33 -33 87 0 120l150 -149z" />
-    <glyph glyph-name="restore" unicode="restore" 
-d="M256 341h32v-90l75 -45l-16 -26l-91 55v106zM277 448c106 0 192 -86 192 -192s-86 -192 -192 -192c-53 0 -100 21 -135 56l30 31c27 -27 64 -44 105 -44c83 0 150 66 150 149s-67 149 -150 149s-149 -66 -149 -149h64l-86 -86l-2 3l-83 83h64c0 106 86 192 192 192z" />
-    <glyph glyph-name="restore_page" unicode="restore_page" 
-d="M256 128c59 0 107 48 107 107s-48 106 -107 106c-38 0 -71 -20 -90 -49l-27 28v-85h85l-34 34c12 24 37 40 66 40c41 0 75 -33 75 -74s-34 -75 -75 -75c-25 0 -48 13 -61 32h-37c16 -38 54 -64 98 -64zM299 469l128 -128v-256c0 -23 -20 -42 -43 -42h-256
-c-23 0 -43 19 -43 42l1 342c0 23 19 42 42 42h171z" />
-    <glyph glyph-name="ring_volume" unicode="ring_volume" 
-d="M137 303c0 0 -74 74 -76 75l30 31l76 -76zM277 469v-106h-42v106h42zM451 378c-2 -1 -76 -75 -76 -75l-30 30l76 76zM506 156c4 -4 6 -9 6 -15s-2 -11 -6 -15l-53 -53c-4 -4 -9 -6 -15 -6s-11 2 -15 6c-17 16 -36 30 -57 40c-7 3 -12 11 -12 19v66c-31 10 -64 15 -98 15
-s-67 -5 -98 -15v-66c0 -9 -5 -17 -12 -20c-21 -10 -40 -23 -57 -39c-4 -4 -9 -6 -15 -6s-11 2 -15 6l-53 53c-4 4 -6 9 -6 15s2 11 6 15c65 62 153 100 250 100s185 -38 250 -100z" />
-    <glyph glyph-name="room" unicode="room" 
-d="M256 267c29 0 53 24 53 53s-24 53 -53 53s-53 -24 -53 -53s24 -53 53 -53zM256 469c83 0 149 -66 149 -149c0 -112 -149 -277 -149 -277s-149 165 -149 277c0 83 66 149 149 149z" />
-    <glyph glyph-name="room_service" unicode="room_service" 
-d="M295 346c83 -17 147 -88 153 -175h-384c6 87 70 158 153 175c-2 5 -4 11 -4 17c0 23 20 42 43 42s43 -19 43 -42c0 -6 -2 -12 -4 -17zM43 149h426v-42h-426v42z" />
-    <glyph glyph-name="rotate_90_degrees_ccw" unicode="rotate_&#x39;&#x30;_degrees_ccw" 
-d="M413 370c75 -75 75 -196 0 -271c-37 -38 -87 -56 -136 -56c-32 0 -63 8 -92 24l32 31c19 -9 39 -13 60 -13c38 0 77 15 106 44c58 58 58 153 0 211c-29 29 -68 44 -106 44v-69l-90 90l90 91v-69c49 0 99 -19 136 -57zM79 237l78 -78l78 78l-78 78zM157 375l138 -138
-l-138 -138l-139 138z" />
-    <glyph glyph-name="rotate_left" unicode="rotate_left" 
-d="M277 425c84 -10 150 -82 150 -169s-66 -159 -150 -169v43c61 10 107 63 107 126s-46 116 -107 126v-83l-97 95l97 97v-66zM151 121l31 31c16 -12 34 -19 53 -22v-43c-30 4 -59 15 -84 34zM130 235c3 -19 10 -37 21 -53l-30 -30c-19 25 -30 53 -34 83h43zM152 330
-c-11 -16 -19 -34 -22 -53h-43c4 30 16 58 35 83z" />
-    <glyph glyph-name="rotate_right" unicode="rotate_right" 
-d="M360 182c12 16 19 34 22 53h43c-4 -30 -15 -58 -34 -83zM277 130c19 3 37 10 53 22l31 -31c-25 -19 -54 -30 -84 -34v43zM425 277h-43c-3 19 -10 37 -22 53l31 30c19 -25 30 -53 34 -83zM332 394l-97 -95v83c-61 -10 -107 -63 -107 -126s46 -116 107 -126v-43
-c-84 10 -150 82 -150 169s66 159 150 169v66z" />
-    <glyph glyph-name="rounded_corner" unicode="rounded_corner" 
-d="M448 341v-106h-43v106c0 35 -29 64 -64 64h-106v43h106c59 0 107 -48 107 -107zM64 64v43h43v-43h-43zM149 64v43h43v-43h-43zM235 64v43h42v-43h-42zM149 405v43h43v-43h-43zM64 405v43h43v-43h-43zM64 320v43h43v-43h-43zM64 149v43h43v-43h-43zM64 235v42h43v-42h-43z
-M405 149v43h43v-43h-43zM405 107h43v-43h-43v43z" />
-    <glyph glyph-name="router" unicode="router" 
-d="M320 128v43h-43v-43h43zM245 128v43h-42v-43h42zM171 128v43h-43v-43h43zM405 235c23 0 43 -20 43 -43v-85c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v85c0 23 20 43 43 43h213v85h43v-85h42zM412 369l-17 -17c-15 15 -35 21 -54 21s-38 -6 -53 -21l-17 17
-c19 19 44 30 70 30s52 -11 71 -30zM431 386c-26 23 -58 36 -90 36s-63 -13 -89 -36l-17 17c30 30 68 45 106 45s77 -15 107 -45z" />
-    <glyph glyph-name="rowing" unicode="rowing" 
-d="M448 64l-64 -64l-64 64v32l-151 151c-7 -1 -14 -1 -20 -1v46c35 -1 77 18 100 43l30 33c7.60688 7.60688 20.1539 16 35 16h1c26 0 48 -22 48 -48v-123c0 -18 -8 -34 -20 -46l-76 76v49c-13 -11 -31 -22 -49 -30l134 -134h32zM320 491c23 0 43 -20 43 -43
-s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM181 203l54 -54h-43l-75 -74l-32 32z" />
-    <glyph glyph-name="rss_feed" unicode="rss_feed" 
-d="M85 297c117 0 212 -95 212 -212h-61c0 83 -68 151 -151 151v61zM85 417c183 0 332 -149 332 -332h-60c0 150 -122 272 -272 272v60zM85 132c0 26 21 46 47 46s46 -20 46 -46s-20 -47 -46 -47s-47 21 -47 47z" />
-    <glyph glyph-name="rv_hookup" unicode="rv_hookup" 
-d="M363 469l64 -64l-64 -64v43h-171v43h171v42zM384 213v64h-85v-64h85zM235 85c12 0 21 10 21 22s-9 21 -21 21s-22 -9 -22 -21s10 -22 22 -22zM427 149h42v-42h-170c0 -35 -29 -64 -64 -64s-64 29 -64 64h-43c-23 0 -43 19 -43 42v64h150v64h-86v-42l-64 64l64 64v-43h235
-c23 0 43 -20 43 -43v-128z" />
-    <glyph glyph-name="satellite" unicode="satellite" 
-d="M107 128h298l-96 128l-74 -96l-54 64zM107 256c83 0 149 67 149 150h-43c0 -59 -47 -107 -106 -107v-43zM107 406v-65c35 0 64 30 64 65h-64zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298z" />
-    <glyph glyph-name="save" unicode="save" 
-d="M320 320v85h-213v-85h213zM256 107c35 0 64 29 64 64s-29 64 -64 64s-64 -29 -64 -64s29 -64 64 -64zM363 448l85 -85v-256c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h256z" />
-    <glyph glyph-name="scanner" unicode="scanner" 
-d="M405 149v43h-213v-43h213zM149 149v43h-42v-43h42zM422 284c15 -4 26 -22 26 -39v-117c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v85c0 23 20 43 43 43h268l-300 109l15 40z" />
-    <glyph glyph-name="schedule" unicode="schedule" 
-d="M267 363v-112l96 -57l-16 -27l-112 68v128h32zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="school" unicode="school" 
-d="M256 448l235 -128v-171h-43v148l-192 -105l-235 128zM107 231l149 -82l149 82v-86l-149 -81l-149 81v86z" />
-    <glyph glyph-name="screen_lock_landscape" unicode="screen_lock_landscape" 
-d="M230 299v-22h52v22c0 14 -12 25 -26 25s-26 -11 -26 -25zM213 171c-12 0 -21 9 -21 21v64c0 12 9 21 21 21v22c0 23 19 42 43 42c23 0 43 -18 43 -42v-22c12 0 21 -9 21 -21v-64c0 -12 -9 -21 -21 -21h-86zM405 149v214h-298v-214h298zM448 405c23 0 43 -19 43 -42v-214
-c0 -23 -20 -42 -43 -42h-384c-23 0 -43 19 -43 42v214c0 23 20 42 43 42h384z" />
-    <glyph glyph-name="screen_lock_portrait" unicode="screen_lock_portrait" 
-d="M363 107v298h-214v-298h214zM363 491c23 0 42 -20 42 -43v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43h214zM230 299v-22h52v22c0 14 -12 25 -26 25s-26 -11 -26 -25zM213 171c-12 0 -21 9 -21 21v64c0 12 9 21 21 21v22
-c0 23 19 42 43 42c23 0 43 -18 43 -42v-22c12 0 21 -9 21 -21v-64c0 -12 -9 -21 -21 -21h-86z" />
-    <glyph glyph-name="screen_lock_rotation" unicode="screen_lock_rotation" 
-d="M358 459v-11h73v11c0 20 -16 36 -36 36s-37 -16 -37 -36zM341 320c-12 0 -21 9 -21 21v86c0 12 9 21 21 21v11c0 29 25 53 54 53s53 -24 53 -53v-11c12 0 21 -9 21 -21v-86c0 -12 -9 -21 -21 -21h-107zM181 75l28 28l81 -81l-14 -1c-134 0 -244 104 -255 235h32
-c8 -80 58 -148 128 -181zM496 240c13 -12 13 -33 0 -46l-136 -135c-12 -13 -32 -13 -45 0l-256 256c-13 12 -13 32 0 45l135 136c12 13 33 13 46 0l52 -52l-30 -30l-45 44l-121 -120l242 -242l120 121l-47 47l30 30z" />
-    <glyph glyph-name="screen_rotation" unicode="screen_rotation" 
-d="M160 54l29 28l81 -81l-14 -1c-134 0 -244 104 -255 235h32c8 -80 57 -148 127 -181zM316 60l136 136l-256 256l-136 -136zM218 475l257 -257c13 -12 13 -32 0 -45l-136 -136c-12 -13 -32 -13 -45 0l-257 257c-13 12 -13 32 0 45l136 136c12 13 32 13 45 0zM352 458
-l-29 -28l-81 81l14 1c134 0 244 -104 255 -235h-32c-8 80 -57 148 -127 181z" />
-    <glyph glyph-name="screen_share" unicode="screen_share" 
-d="M277 203l86 80l-86 80v-46c-83 -12 -116 -68 -128 -125c30 40 69 58 128 58v-47zM427 128h85v-43h-512v43h85c-24 0 -42 20 -42 43v213c0 24 18 43 42 43h342c23 0 42 -19 42 -43v-213c0 -23 -19 -43 -42 -43z" />
-    <glyph glyph-name="sd_card" unicode="sd_card" 
-d="M384 341v86h-43v-86h43zM320 341v86h-43v-86h43zM256 341v86h-43v-86h43zM384 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42l1 256l127 128h171z" />
-    <glyph glyph-name="sd_storage" unicode="sd_storage" 
-d="M384 341v86h-43v-86h43zM320 341v86h-43v-86h43zM256 341v86h-43v-86h43zM384 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42l1 256l127 128h171z" />
-    <glyph glyph-name="search" unicode="search" 
-d="M203 213c53 0 96 43 96 96s-43 96 -96 96s-96 -43 -96 -96s43 -96 96 -96zM331 213l106 -106l-32 -32l-106 106v17l-6 6c-24 -21 -56 -33 -90 -33c-77 0 -139 61 -139 138s62 139 139 139s138 -62 138 -139c0 -34 -12 -66 -33 -90l6 -6h17z" />
-    <glyph glyph-name="security" unicode="security" 
-d="M256 491l192 -86v-128c0 -118 -82 -229 -192 -256c-110 27 -192 138 -192 256v128zM256 256v-191c79 25 138 103 149 191h-149zM256 256v188l-149 -66v-122h149z" />
-    <glyph glyph-name="select_all" unicode="select_all" 
-d="M192 320v-128h128v128h-128zM149 149v214h214v-214h-214zM320 405v43h43v-43h-43zM320 64v43h43v-43h-43zM405 149v43h43v-43h-43zM405 320v43h43v-43h-43zM405 64v43h43c0 -23 -20 -43 -43 -43zM405 235v42h43v-42h-43zM235 64v43h42v-43h-42zM192 448v-43h-43v43h43z
-M64 149v43h43v-43h-43zM107 64c-23 0 -43 20 -43 43h43v-43zM405 448c23 0 43 -20 43 -43h-43v43zM277 448v-43h-42v43h42zM64 320v43h43v-43h-43zM149 64v43h43v-43h-43zM64 235v42h43v-42h-43zM64 405c0 23 20 43 43 43v-43h-43z" />
-    <glyph glyph-name="send" unicode="send" 
-d="M43 64v149l320 43l-320 43v149l448 -192z" />
-    <glyph glyph-name="sentiment_dissatisfied" unicode="sentiment_dissatisfied" 
-d="M256 213c50 0 92 -30 109 -74h-35c-15 25 -42 42 -74 42s-59 -17 -74 -42h-35c17 44 59 74 109 74zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213
-s95 213 213 213zM149 309c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32zM299 309c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32z" />
-    <glyph glyph-name="sentiment_neutral" unicode="sentiment_neutral" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM149 309c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32zM299 309
-c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32zM192 213h128v-32h-128v32z" />
-    <glyph glyph-name="sentiment_satisfied" unicode="sentiment_satisfied" 
-d="M256 171c32 0 59 17 74 42h35c-17 -44 -59 -74 -109 -74s-92 30 -109 74h35c15 -25 42 -42 74 -42zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213
-s95 213 213 213zM149 309c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32zM299 309c0 18 14 32 32 32s32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32z" />
-    <glyph glyph-name="sentiment_very_dissatisfied" unicode="sentiment_very_dissatisfied" 
-d="M256 213c50 0 92 -30 109 -74h-218c17 44 59 74 109 74zM167 256l-23 23l23 22l-23 23l23 22l22 -22l23 22l23 -22l-23 -23l23 -22l-23 -23l-23 23zM345 346l23 -22l-23 -23l23 -22l-23 -23l-22 23l-23 -23l-23 23l23 22l-23 23l23 22l23 -22zM256 85
-c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="sentiment_very_satisfied" unicode="sentiment_very_satisfied" 
-d="M256 139c-50 0 -92 30 -109 74h218c-17 -44 -59 -74 -109 -74zM189 300l-22 -23l-23 23l45 45l46 -45l-23 -23zM277 300l46 45l45 -45l-23 -23l-22 23l-23 -23zM256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469
-c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="settings" unicode="settings" 
-d="M256 181c41 0 75 34 75 75s-34 75 -75 75s-75 -34 -75 -75s34 -75 75 -75zM415 235l45 -35c4 -3 5 -9 2 -14l-43 -74c-3 -5 -8 -6 -13 -4l-53 21c-11 -8 -23 -16 -36 -21l-8 -56c-1 -5 -5 -9 -10 -9h-86c-5 0 -9 4 -10 9l-8 56c-13 5 -25 12 -36 21l-53 -21
-c-5 -2 -10 -1 -13 4l-43 74c-3 5 -2 11 2 14l45 35c-1 7 -1 14 -1 21s0 14 1 21l-45 35c-4 3 -5 9 -2 14l43 74c3 5 8 6 13 4l53 -21c11 8 23 16 36 21l8 56c1 5 5 9 10 9h86c5 0 9 -4 10 -9l8 -56c13 -5 25 -12 36 -21l53 21c5 2 10 1 13 -4l43 -74c3 -5 2 -11 -2 -14
-l-45 -35c1 -7 1 -14 1 -21s0 -14 -1 -21z" />
-    <glyph glyph-name="settings_applications" unicode="settings_applications" 
-d="M368 256c0 5 0 10 -1 15l32 24c3 2 3 7 1 10l-30 52c-2 3 -6 4 -9 3l-37 -15c-8 6 -16 11 -25 15l-6 39c-1 3 -3 6 -7 6h-60c-4 0 -6 -2 -7 -6l-6 -40c-9 -4 -17 -8 -25 -14l-37 15c-3 1 -7 -1 -9 -4l-30 -51c-2 -3 -2 -8 1 -10l32 -24c-1 -5 -1 -10 -1 -15s0 -10 1 -15
-l-32 -24c-3 -2 -3 -7 -1 -10l30 -52c2 -3 6 -4 9 -3l37 15c8 -6 16 -11 25 -15l6 -39c1 -3 3 -6 7 -6h60c4 0 6 2 7 6l6 40c9 4 17 8 25 14l37 -15c3 -1 7 1 9 4l30 51c2 3 2 8 -1 10l-32 24c1 5 1 10 1 15zM405 448c24 0 43 -20 43 -43v-298c0 -23 -19 -43 -43 -43h-298
-c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h298zM256 299c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43z" />
-    <glyph glyph-name="settings_backup_restore" unicode="settings_backup_restore" 
-d="M256 448c106 0 192 -86 192 -192s-86 -192 -192 -192c-44 0 -85 15 -117 40l30 30c25 -17 55 -27 87 -27c83 0 149 66 149 149s-66 149 -149 149s-149 -66 -149 -149h64l-86 -85l-85 85h64c0 106 86 192 192 192zM299 256c0 -23 -20 -43 -43 -43s-43 20 -43 43
-s20 43 43 43s43 -20 43 -43z" />
-    <glyph glyph-name="settings_bluetooth" unicode="settings_bluetooth" 
-d="M317 207l-40 40v-80zM277 430v-80l40 40zM378 390l-92 -91l92 -92l-122 -122h-21v162l-98 -98l-30 30l119 120l-119 119l30 30l98 -98v162h21zM320 0v43h43v-43h-43zM149 0v43h43v-43h-43zM235 0v43h42v-43h-42z" />
-    <glyph glyph-name="settings_brightness" unicode="settings_brightness" 
-d="M256 320v-128c35 0 64 29 64 64s-29 64 -64 64zM171 171v53l-32 32l32 32v53h53l32 32l32 -32h53v-53l32 -32l-32 -32v-53h-53l-32 -32l-32 32h-53zM448 106v300h-384v-300h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298
-c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="settings_cell" unicode="settings_cell" 
-d="M341 171v256h-170v-256h170zM341 512c23 0 43 -20 43 -43v-341c0 -23 -20 -43 -43 -43h-170c-23 0 -43 20 -43 43v341c0 23 20 43 43 43h170zM320 0v43h43v-43h-43zM235 0v43h42v-43h-42zM149 0v43h43v-43h-43z" />
-    <glyph glyph-name="settings_ethernet" unicode="settings_ethernet" 
-d="M379 395l116 -139l-116 -139l-33 27l93 112l-93 112zM235 235v42h42v-42h-42zM363 277v-42h-43v42h43zM149 235v42h43v-42h-43zM166 368l-93 -112l93 -112l-33 -27l-116 139l116 139z" />
-    <glyph glyph-name="settings_input_antenna" unicode="settings_input_antenna" 
-d="M256 491c129 0 235 -106 235 -235h-43c0 106 -86 192 -192 192s-192 -86 -192 -192h-43c0 129 106 235 235 235zM277 207v-70l73 -73l-30 -30l-64 64l-64 -64l-30 30l73 73v70c-19 8 -32 27 -32 49c0 29 24 53 53 53s53 -24 53 -53c0 -22 -13 -41 -32 -49zM256 405
-c83 0 149 -66 149 -149h-42c0 59 -48 107 -107 107s-107 -48 -107 -107h-42c0 83 66 149 149 149z" />
-    <glyph glyph-name="settings_input_component" unicode="settings_input_component" 
-d="M363 171v42h128v-42c0 -28 -18 -51 -43 -60v-90h-43v90c-25 9 -42 32 -42 60zM277 469v-85h43v-128h-128v128h43v85c0 12 9 22 21 22s21 -10 21 -22zM448 384h43v-128h-128v128h42v85c0 12 10 22 22 22s21 -10 21 -22v-85zM21 171v42h128v-42c0 -28 -17 -51 -42 -60v-90
-h-43v90c-25 9 -43 32 -43 60zM192 171v42h128v-42c0 -28 -18 -51 -43 -60v-90h-42v90c-25 9 -43 32 -43 60zM107 469v-85h42v-128h-128v128h43v85c0 12 9 22 21 22s22 -10 22 -22z" />
-    <glyph glyph-name="settings_input_composite" unicode="settings_input_composite" 
-d="M363 171v42h128v-42c0 -28 -18 -51 -43 -60v-90h-43v90c-25 9 -42 32 -42 60zM277 469v-85h43v-128h-128v128h43v85c0 12 9 22 21 22s21 -10 21 -22zM448 384h43v-128h-128v128h42v85c0 12 10 22 22 22s21 -10 21 -22v-85zM21 171v42h128v-42c0 -28 -17 -51 -42 -60v-90
-h-43v90c-25 9 -43 32 -43 60zM192 171v42h128v-42c0 -28 -18 -51 -43 -60v-90h-42v90c-25 9 -43 32 -43 60zM107 469v-85h42v-128h-128v128h43v85c0 12 9 22 21 22s22 -10 22 -22z" />
-    <glyph glyph-name="settings_input_hdmi" unicode="settings_input_hdmi" 
-d="M171 427v-64h42v42h22v-42h42v42h22v-42h42v64h-170zM384 363h21v-128l-64 -128v-64h-170v64l-64 128v128h21v64c0 23 20 42 43 42h170c23 0 43 -19 43 -42v-64z" />
-    <glyph glyph-name="settings_input_svideo" unicode="settings_input_svideo" 
-d="M331 192c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM373 299c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM256 64c106 0 192 86 192 192s-86 192 -192 192s-192 -86 -192 -192s86 -192 192 -192zM256 491
-c129 0 235 -106 235 -235s-106 -235 -235 -235s-235 106 -235 235s106 235 235 235zM181 192c18 0 32 -14 32 -32s-14 -32 -32 -32s-32 14 -32 32s14 32 32 32zM320 373c0 -18 -14 -32 -32 -32h-64c-18 0 -32 14 -32 32s14 32 32 32h64c18 0 32 -14 32 -32zM171 267
-c0 -18 -14 -32 -32 -32s-32 14 -32 32s14 32 32 32s32 -14 32 -32z" />
-    <glyph glyph-name="settings_overscan" unicode="settings_overscan" 
-d="M448 106v300h-384v-300h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384zM299 171l-43 -54l-43 54h86zM128 299v-86l-53 43zM384 299l53 -43l-53 -43v86zM256 395l43 -54h-86z" />
-    <glyph glyph-name="settings_phone" unicode="settings_phone" 
-d="M405 320h43v-43h-43v43zM427 181c12 0 21 -9 21 -21v-75c0 -12 -9 -21 -21 -21c-200 0 -363 163 -363 363c0 12 9 21 21 21h75c12 0 21 -9 21 -21c0 -27 4 -52 12 -76c2 -7 1 -16 -5 -22l-47 -47c31 -60 81 -110 141 -141l47 47c6 6 15 7 22 5c24 -8 49 -12 76 -12z
-M363 320v-43h-43v43h43zM277 320v-43h-42v43h42z" />
-    <glyph glyph-name="settings_power" unicode="settings_power" 
-d="M320 0v43h43v-43h-43zM353 417c44 -31 74 -82 74 -140c0 -94 -77 -170 -171 -170s-171 76 -171 170c0 58 30 109 74 140l30 -30c-37 -23 -61 -64 -61 -110c0 -71 57 -128 128 -128s128 57 128 128c0 46 -25 87 -62 109zM277 469v-213h-42v213h42zM235 0v43h42v-43h-42z
-M149 0v43h43v-43h-43z" />
-    <glyph glyph-name="settings_remote" unicode="settings_remote" 
-d="M256 512c65 0 124 -26 166 -69l-30 -30c-35 35 -83 56 -136 56s-101 -21 -136 -56l-30 30c42 42 101 69 166 69zM150 383c27 27 65 44 106 44s79 -17 106 -44l-30 -30c-19 19 -47 31 -76 31s-57 -12 -76 -31zM256 192c23 0 43 20 43 43s-20 42 -43 42s-43 -19 -43 -42
-s20 -43 43 -43zM320 320c12 0 21 -9 21 -21v-256c0 -12 -9 -22 -21 -22h-128c-12 0 -21 10 -21 22v256c0 12 9 21 21 21h128z" />
-    <glyph glyph-name="settings_system_daydream" unicode="settings_system_daydream" 
-d="M448 106v300h-384v-300h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384zM192 171c-35 0 -64 29 -64 64c0 33 25 60 57 63h4c12 25 37 43 67 43c38 0 69 -28 74 -64h1c29 0 53 -24 53 -53
-s-24 -53 -53 -53h-139z" />
-    <glyph glyph-name="settings_voice" unicode="settings_voice" 
-d="M405 299c0 -73 -58 -134 -128 -144v-70h-42v70c-70 10 -128 71 -128 144h36c0 -64 54 -109 113 -109s113 45 113 109h36zM320 0v43h43v-43h-43zM235 0v43h42v-43h-42zM256 235c-35 0 -64 29 -64 64v128c0 35 29 64 64 64s64 -29 64 -64v-128c0 -35 -29 -64 -64 -64z
-M149 0v43h43v-43h-43z" />
-    <glyph glyph-name="share" unicode="share" 
-d="M384 169c34 0 62 -28 62 -62s-28 -63 -62 -63s-62 29 -62 63c0 5 0 10 1 14l-151 88c-12 -11 -27 -17 -44 -17c-35 0 -64 29 -64 64s29 64 64 64c17 0 32 -6 44 -17l150 87c-1 5 -2 10 -2 15c0 35 29 64 64 64s64 -29 64 -64s-29 -64 -64 -64c-17 0 -32 7 -44 18
-l-150 -88c1 -5 2 -10 2 -15s-1 -10 -2 -15l152 -88c11 10 26 16 42 16z" />
-    <glyph glyph-name="shop" unicode="shop" 
-d="M192 128l160 107l-160 85v-192zM213 427v-43h86v43h-86zM341 384h128v-277c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v277h128v43c0 24 18 42 42 42h86c24 0 42 -18 42 -42v-43z" />
-    <glyph glyph-name="shop_two" unicode="shop_two" 
-d="M256 192l117 85l-117 64v-149zM256 448v-43h85v43h-85zM384 405h107v-234c0 -24 -19 -43 -43 -43h-299c-24 0 -42 19 -42 43v234h106v43c0 24 19 43 43 43h85c24 0 43 -19 43 -43v-43zM64 320v-235h341c0 -24 -18 -42 -42 -42h-299c-24 0 -43 18 -43 42v235h43z" />
-    <glyph glyph-name="shopping_basket" unicode="shopping_basket" 
-d="M256 149c23 0 43 20 43 43s-20 43 -43 43s-43 -20 -43 -43s20 -43 43 -43zM192 320h128l-64 94zM367 320h102c12 0 22 -9 22 -21c-17.3126 -69.0207 -36.8524 -135.814 -55 -204c-5 -18 -21 -31 -41 -31h-278c-20 0 -36 13 -41 31l-54 198c-1 2 -1 4 -1 6
-c0 12 10 21 22 21h102l93 140c4 6 11 9 18 9s14 -3 18 -9z" />
-    <glyph glyph-name="shopping_cart" unicode="shopping_cart" 
-d="M363 128c23 0 42 -20 42 -43s-19 -42 -42 -42s-43 19 -43 42s20 43 43 43zM21 469h70l20 -42h316c12 0 21 -10 21 -22c0 -4 -1 -7 -3 -10l-76 -138c-7 -13 -21 -22 -37 -22h-159l-19 -35l-1 -3c0 -3 2 -5 5 -5h247v-43h-256c-23 0 -42 20 -42 43c0 7 2 14 5 20l29 53
-l-77 162h-43v42zM149 128c23 0 43 -20 43 -43s-20 -42 -43 -42s-42 19 -42 42s19 43 42 43z" />
-    <glyph glyph-name="short_text" unicode="short_text" 
-d="M85 235h214v-43h-214v43zM85 320h342v-43h-342v43z" />
-    <glyph glyph-name="show_chart" unicode="show_chart" 
-d="M75 118l-32 32l160 160l85 -86l151 170l30 -30l-181 -204l-85 86z" />
-    <glyph glyph-name="shuffle" unicode="shuffle" 
-d="M316 226l67 -67l44 44v-118h-118l44 44l-67 67zM309 427h118v-118l-44 44l-268 -268l-30 30l268 268zM226 316l-30 -30l-111 111l30 30z" />
-    <glyph glyph-name="signal_cellular_4_bar" unicode="signal_cellular_&#x34;_bar" 
-d="M43 43l426 426v-426h-426z" />
-    <glyph glyph-name="signal_cellular_connected_no_internet_4_bar" unicode="signal_cellular_connected_no_internet_&#x34;_bar" 
-d="M43 43l426 426v-128h-85v-298h-341zM427 43v42h42v-42h-42zM427 128v171h42v-171h-42z" />
-    <glyph glyph-name="signal_cellular_no_sim" unicode="signal_cellular_no_sim" 
-d="M78 429l373 -372l-28 -28l-40 41c-6 -3 -13 -6 -20 -6h-214c-23 0 -42 20 -42 43v239l-56 56zM405 405v-249l-242 242l50 50h150c23 0 42 -20 42 -43z" />
-    <glyph glyph-name="signal_cellular_null" unicode="signal_cellular_null" 
-d="M469 469v-426h-426zM427 366l-281 -281h281v281z" />
-    <glyph glyph-name="signal_cellular_off" unicode="signal_cellular_off" 
-d="M102 416l367 -368l-27 -27l-42 43h-379l189 189l-135 136zM448 491v-367l-183 183z" />
-    <glyph glyph-name="signal_wifi_4_bar" unicode="signal_wifi_&#x34;_bar" 
-d="M256 54l-248 309c10 7 105 85 248 85s238 -78 248 -85z" />
-    <glyph glyph-name="signal_wifi_4_bar_lock" unicode="signal_wifi_&#x34;_bar_lock" 
-d="M331 203v-56l-75 -94l-247 310c9 6 104 85 247 85s238 -79 247 -85l-44 -56c-6 2 -13 2 -22 2c-60 0 -106 -46 -106 -106zM469 171v32c0 17 -15 32 -32 32s-32 -15 -32 -32v-32h64zM491 171c11 0 21 -11 21 -22v-85c0 -11 -10 -21 -21 -21h-107c-11 0 -21 10 -21 21v85
-c0 11 10 22 21 22v32c0 30 23 53 53 53s54 -23 54 -53v-32z" />
-    <glyph glyph-name="signal_wifi_off" unicode="signal_wifi_off" 
-d="M70 481c122.302 -122.698 245.474 -244.526 367 -368l-27 -27l-71 71l-83 -103l-248 309c5 4 32 26 78 47l-43 44zM504 363l-116 -145l-221 220c27 6 57 10 89 10c143 0 238 -78 248 -85z" />
-    <glyph glyph-name="sim_card" unicode="sim_card" 
-d="M363 192v85h-43v-85h43zM277 235v42h-42v-42h42zM277 107v85h-42v-85h42zM192 192v85h-43v-85h43zM363 107v42h-43v-42h43zM192 107v42h-43v-42h43zM426 427l1 -342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42v256l128 128h171c23 0 42 -19 42 -42z" />
-    <glyph glyph-name="sim_card_alert" unicode="sim_card_alert" 
-d="M277 235v106h-42v-106h42zM277 149v43h-42v-43h42zM384 469c23 0 43 -19 43 -42v-342c0 -23 -20 -42 -43 -42h-256c-23 0 -43 19 -43 42l1 256l127 128h171z" />
-    <glyph glyph-name="skip_next" unicode="skip_next" 
-d="M341 384h43v-256h-43v256zM128 128v256l181 -128z" />
-    <glyph glyph-name="skip_previous" unicode="skip_previous" 
-d="M203 256l181 128v-256zM128 384h43v-256h-43v256z" />
-    <glyph glyph-name="slideshow" unicode="slideshow" 
-d="M405 107v298h-298v-298h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h298zM213 341l107 -85l-107 -85v170z" />
-    <glyph glyph-name="slow_motion_video" unicode="slow_motion_video" 
-d="M469 256c0 -110 -84 -201 -191 -212v43c84 11 149 83 149 169s-65 158 -149 169v43c107 -11 191 -102 191 -212zM121 91l30 30c24 -18 53 -30 84 -34v-43c-43 4 -82 21 -114 47zM87 235c4 -31 16 -60 34 -83l-30 -31c-26 32 -43 71 -47 114h43zM121 361
-c-18 -24 -30 -53 -34 -84h-43c4 43 21 82 47 114zM235 425c-31 -4 -60 -16 -84 -34l-30 30c32 26 71 43 114 47v-43zM278 303l63 -47c-42.8195 -31.8471 -85.479 -63.8543 -128 -96z" />
-    <glyph glyph-name="smartphone" unicode="smartphone" 
-d="M363 107v298h-214v-298h214zM363 490c23 0 42 -19 42 -42v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43z" />
-    <glyph glyph-name="smoke_free" unicode="smoke_free" 
-d="M363 172l-63 63h63v-63zM309 326c-39 0 -71 33 -71 72s32 71 71 71v-32c-22 0 -39 -15 -39 -37s17 -43 39 -43h33c40 0 74 -29 74 -67v-34h-32v27c0 28 -20 43 -42 43h-33zM402 408c40 -19 67 -60 67 -108v-44h-32v44c0 48 -37 87 -85 87v32c22 0 39 18 39 40h32
-c0 -20 -8 -38 -21 -51zM384 235h32v-64h-32v64zM437 235h32v-64h-32v64zM43 384l26 27l363 -363l-27 -27l-149 150h-213v64h149z" />
-    <glyph glyph-name="smoking_rooms" unicode="smoking_rooms" 
-d="M342 294c40 0 74 -28 74 -67v-35h-32v28c0 28 -20 43 -42 43h-33c-39 0 -71 33 -71 72s32 71 71 71v-32c-22 0 -39 -15 -39 -37s17 -43 39 -43h33zM402 347c40 -19 67 -60 67 -107v-48h-32v48c0 48 -37 86 -85 86v32c22 0 39 18 39 40s-17 39 -39 39v32
-c39 0 71 -32 71 -71c0 -20 -8 -38 -21 -51zM384 171h32v-64h-32v64zM437 171h32v-64h-32v64zM43 171h320v-64h-320v64z" />
-    <glyph glyph-name="sms" unicode="sms" 
-d="M363 277v43h-43v-43h43zM277 277v43h-42v-43h42zM192 277v43h-43v-43h43zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="sms_failed" unicode="sms_failed" 
-d="M277 299v85h-42v-85h42zM277 213v43h-42v-43h42zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="snooze" unicode="snooze" 
-d="M192 277v43h128v-38l-77 -90h77v-43h-128v39l77 89h-77zM256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM256 427c106 0 192 -86 192 -192s-86 -192 -192 -192s-192 86 -192 192s86 192 192 192zM469 390l-27 -33l-98 83l27 32z
-M168 440l-98 -82l-27 32l98 82z" />
-    <glyph glyph-name="sort" unicode="sort" 
-d="M64 235v42h256v-42h-256zM64 384h384v-43h-384v43zM64 128v43h128v-43h-128z" />
-    <glyph glyph-name="sort_by_alpha" unicode="sort_by_alpha" 
-d="M336 168h130v-34h-182v27l126 183h-125v34h177v-27zM106 221h83l-42 111zM130 378h35l96 -244h-39l-20 52h-109l-20 -52h-39zM219 99h99l-50 -50zM319 413h-101l50 50z" />
-    <glyph glyph-name="spa" unicode="spa" 
-d="M330 307c-27 -15 -52 -34 -74 -57c-22 23 -47 42 -74 57c5 59 29 116 75 162c45 -45 69 -102 73 -162zM43 299c95.1702 0 171.746 -54.2229 213 -117c41.2966 62.8426 117.856 117 213 117c0 -113 -71 -209 -171 -245c-14 -5 -27 -8 -42 -11c-15 2 -29 6 -42 11
-c-100 36 -171 132 -171 245z" />
-    <glyph glyph-name="space_bar" unicode="space_bar" 
-d="M384 320h43v-128h-342v128h43v-85h256v85z" />
-    <glyph glyph-name="speaker" unicode="speaker" 
-d="M256 256c35 0 64 -29 64 -64s-29 -64 -64 -64s-64 29 -64 64s29 64 64 64zM256 85c59 0 107 48 107 107s-48 107 -107 107s-107 -48 -107 -107s48 -107 107 -107zM256 427c-24 0 -43 -20 -43 -43s19 -43 43 -43c23 0 43 20 43 43s-20 43 -43 43zM363 469
-c23 0 42 -19 42 -42v-342c0 -23 -19 -42 -42 -42h-214c-23 0 -42 19 -42 42v342c0 23 19 42 42 42h214z" />
-    <glyph glyph-name="speaker_group" unicode="speaker_group" 
-d="M128 405v-341h213v-43h-213c-24 0 -43 20 -43 43v341h43zM245 245c0 29 25 54 54 54s53 -25 53 -54s-24 -53 -53 -53s-54 24 -54 53zM299 160c47 0 85 38 85 85s-38 86 -85 86s-86 -39 -86 -86s39 -85 86 -85zM299 448c-23 0 -43 -19 -43 -43s20 -42 43 -42s42 18 42 42
-s-19 43 -42 43zM388 491c21 0 39 -18 39 -39v-307c0 -21 -18 -38 -39 -38h-179c-21 0 -38 17 -38 38v307c0 21 17 39 38 39h179z" />
-    <glyph glyph-name="speaker_notes" unicode="speaker_notes" 
-d="M384 341v43h-171v-43h171zM384 277v43h-171v-43h171zM320 213v43h-107v-43h107zM171 341v43h-43v-43h43zM171 277v43h-43v-43h43zM171 213v43h-43v-43h43zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="speaker_notes_off" unicode="speaker_notes_off" 
-d="M427 469c23 0 42 -19 42 -42v-256c0 -23 -18 -42 -41 -43l-149 149h105v43h-148l-21 21h169v43h-171v-41l-126 126h340zM128 277h43l-43 43v-43zM171 213v43h-43v-43h43zM27 475l442 -442l-27 -27l-122 122h-192l-85 -85v362l-43 43z" />
-    <glyph glyph-name="speaker_phone" unicode="speaker_phone" 
-d="M320 85v171h-128v-171h128zM317 298c13 0 24 -11 24 -24v-207c0 -13 -11 -24 -24 -24h-122c-13 0 -24 11 -24 24v207c0 13 11 25 24 25zM256 491c64 0 123 -27 165 -69l-30 -30c-35 35 -82 56 -135 56s-100 -21 -135 -56l-30 30c42 42 101 69 165 69zM149 361
-c27 27 65 44 107 44s80 -17 107 -44l-31 -30c-19 19 -46 31 -76 31s-57 -12 -76 -31z" />
-    <glyph glyph-name="spellcheck" unicode="spellcheck" 
-d="M461 265l30 -30l-203 -203l-108 109l30 30l78 -79zM137 277h88l-44 118zM266 171l-25 64h-120l-24 -64h-45l109 277h40l109 -277h-44z" />
-    <glyph glyph-name="star" unicode="star" 
-d="M256 144l-132 -80l35 150l-116 101l153 13l60 141l60 -141l153 -13l-116 -101l35 -150z" />
-    <glyph glyph-name="star_border" unicode="star_border" 
-d="M256 183l80 -48l-21 91l71 62l-94 8l-36 86l-36 -86l-94 -8l71 -62l-21 -91zM469 315l-116 -101l35 -150l-132 80l-132 -80l35 150l-116 101l153 13l60 141l60 -141z" />
-    <glyph glyph-name="star_half" unicode="star_half" 
-d="M256 183l80 -48l-21 91l71 62l-94 8l-36 86v-199zM469 315l-116 -101l35 -150l-132 80l-132 -80l35 150l-116 101l153 13l60 141l60 -141z" />
-    <glyph glyph-name="stars" unicode="stars" 
-d="M346 128l-24 103l80 69l-105 9l-41 96l-41 -97l-105 -8l80 -69l-24 -103l90 54zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="stay_current_landscape" unicode="stay_current_landscape" 
-d="M405 363h-298v-214h298v214zM22 363c0 23 19 42 42 42h384c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-384c-23 0 -43 19 -43 42z" />
-    <glyph glyph-name="stay_current_portrait" unicode="stay_current_portrait" 
-d="M363 107v298h-214v-298h214zM363 490c23 0 42 -19 42 -42v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43z" />
-    <glyph glyph-name="stay_primary_landscape" unicode="stay_primary_landscape" 
-d="M405 363h-298v-214h298v214zM22 363c0 23 19 42 42 42h384c23 0 43 -19 43 -42v-214c0 -23 -20 -42 -43 -42h-384c-23 0 -43 19 -43 42z" />
-    <glyph glyph-name="stay_primary_portrait" unicode="stay_primary_portrait" 
-d="M363 107v298h-214v-298h214zM363 490c23 0 42 -19 42 -42v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43z" />
-    <glyph glyph-name="stop" unicode="stop" 
-d="M128 384h256v-256h-256v256z" />
-    <glyph glyph-name="stop_screen_share" unicode="stop_screen_share" 
-d="M149 192c20 28 45 44 78 52l-34 34c-25 -24 -37 -54 -44 -86zM51 475l421 -421l-27 -27l-58 58h-387v43h85c-24 0 -42 19 -42 42v214c0 13 5 23 14 31l-33 33zM469 170c0 -16 -9 -30 -22 -37l-118 118l34 32l-86 79v-45c-4 -1 -7 -1 -11 -2l-112 111h273
-c23 0 42 -18 42 -42v-214zM453 128h59v-43h-17z" />
-    <glyph glyph-name="storage" unicode="storage" 
-d="M85 277v-42h43v42h-43zM43 213v86h426v-86h-426zM128 363v42h-43v-42h43zM43 427h426v-86h-426v86zM85 149v-42h43v42h-43zM43 85v86h426v-86h-426z" />
-    <glyph glyph-name="store" unicode="store" 
-d="M256 128v85h-128v-85h128zM448 213h-21v-128h-43v128h-85v-128h-214v128h-21v43l21 107h342l21 -107v-43zM427 427v-43h-342v43h342z" />
-    <glyph glyph-name="store_mall_directory" unicode="store_mall_directory" 
-d="M256 128v85h-128v-85h128zM448 213h-21v-128h-43v128h-85v-128h-214v128h-21v43l21 107h342l21 -107v-43zM427 427v-43h-342v43h342z" />
-    <glyph glyph-name="straighten" unicode="straighten" 
-d="M448 171v170h-43v-85h-42v85h-43v-85h-43v85h-42v-85h-43v85h-43v-85h-42v85h-43v-170h384zM448 384c23 0 43 -20 43 -43v-170c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v170c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="streetview" unicode="streetview" 
-d="M245 384c0 -38 16 -73 41 -98l-209 -209c-8 8 -13 18 -13 30v298c0 23 20 43 43 43h154c-10 -19 -16 -41 -16 -64zM277 384c0 59 48 107 107 107s107 -48 107 -107s-48 -107 -107 -107s-107 48 -107 107zM268 206c32 24 73 39 116 39c22 0 44 -4 64 -11v-127
-c0 -23 -20 -43 -43 -43h-149v117c0 10 5 19 12 25z" />
-    <glyph glyph-name="strikethrough_s" unicode="strikethrough_s" 
-d="M200 232c0 -38.1216 24.1545 -54 62 -54c26.1564 0 49 10.6702 49 36c0 23.9161 -12.6848 29.3424 -30 38c-3 1 -8 3 -12 4h-205v43h384v-43h-83c1 -2 3 -5 4 -7c4 -10 7 -22 7 -35c0 -46.2545 -30.1882 -69.4824 -67 -80c-14 -4 -29 -6 -46 -6c-10 0 -21 1 -31 3
-c-21.9156 4.38312 -40.6035 10.4527 -56 22c-22.8363 17.1272 -39 39.9131 -39 79h63zM311 352c0 30.7771 -19.602 45 -51 45c-22.5729 0 -39.6285 -7.25692 -47 -22c-2 -4 -3 -9 -3 -14c0 -10 6 -19 16 -26c8 -5 16 -10 30 -15h-98c-1 2 -3 3 -4 5c-6 10 -8 22 -8 36
-c0 28.7417 14.9303 49.3443 32 63c20.5411 14.3788 47.8126 24 83 24c35.0657 0 64.1326 -10.0193 83 -27c17.5603 -15.8042 31 -37.9468 31 -69h-64z" />
-    <glyph glyph-name="style" unicode="style" 
-d="M125 91v135l74 -178h-31c-23 0 -43 20 -43 43zM168 325c12 0 21 10 21 22s-9 21 -21 21s-21 -9 -21 -21s9 -22 21 -22zM470 172c9 -22 -1 -47 -23 -56l-157 -65c-5 -2 -11 -3 -17 -3c-17 0 -32 10 -39 26l-106 256c-2 6 -3 11 -3 17c0 16 10 31 26 38l158 65
-c6 2 11 3 17 3c16 0 31 -10 38 -26zM54 93c-22 9 -32 33 -23 55l52 125v-192z" />
-    <glyph glyph-name="subdirectory_arrow_left" unicode="subdirectory_arrow_left" 
-d="M235 320l30 -30l-77 -77h196v214h43v-256h-239l77 -77l-30 -30l-128 128z" />
-    <glyph glyph-name="subdirectory_arrow_right" unicode="subdirectory_arrow_right" 
-d="M405 192l-128 -128l-30 30l77 77h-239v256h43v-214h196l-77 77l30 30z" />
-    <glyph glyph-name="subject" unicode="subject" 
-d="M85 405h342v-42h-342v42zM85 192v43h342v-43h-342zM427 320v-43h-342v43h342zM299 149v-42h-214v42h214z" />
-    <glyph glyph-name="subscriptions" unicode="subscriptions" 
-d="M341 171l-128 69v-139zM469 256v-171c0 -23 -19 -42 -42 -42h-342c-23 0 -42 19 -42 42v171c0 23 19 43 42 43h342c23 0 42 -20 42 -43zM384 469v-42h-256v42h256zM427 341h-342v43h342v-43z" />
-    <glyph glyph-name="subtitles" unicode="subtitles" 
-d="M427 213v43h-214v-43h214zM427 128v43h-86v-43h86zM299 128v43h-214v-43h214zM85 256v-43h86v43h-86zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="subway" unicode="subway" 
-d="M384 173v147c0 56 -57 64 -128 64c-64 0 -128 -8 -128 -64v-147c0 -31 25 -56 56 -56l-24 -24v-8h36l32 32h60l32 -32h32v8l-24 24c31 0 56 25 56 56zM380 452c57 -22 89 -69 89 -129v-280h-426v280c0 60 32 107 89 129c38 15 84 17 124 17s86 -2 124 -17zM150 320h213
-v-107h-213v107zM160 171c0 12 9 21 21 21s22 -9 22 -21s-10 -22 -22 -22s-21 10 -21 22zM309 171c0 12 10 21 22 21s21 -9 21 -21s-9 -22 -21 -22s-22 10 -22 22z" />
-    <glyph glyph-name="supervisor_account" unicode="supervisor_account" 
-d="M192 235c14 0 32 -2 51 -6c-44 -24 -51 -56 -51 -74v-48h-149v53c0 50 99 75 149 75zM352 213c39 0 117 -19 117 -58v-48h-234v48c0 39 78 58 117 58zM192 277c-35 0 -64 29 -64 64s29 64 64 64s64 -29 64 -64s-29 -64 -64 -64zM352 256c-29 0 -53 24 -53 53s24 54 53 54
-s53 -25 53 -54s-24 -53 -53 -53z" />
-    <glyph glyph-name="surround_sound" unicode="surround_sound" 
-d="M256 299c23 0 43 -20 43 -43s-20 -43 -43 -43s-43 20 -43 43s20 43 43 43zM377 135c33 33 50 77 50 121s-17 88 -50 121l-31 -31c25 -25 38 -57 38 -90s-12 -66 -37 -91zM256 171c47 0 85 38 85 85s-38 85 -85 85s-85 -38 -85 -85s38 -85 85 -85zM166 166
-c-25 25 -38 57 -38 90s12 66 37 91l-30 30c-33 -33 -50 -77 -50 -121s17 -88 50 -121zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="swap_calls" unicode="swap_calls" 
-d="M384 427l85 -86h-64v-149c0 -47 -38 -85 -85 -85s-85 38 -85 85v149c0 23 -20 43 -43 43s-43 -20 -43 -43v-149h64l-85 -85l-85 85h64v149c0 47 38 86 85 86s85 -39 85 -86v-149c0 -23 20 -43 43 -43s43 20 43 43v149h-64z" />
-    <glyph glyph-name="swap_horiz" unicode="swap_horiz" 
-d="M448 320l-85 -85v64h-150v42h150v64zM149 277v-64h150v-42h-150v-64l-85 85z" />
-    <glyph glyph-name="swap_vert" unicode="swap_vert" 
-d="M192 448l85 -85h-64v-150h-42v150h-64zM341 149h64l-85 -85l-85 85h64v150h42v-150z" />
-    <glyph glyph-name="swap_vertical_circle" unicode="swap_vertical_circle" 
-d="M373 192h-53v85h-43v-85h-53l75 -75zM139 320h53v-85h43v85h53l-75 75zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="switch_camera" unicode="switch_camera" 
-d="M320 181l75 75l-75 75v-54h-128v54l-75 -75l75 -75v54h128v-54zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h68l39 42h128l39 -42h68z" />
-    <glyph glyph-name="switch_video" unicode="switch_video" 
-d="M277 181l75 75l-75 75v-54h-128v54l-74 -75l74 -75v54h128v-54zM384 309l85 86v-278l-85 86v-75c0 -12 -9 -21 -21 -21h-299c-12 0 -21 9 -21 21v256c0 12 9 21 21 21h299c12 0 21 -9 21 -21v-75z" />
-    <glyph glyph-name="sync" unicode="sync" 
-d="M256 128v64l85 -85l-85 -86v64c-94 0 -171 77 -171 171c0 33 10 65 27 91l31 -31c-10 -18 -15 -38 -15 -60c0 -71 57 -128 128 -128zM256 427c94 0 171 -77 171 -171c0 -33 -10 -65 -27 -91l-31 31c10 18 15 38 15 60c0 71 -57 128 -128 128v-64l-85 85l85 86v-64z" />
-    <glyph glyph-name="sync_disabled" unicode="sync_disabled" 
-d="M427 427l-51 -51c31 -31 51 -73 51 -120c0 -33 -10 -64 -26 -90l-32 31c9 18 15 38 15 59c0 35 -15 67 -38 90l-47 -47v128h128zM61 397l27 27l335 -336l-27 -27l-50 50c-15 -9 -31 -16 -48 -20v44c6 2 12 5 17 8l-172 172c-9 -18 -15 -38 -15 -59c0 -35 15 -67 38 -90
-l47 47v-128h-128l51 51c-31 31 -51 73 -51 120c0 33 10 64 26 90zM213 377c-6 -2 -11 -5 -16 -8l-31 32c15 9 30 16 47 20v-44z" />
-    <glyph glyph-name="sync_problem" unicode="sync_problem" 
-d="M235 235v128h42v-128h-42zM448 427l-50 -51c31 -31 50 -73 50 -120c0 -80 -54 -146 -128 -165v44c50 17 85 65 85 121c0 35 -14 67 -37 90l-48 -47v128h128zM235 149v43h42v-43h-42zM64 256c0 80 54 146 128 165v-44c-50 -17 -85 -65 -85 -121c0 -35 14 -67 37 -90l48 47
-v-128h-128l50 51c-31 31 -50 73 -50 120z" />
-    <glyph glyph-name="system_update" unicode="system_update" 
-d="M341 235l-85 -86l-85 86h64v106h42v-106h64zM363 107v298h-214v-298h214zM363 490c23 0 42 -19 42 -42v-384c0 -23 -19 -43 -42 -43h-214c-23 0 -42 20 -42 43v384c0 23 19 43 42 43z" />
-    <glyph glyph-name="system_update_alt" unicode="system_update_alt" 
-d="M448 437c23 0 43 -19 43 -42v-299c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v299c0 23 20 42 43 42h128v-42h-128v-299h384v299h-128v42h128zM256 160l-85 85h64v192h42v-192h64z" />
-    <glyph glyph-name="tab" unicode="tab" 
-d="M448 107v213h-171v85h-213v-298h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="tab_unselected" unicode="tab_unselected" 
-d="M363 64v43h42v-43h-42zM277 64v43h43v-43h-43zM448 235v42h43v-42h-43zM448 64v43h43c0 -23 -20 -43 -43 -43zM107 405v43h42v-43h-42zM107 64v43h42v-43h-42zM192 405v43h43v-43h-43zM448 149v43h43v-43h-43zM448 448c23 0 43 -20 43 -43v-85h-214v128h171zM64 64
-c-23 0 -43 20 -43 43h43v-43zM21 149v43h43v-43h-43zM192 64v43h43v-43h-43zM21 405c0 23 20 43 43 43v-43h-43zM21 235v42h43v-42h-43zM21 320v43h43v-43h-43z" />
-    <glyph glyph-name="tablet" unicode="tablet" 
-d="M405 128v256h-298v-256h298zM448 427c23 0 43 -20 43 -43l-1 -256c0 -23 -19 -43 -42 -43h-384c-23 0 -43 20 -43 43v256c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="tablet_android" unicode="tablet_android" 
-d="M411 107v341h-310v-341h310zM299 43v21h-86v-21h86zM384 512c35 0 64 -29 64 -64v-384c0 -35 -29 -64 -64 -64h-256c-35 0 -64 29 -64 64v384c0 35 29 64 64 64h256z" />
-    <glyph glyph-name="tablet_mac" unicode="tablet_mac" 
-d="M405 107v341h-320v-341h320zM245 21c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM395 512c29 0 53 -24 53 -53v-406c0 -29 -24 -53 -53 -53h-299c-29 0 -53 24 -53 53v406c0 29 24 53 53 53h299z" />
-    <glyph glyph-name="tag_faces" unicode="tag_faces" 
-d="M256 139c-50 0 -92 30 -109 74h218c-17 -44 -59 -74 -109 -74zM181 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM331 277c-18 0 -32 14 -32 32s14 32 32 32s32 -14 32 -32s-14 -32 -32 -32zM256 85c94 0 171 77 171 171s-77 171 -171 171
-s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="tap_and_play" unicode="tap_and_play" 
-d="M363 490c23 0 42 -19 42 -42v-363c0 -23 -19 -42 -42 -42h-45c-2 30 -9 58 -20 85h65v277h-214v-128c-14 6 -27 11 -42 14v157c0 23 19 43 42 43zM43 256c130 0 234 -105 234 -235h-42c0 106 -86 192 -192 192v43zM43 85c35 0 64 -29 64 -64h-64v64zM43 171
-c83 0 149 -67 149 -150h-43c0 59 -47 107 -106 107v43z" />
-    <glyph glyph-name="terrain" unicode="terrain" 
-d="M299 384l192 -256h-470l128 171l96 -128l34 25l-60 81z" />
-    <glyph glyph-name="text_fields" unicode="text_fields" 
-d="M459 320v-64h-64v-149h-64v149h-64v64h192zM53 427h278v-64h-107v-256h-64v256h-107v64z" />
-    <glyph glyph-name="text_format" unicode="text_format" 
-d="M256 384l-40 -107h80zM203 239l-20 -47h-44l101 235h32l101 -235h-44l-20 47h-106zM107 149h298v-42h-298v42z" />
-    <glyph glyph-name="textsms" unicode="textsms" 
-d="M363 277v43h-43v-43h43zM277 277v43h-42v-43h42zM192 277v43h-43v-43h43zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="texture" unicode="texture" 
-d="M198 64l250 250v-61l-189 -189h-61zM448 107c0 -22.9739 -20.0355 -43 -43 -43h-42l85 85v-42zM107 448h42l-85 -85v42c0 23 20 43 43 43zM253 448h61l-250 -250v61zM416 446c15 -4 27 -15 31 -30l-351 -350c-14.6749 4.19283 -25.8059 15.3206 -30 30z" />
-    <glyph glyph-name="theaters" unicode="theaters" 
-d="M384 320v43h-43v-43h43zM384 235v42h-43v-42h43zM384 149v43h-43v-43h43zM171 320v43h-43v-43h43zM171 235v42h-43v-42h43zM171 149v43h-43v-43h43zM384 448h43v-384h-43v43h-43v-43h-170v43h-43v-43h-43v384h43v-43h43v43h170v-43h43v43z" />
-    <glyph glyph-name="thumb_down" unicode="thumb_down" 
-d="M405 448h86v-256h-86v256zM320 448c23 0 43 -20 43 -43v-213c0 -12 -5 -22 -13 -30l-140 -141l-23 23c-6 6 -9 13 -9 22v7l21 98h-135c-23 0 -43 19 -43 42l1 2h-1v41c0 6 1 11 3 16l65 150c6 15 21 26 39 26h192z" />
-    <glyph glyph-name="thumb_up" unicode="thumb_up" 
-d="M491 299l-1 -2h1v-41c0 -6 -1 -11 -3 -16l-65 -150c-6 -15 -21 -26 -39 -26h-192c-23 0 -43 20 -43 43v213c0 12 5 22 13 30l140 141l23 -23c6 -6 9 -13 9 -22v-7l-21 -98h135c23 0 43 -19 43 -42zM21 64v256h86v-256h-86z" />
-    <glyph glyph-name="thumbs_up_down" unicode="thumbs_up_down" 
-d="M480 299c18 0 32 -14 32 -32v-139c0 -9 -3 -17 -9 -23l-106 -105l-17 17c-4 4 -7 10 -7 17c4.95149 24.3818 10.0081 48.6586 15 73h-111c-12 0 -21 9 -21 21v27c0 4 1 7 2 11l49 113c5 11 16 20 29 20h144zM256 384v-27c0 -4 -1 -7 -2 -11l-49 -113
-c-5 -11 -16 -20 -29 -20h-144c-18 0 -32 14 -32 32v139c0 9 3 17 9 23l106 105l17 -17c4 -4 7 -10 7 -17c-4.95149 -24.3818 -10.0081 -48.6586 -15 -73h111c12 0 21 -9 21 -21z" />
-    <glyph glyph-name="time_to_leave" unicode="time_to_leave" 
-d="M107 299h298l-32 96h-234zM373 192c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM139 192c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM404 405l44 -128v-170c0 -12 -9 -22 -21 -22h-22c-12 0 -21 10 -21 22v21h-256v-21
-c0 -12 -9 -22 -21 -22h-22c-12 0 -21 10 -21 22v170l44 128c4 13 17 22 31 22h234c14 0 27 -9 31 -22z" />
-    <glyph glyph-name="timelapse" unicode="timelapse" 
-d="M256 85c94 0 171 77 171 171s-77 171 -171 171s-171 -77 -171 -171s77 -171 171 -171zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213zM346 346c50 -50 51 -130 1 -180s-131 -50 -181 0l90 90v128c33 0 65 -13 90 -38z" />
-    <glyph glyph-name="timeline" unicode="timeline" 
-d="M491 341c0 -23 -20 -42 -43 -42c-4 0 -8 0 -11 1l-76 -76c1 -3 2 -7 2 -11c0 -23 -20 -42 -43 -42s-43 19 -43 42c0 4 1 8 2 11l-55 55c-3 -1 -7 -2 -11 -2s-8 1 -11 2l-97 -97c1 -3 2 -7 2 -11c0 -23 -20 -43 -43 -43s-43 20 -43 43s20 42 43 42c4 0 8 0 11 -1l97 97
-c-1 3 -1 7 -1 11c0 23 19 43 42 43s43 -20 43 -43c0 -4 0 -8 -1 -11l54 -54c3 1 7 1 11 1s8 0 11 -1l76 75c-1 3 -2 7 -2 11c0 23 20 43 43 43s43 -20 43 -43z" />
-    <glyph glyph-name="timer" unicode="timer" 
-d="M256 85c83 0 149 67 149 150s-66 149 -149 149s-149 -66 -149 -149s66 -150 149 -150zM406 354c26 -33 42 -74 42 -119c0 -106 -86 -192 -192 -192s-192 86 -192 192s86 192 192 192c45 0 87 -17 120 -43l30 31c11 -9 21 -19 30 -30zM235 213v128h42v-128h-42zM320 491
-v-43h-128v43h128z" />
-    <glyph glyph-name="timer_10" unicode="timer_&#x31;&#x30;" 
-d="M275 230v54c0 23.1679 -2.28229 40.1372 -10 53c-5.32529 10.6506 -15.2041 15 -30 15c-6 0 -13 -1 -18 -3c-19.376 -11.6256 -23 -33.9937 -23 -66v-53c0 -13 0 -24 2 -33s6 -15 9 -21c5.59145 -11.1829 14.1701 -16 30 -16c15.4236 0 24.6161 5.23229 30 16
-c3 6 6 12 8 21s2 20 2 33zM152 277c0 64.1175 20.6864 109 83 109c25.9331 0 47.8484 -8.37646 60 -24c15.2136 -19.5604 22 -48.5586 22 -85v-41c0 -63.9076 -19.6435 -110 -82 -110c-62.0914 0 -83 46.0788 -83 110v41zM436 289c-16.3185 0 -30 -6.67853 -30 -23
-c0 -14.5467 7.81248 -15.525 19 -20c5 -2 12 -4 19 -5c11 -2 19 -5 28 -8s16 -8 22 -12s10 -10 13 -16s5 -12 5 -21c0 -30.9206 -20.0931 -44.031 -44 -52c-9 -3 -19 -4 -30 -4c-35.9519 0 -63.4589 14.4041 -74 39c-3 7 -5 14 -5 22h41c0 -21.2888 17.0766 -30 38 -30
-c18.6968 0 33 5.89308 33 23c0 13.5739 -8.51234 16.8049 -19 21c-12.7341 5.09362 -34.9088 9.09079 -48 14c-8 3 -14 7 -20 11c-11.0546 7.36974 -19 18.5758 -19 36c0 27.5628 20.3776 44.7925 42 52c9 3 18 4 29 4c40.9316 0 75 -19.1355 75 -59h-42
-c0 12.2774 -7.84356 22.4609 -18 25c-4 1 -10 3 -15 3zM0 347l101 37h6v-256h-43v205l-64 -22v36z" />
-    <glyph glyph-name="timer_3" unicode="timer_&#x33;" 
-d="M374 289c-15.9409 0 -31 -7.57315 -31 -23c0 -13.6828 9.30955 -15.7238 20 -20c5 -2 11 -4 18 -5c11 -2 20 -5 29 -8s16 -8 22 -12s10 -10 13 -16s5 -12 5 -21c0 -30.9206 -20.0931 -44.031 -44 -52c-9 -3 -20 -4 -31 -4c-35.3954 0 -62.613 14.7638 -73 39
-c-3 7 -5 14 -5 22h40c0 -20.4241 18.5387 -30 39 -30c18.6968 0 33 5.89308 33 23c0 13.5739 -8.51234 16.8049 -19 21c-5 2 -13 4 -21 6c-18.808 3.76159 -34.9505 10.3003 -48 19c-10.5283 7.01889 -18 19.4522 -18 36c0 27.5628 20.3776 44.7925 42 52c9 3 18 4 29 4
-c40.9316 0 75 -19.1355 75 -59h-42c0 13.019 -8.2055 22.3014 -19 25c-4 1 -9 3 -14 3zM215 259c24.7243 -9.2716 42 -25.484 42 -58c0 -25.5996 -8.85495 -43.6412 -24 -55c-14.0356 -12.0305 -34.4533 -20 -60 -20c-46.8771 0 -84 25.2474 -84 72h43
-c0 -11.5043 4.1483 -22.8612 11 -28c7.35188 -5.51391 17.5339 -10 30 -10c27.0755 0 42 14.0756 42 41c0 28.626 -17.0664 41 -46 41h-26v33h25c20.5078 0 35.1083 8.27068 41 23c2 5 2 10 2 16c0 24.8875 -12.4571 38 -38 38c-18.723 0 -29.7305 -7.46097 -36 -20
-c-2 -4 -3 -9 -3 -15h-42c0 34.3341 22.95 53.98 48 64c10 3 21 5 33 5c48.7123 0 80 -23.4793 80 -72c0 -28.4847 -18.378 -45.189 -38 -55z" />
-    <glyph glyph-name="timer_off" unicode="timer_off" 
-d="M256 85c27 0 53 8 75 21l-204 204c-13 -22 -20 -48 -20 -75c0 -83 66 -150 149 -150zM64 427l379 -379l-27 -27l-54 54c-31 -20 -67 -32 -106 -32c-106 0 -192 86 -192 192c0 39 12 76 32 106l-59 59zM235 311v30h42v-73zM320 491v-43h-128v43h128zM406 415l30 -30
-l-30 -31c26 -33 42 -74 42 -119c0 -39 -12 -76 -32 -106l-31 31c13 22 20 48 20 75c0 83 -66 149 -149 149c-27 0 -52 -7 -74 -20l-32 31c30 20 67 32 106 32c45 0 87 -16 120 -42z" />
-    <glyph glyph-name="title" unicode="title" 
-d="M107 427h298v-64h-117v-256h-64v256h-117v64z" />
-    <glyph glyph-name="toc" unicode="toc" 
-d="M405 235v42h43v-42h-43zM405 363h43v-43h-43v43zM405 149v43h43v-43h-43zM64 149v43h299v-43h-299zM64 235v42h299v-42h-299zM64 320v43h299v-43h-299z" />
-    <glyph glyph-name="today" unicode="today" 
-d="M149 299h107v-107h-107v107zM405 107v234h-298v-234h298zM405 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v298c0 23 19 43 43 43h21v43h43v-43h170v43h43v-43h21z" />
-    <glyph glyph-name="toll" unicode="toll" 
-d="M64 256c0 -56 35 -104 85 -121v-44c-74 19 -128 85 -128 165s54 146 128 165v-44c-50 -17 -85 -65 -85 -121zM320 128c71 0 128 57 128 128s-57 128 -128 128s-128 -57 -128 -128s57 -128 128 -128zM320 427c94 0 171 -77 171 -171s-77 -171 -171 -171s-171 77 -171 171
-s77 171 171 171z" />
-    <glyph glyph-name="tonality" unicode="tonality" 
-d="M421 213c2 7 3 15 4 22h-148v-22h144zM389 149c5 7 11 15 15 22h-127v-22h112zM277 87c22 3 43 10 62 20h-62v-20zM277 299v-22h148c-1 7 -2 15 -4 22h-144zM277 363v-22h127c-4 7 -10 15 -15 22h-112zM277 425v-20h62c-19 10 -40 17 -62 20zM235 87v338
-c-84 -10 -150 -82 -150 -169s66 -159 150 -169zM256 469c118 0 213 -95 213 -213s-95 -213 -213 -213s-213 95 -213 213s95 213 213 213z" />
-    <glyph glyph-name="touch_app" unicode="touch_app" 
-d="M402 173c11 -5 19 -16 19 -29v-4l-16 -113c-2 -16 -15 -27 -31 -27h-145c-9 0 -16 3 -22 9l-106 106l17 17c4 4 10 7 17 7c2 0 3 -1 5 -1l73 -15v229c0 18 14 32 32 32s32 -14 32 -32v-128h17c4 0 7 -1 11 -2zM192 272c-26 17 -43 47 -43 80c0 53 43 96 96 96
-s96 -43 96 -96c0 -33 -16 -63 -42 -80v80c0 29 -25 53 -54 53s-53 -24 -53 -53v-80z" />
-    <glyph glyph-name="toys" unicode="toys" 
-d="M256 256c0 -64 -53 -117 -117 -117s-118 53 -118 117h235zM256 256c-64 0 -117 53 -117 117s53 118 117 118v-235zM256 256c64 0 117 -53 117 -117s-53 -118 -117 -118v235zM256 256c0 64 53 117 117 117s118 -53 118 -117h-235z" />
-    <glyph glyph-name="track_changes" unicode="track_changes" 
-d="M407 407c39 -39 62 -92 62 -151c0 -118 -95 -213 -213 -213s-213 95 -213 213s95 213 213 213h21v-176c13 -7 22 -21 22 -37c0 -23 -20 -43 -43 -43s-43 20 -43 43c0 16 9 30 22 37v45c-37 -10 -64 -42 -64 -82c0 -47 38 -85 85 -85s85 38 85 85c0 23 -10 44 -25 60
-l30 30c23 -23 38 -55 38 -90c0 -71 -57 -128 -128 -128s-128 57 -128 128c0 63 46 116 107 126v43c-84 -10 -150 -82 -150 -169c0 -94 77 -171 171 -171s171 77 171 171c0 47 -19 90 -50 121z" />
-    <glyph glyph-name="traffic" unicode="traffic" 
-d="M256 320c24 0 43 20 43 43c0 24 -20 42 -43 42c-24 0 -43 -18 -43 -42c0 -23 19 -43 43 -43zM256 213c24 0 43 20 43 43s-20 43 -43 43c-24 0 -43 -20 -43 -43s19 -43 43 -43zM256 107c24 0 43 19 43 42s-20 43 -43 43c-24 0 -43 -20 -43 -43s19 -42 43 -42zM427 299
-c0 -40 -27 -73 -64 -83v-24h64c0 -40 -27 -72 -64 -82v-25c0 -12 -10 -21 -22 -21h-170c-12 0 -22 9 -22 21v25c-37 10 -64 42 -64 82h64v24c-37 10 -64 43 -64 83h64v24c-37 10 -64 42 -64 82h64v22c0 12 10 21 22 21h170c12 0 22 -9 22 -21v-22h64c0 -40 -27 -72 -64 -82
-v-24h64z" />
-    <glyph glyph-name="train" unicode="train" 
-d="M352 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM277 299h107v85h-107v-85zM235 299v85h-107v-85h107zM160 149c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM256 469c94 0 171 -10 171 -85v-203c0 -41 -34 -74 -75 -74
-l32 -32v-11h-43l-42 43h-81l-42 -43h-48v11l32 32c-41 0 -75 33 -75 74v203c0 75 86 85 171 85z" />
-    <glyph glyph-name="tram" unicode="tram" 
-d="M363 213v107h-214v-107h214zM256 117c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM405 151c0 -36 -19 -66 -55 -66h2l32 -32v-10h-43l-42 42h-81l-42 -42h-48v10l34 34c-30 7 -55 33 -55 64v180c0 59 60 72 127 74l17 32h-102v32h214v-32h-70
-l-16 -32c73 -2 128 -14 128 -74v-180z" />
-    <glyph glyph-name="transfer_within_a_station" unicode="transfer_within_a_station" 
-d="M123 322l-59 -301h45l37 171l46 -43v-128h43v161l-44 44l13 64c28 -34 69 -55 116 -55v42c-39 0 -74 22 -93 53l-20 34c-7 13 -21 20 -36 20c-5 0 -11 -1 -16 -3l-112 -46v-100h42v71l38 16zM203 395c-23 0 -43 19 -43 42s20 43 43 43s42 -20 42 -43s-19 -42 -42 -42z
-M416 91v37l53 -53l-53 -54v38h-117v32h117zM352 181h117v-32h-117v-37l-53 53l53 54v-38z" />
-    <glyph glyph-name="transform" unicode="transform" 
-d="M213 341v43h128c23 0 43 -20 43 -43v-128h-43v128h-128zM469 128h-85v-43h43l-64 -64l-64 64h42v43h-170c-23 0 -43 20 -43 43v170h-85v43h85v43h-43l64 64l64 -64h-42v-256h298v-43z" />
-    <glyph glyph-name="translate" unicode="translate" 
-d="M339 149h69l-35 93zM395 299l96 -256h-43l-24 64h-101l-24 -64h-43l96 256h43zM275 191l-17 -44l-66 66l-107 -106l-30 30l109 107c-27 30 -48 62 -64 97h43c13 -25 29 -49 49 -71c31 34 54 73 68 114h-239v43h150v42h42v-42h150v-43h-63c-16 -50 -42 -98 -79 -139l-1 -1
-z" />
-    <glyph glyph-name="trending_down" unicode="trending_down" 
-d="M341 128l49 49l-104 104l-85 -85l-158 158l30 30l128 -128l85 85l134 -134l49 49v-128h-128z" />
-    <glyph glyph-name="trending_flat" unicode="trending_flat" 
-d="M469 256l-85 -85v64h-320v42h320v64z" />
-    <glyph glyph-name="trending_up" unicode="trending_up" 
-d="M341 384h128v-128l-49 49l-134 -134l-85 85l-128 -128l-30 30l158 158l85 -85l104 104z" />
-    <glyph glyph-name="tune" unicode="tune" 
-d="M320 320v128h43v-43h85v-42h-85v-43h-43zM448 235h-213v42h213v-42zM149 320h43v-128h-43v43h-85v42h85v43zM277 64h-42v128h42v-43h171v-42h-171v-43zM64 405h213v-42h-213v42zM64 149h128v-42h-128v42z" />
-    <glyph glyph-name="turned_in" unicode="turned_in" 
-d="M363 448c23 0 42 -20 42 -43v-341l-149 64l-149 -64v341c0 23 19 43 42 43h214z" />
-    <glyph glyph-name="turned_in_not" unicode="turned_in_not" 
-d="M363 128v277h-214v-277l107 47zM363 448c23 0 42 -20 42 -43v-341l-149 64l-149 -64v341c0 23 19 43 42 43h214z" />
-    <glyph glyph-name="tv" unicode="tv" 
-d="M448 149v256h-384v-256h384zM448 448c23 0 43 -20 43 -43l-1 -256c0 -23 -19 -42 -42 -42h-107v-43h-170v43h-107c-23 0 -43 19 -43 42v256c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="unarchive" unicode="unarchive" 
-d="M109 405h294l-20 22h-256zM256 309l-117 -117h74v-43h86v43h74zM438 401c6 -7 10 -18 10 -28v-266c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v266c0 10 4 21 10 28l29 35c6 7 15 12 25 12h256c10 0 19 -5 25 -12z" />
-    <glyph glyph-name="undo" unicode="undo" 
-d="M267 341c99 0 182 -65 212 -154l-50 -16c-22 68 -86 117 -162 117c-42 0 -80 -15 -110 -40l78 -77h-192v192l76 -77c39 34 91 55 148 55z" />
-    <glyph glyph-name="unfold_less" unicode="unfold_less" 
-d="M354 397l-98 -98l-98 98l30 30l68 -68l68 68zM158 115l98 98l98 -98l-30 -30l-68 68l-68 -68z" />
-    <glyph glyph-name="unfold_more" unicode="unfold_more" 
-d="M256 124l68 68l30 -30l-98 -98l-98 98l30 30zM256 388l-68 -68l-30 30l98 98l98 -98l-30 -30z" />
-    <glyph glyph-name="update" unicode="update" 
-d="M267 341v-90l74 -45l-15 -26l-91 55v106h32zM448 296h-145l59 60c-58 58 -153 60 -211 2s-58 -150 0 -208s153 -58 211 0c29 29 43 62 43 104h43c0 -42 -18 -97 -56 -134c-75 -74 -197 -74 -272 0s-75 194 0 268s195 74 270 0l58 60v-152z" />
-    <glyph glyph-name="usb" unicode="usb" 
-d="M320 363h85v-86h-21v-42c0 -24 -19 -43 -43 -43h-64v-65c15 -8 26 -24 26 -42c0 -26 -21 -47 -47 -47s-47 21 -47 47c0 18 11 34 26 42v65h-64c-24 0 -43 19 -43 43v44c-15 8 -26 23 -26 41c0 26 21 47 47 47s47 -21 47 -47c0 -18 -10 -33 -25 -41v-44h64v170h-43l64 86
-l64 -86h-43v-170h64v42h-21v86z" />
-    <glyph glyph-name="verified_user" unicode="verified_user" 
-d="M213 149l171 171l-30 30l-141 -140l-55 55l-30 -30zM256 491l192 -86v-128c0 -118 -82 -229 -192 -256c-110 27 -192 138 -192 256v128z" />
-    <glyph glyph-name="vertical_align_bottom" unicode="vertical_align_bottom" 
-d="M85 107h342v-43h-342v43zM341 235l-85 -86l-85 86h64v213h42v-213h64z" />
-    <glyph glyph-name="vertical_align_center" unicode="vertical_align_center" 
-d="M85 277h342v-42h-342v42zM341 405l-85 -85l-85 85h64v86h42v-86h64zM171 107l85 85l85 -85h-64v-86h-42v86h-64z" />
-    <glyph glyph-name="vertical_align_top" unicode="vertical_align_top" 
-d="M85 448h342v-43h-342v43zM171 277l85 86l85 -86h-64v-213h-42v213h-64z" />
-    <glyph glyph-name="vibration" unicode="vibration" 
-d="M341 107v298h-170v-298h170zM352 448c18 0 32 -14 32 -32v-320c0 -18 -14 -32 -32 -32h-192c-18 0 -32 14 -32 32v320c0 18 14 32 32 32h192zM405 149v214h43v-214h-43zM469 320h43v-128h-43v128zM64 149v214h43v-214h-43zM0 192v128h43v-128h-43z" />
-    <glyph glyph-name="video_call" unicode="video_call" 
-d="M299 235v42h-64v64h-43v-64h-64v-42h64v-64h43v64h64zM363 288l85 85v-234l-85 85v-75c0 -12 -10 -21 -22 -21h-256c-12 0 -21 9 -21 21v214c0 12 9 21 21 21h256c12 0 22 -9 22 -21v-75z" />
-    <glyph glyph-name="video_label" unicode="video_label" 
-d="M448 171v234h-384v-234h384zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="video_library" unicode="video_library" 
-d="M256 203l128 96l-128 96v-192zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-256c-23 0 -43 20 -43 43v256c0 23 20 42 43 42h256zM85 384v-299h299v-42h-299c-23 0 -42 19 -42 42v299h42z" />
-    <glyph glyph-name="videocam" unicode="videocam" 
-d="M363 288l85 85v-234l-85 85v-75c0 -12 -10 -21 -22 -21h-256c-12 0 -21 9 -21 21v214c0 12 9 21 21 21h256c12 0 22 -9 22 -21v-75z" />
-    <glyph glyph-name="videocam_off" unicode="videocam_off" 
-d="M70 469l378 -378l-27 -27l-68 68c-3 -2 -8 -4 -12 -4h-256c-12 0 -21 9 -21 21v214c0 12 9 21 21 21h16l-58 58zM448 373v-228l-239 239h132c12 0 22 -9 22 -21v-75z" />
-    <glyph glyph-name="videogame_asset" unicode="videogame_asset" 
-d="M416 256c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM331 192c18 0 32 14 32 32s-14 32 -32 32s-32 -14 -32 -32s14 -32 32 -32zM235 235v42h-64v64h-43v-64h-64v-42h64v-64h43v64h64zM448 384c23 0 43 -20 43 -43v-170c0 -23 -20 -43 -43 -43h-384
-c-23 0 -43 20 -43 43v170c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="view_agenda" unicode="view_agenda" 
-d="M427 448c12 0 21 -9 21 -21v-128c0 -12 -9 -22 -21 -22h-363c-12 0 -21 10 -21 22v128c0 12 9 21 21 21h363zM427 235c12 0 21 -10 21 -22v-128c0 -12 -9 -21 -21 -21h-363c-12 0 -21 9 -21 21v128c0 12 9 22 21 22h363z" />
-    <glyph glyph-name="view_array" unicode="view_array" 
-d="M171 128v277h192v-277h-192zM384 405h64v-277h-64v277zM85 128v277h64v-277h-64z" />
-    <glyph glyph-name="view_carousel" unicode="view_carousel" 
-d="M384 384h85v-235h-85v235zM43 149v235h85v-235h-85zM149 107v320h214v-320h-214z" />
-    <glyph glyph-name="view_column" unicode="view_column" 
-d="M341 405h107v-277h-107v277zM85 128v277h107v-277h-107zM213 128v277h107v-277h-107z" />
-    <glyph glyph-name="view_comfy" unicode="view_comfy" 
-d="M384 405h85v-85h-85v85zM384 107v85h85v-85h-85zM277 107v85h86v-85h-86zM171 107v85h85v-85h-85zM64 107v85h85v-85h-85zM384 213v86h85v-86h-85zM277 405h86v-85h-86v85zM171 320v85h85v-85h-85zM277 213v86h86v-86h-86zM171 213v86h85v-86h-85zM64 213v86h85v-86h-85z
-M64 320v85h85v-85h-85z" />
-    <glyph glyph-name="view_compact" unicode="view_compact" 
-d="M64 405h405v-128h-405v128zM213 107v149h256v-149h-256zM64 107v149h128v-149h-128z" />
-    <glyph glyph-name="view_day" unicode="view_day" 
-d="M43 448h405v-64h-405v64zM427 341c12 0 21 -9 21 -21v-128c0 -12 -9 -21 -21 -21h-363c-12 0 -21 9 -21 21v128c0 12 9 21 21 21h363zM43 64v64h405v-64h-405z" />
-    <glyph glyph-name="view_headline" unicode="view_headline" 
-d="M85 405h342v-42h-342v42zM85 277v43h342v-43h-342zM85 107v42h342v-42h-342zM85 192v43h342v-43h-342z" />
-    <glyph glyph-name="view_list" unicode="view_list" 
-d="M192 405h256v-85h-256v85zM192 107v85h256v-85h-256zM192 213v86h256v-86h-256zM85 320v85h86v-85h-86zM85 107v85h86v-85h-86zM85 213v86h86v-86h-86z" />
-    <glyph glyph-name="view_module" unicode="view_module" 
-d="M341 405h107v-128h-107v128zM213 277v128h107v-128h-107zM341 128v128h107v-128h-107zM213 128v128h107v-128h-107zM85 128v128h107v-128h-107zM85 277v128h107v-128h-107z" />
-    <glyph glyph-name="view_quilt" unicode="view_quilt" 
-d="M213 405h235v-128h-235v128zM341 128v128h107v-128h-107zM85 128v277h107v-277h-107zM213 128v128h107v-128h-107z" />
-    <glyph glyph-name="view_stream" unicode="view_stream" 
-d="M85 405h363v-128h-363v128zM85 128v128h363v-128h-363z" />
-    <glyph glyph-name="view_week" unicode="view_week" 
-d="M277 405c12 0 22 -9 22 -21v-256c0 -12 -10 -21 -22 -21h-64c-12 0 -21 9 -21 21v256c0 12 9 21 21 21h64zM427 405c12 0 21 -9 21 -21v-256c0 -12 -9 -21 -21 -21h-64c-12 0 -22 9 -22 21v256c0 12 10 21 22 21h64zM128 405c12 0 21 -9 21 -21v-256
-c0 -12 -9 -21 -21 -21h-64c-12 0 -21 9 -21 21v256c0 12 9 21 21 21h64z" />
-    <glyph glyph-name="vignette" unicode="vignette" 
-d="M256 128c94 0 171 57 171 128s-77 128 -171 128s-171 -57 -171 -128s77 -128 171 -128zM448 448c23 0 43 -20 43 -43v-298c0 -23 -20 -43 -43 -43h-384c-23 0 -43 20 -43 43v298c0 23 20 43 43 43h384z" />
-    <glyph glyph-name="visibility" unicode="visibility" 
-d="M256 320c35 0 64 -29 64 -64s-29 -64 -64 -64s-64 29 -64 64s29 64 64 64zM256 149c59 0 107 48 107 107s-48 107 -107 107s-107 -48 -107 -107s48 -107 107 -107zM256 416c107 0 198 -66 235 -160c-37 -94 -128 -160 -235 -160s-198 66 -235 160c37 94 128 160 235 160z
-" />
-    <glyph glyph-name="visibility_off" unicode="visibility_off" 
-d="M253 320h3c35 0 64 -29 64 -64v-4zM161 303c-7 -14 -12 -30 -12 -47c0 -59 48 -107 107 -107c17 0 33 5 47 12l-33 33c-4 -1 -9 -2 -14 -2c-35 0 -64 29 -64 64c0 5 1 10 2 14zM43 421l27 27l378 -378l-27 -27c-23.9841 23.6825 -48.1328 47.2006 -72 71
-c-29 -12 -60 -18 -93 -18c-107 0 -198 66 -235 160c17 42 45 78 80 106c-19.5086 19.4914 -38.6537 39.3463 -58 59zM256 363c-14 0 -27 -3 -39 -8l-46 46c26 10 55 15 85 15c107 0 197 -66 234 -160c-16 -40 -41 -74 -73 -101l-62 62c5 12 8 25 8 39c0 59 -48 107 -107 107
-z" />
-    <glyph glyph-name="voice_chat" unicode="voice_chat" 
-d="M384 213v171l-85 -68v68h-171v-171h171v69zM427 469c23 0 42 -19 42 -42v-256c0 -23 -19 -43 -42 -43h-299l-85 -85v384c0 23 19 42 42 42h342z" />
-    <glyph glyph-name="voicemail" unicode="voicemail" 
-d="M395 192c41 0 74 34 74 75s-33 74 -74 74s-75 -33 -75 -74s34 -75 75 -75zM117 192c41 0 75 34 75 75s-34 74 -75 74s-74 -33 -74 -74s33 -75 74 -75zM395 384c65 0 117 -52 117 -117s-52 -118 -117 -118h-278c-65 0 -117 53 -117 118s52 117 117 117s118 -52 118 -117
-c0 -28 -10 -55 -27 -75h96c-17 20 -27 47 -27 75c0 65 53 117 118 117z" />
-    <glyph glyph-name="volume_down" unicode="volume_down" 
-d="M107 320h85l107 107v-342l-107 107h-85v128zM395 256c0 -38 -22 -70 -54 -86v172c32 -16 54 -48 54 -86z" />
-    <glyph glyph-name="volume_mute" unicode="volume_mute" 
-d="M149 320h86l106 107v-342l-106 107h-86v128z" />
-    <glyph glyph-name="volume_off" unicode="volume_off" 
-d="M256 427v-90l-45 45zM91 448l357 -357l-27 -27l-44 44c-23 -18 -49 -32 -78 -39v44c18 5 34 14 48 25l-91 91v-144l-107 107h-85v128h101l-101 101zM405 256c0 68 -44 125 -106 143v44c86 -19 149 -96 149 -187c0 -32 -8 -63 -22 -89l-32 33c7 17 11 36 11 56zM352 256
-c0 -5 0 -9 -1 -13l-52 52v47c32 -16 53 -48 53 -86z" />
-    <glyph glyph-name="volume_up" unicode="volume_up" 
-d="M299 443c86 -19 149 -96 149 -187s-63 -168 -149 -187v44c62 18 106 75 106 143s-44 125 -106 143v44zM352 256c0 -38 -21 -70 -53 -86v172c32 -16 53 -48 53 -86zM64 320h85l107 107v-342l-107 107h-85v128z" />
-    <glyph glyph-name="vpn_key" unicode="vpn_key" 
-d="M149 213c23 0 43 20 43 43s-20 43 -43 43s-42 -20 -42 -43s19 -43 42 -43zM270 299h221v-86h-43v-85h-85v85h-93c-17 -50 -65 -85 -121 -85c-71 0 -128 57 -128 128s57 128 128 128c56 0 104 -35 121 -85z" />
-    <glyph glyph-name="vpn_lock" unicode="vpn_lock" 
-d="M213 65v42c-23 0 -42 19 -42 42v22l-103 102c-3 -12 -4 -25 -4 -38c0 -87 65 -160 149 -170zM404 256h43c1 -7 1 -14 1 -21c0 -118 -95 -214 -213 -214s-214 96 -214 214s96 213 214 213c22 0 44 -4 64 -10v-54c0 -23 -20 -43 -43 -43h-43v-42c0 -12 -9 -22 -21 -22h-43
-v-42h128c12 0 22 -10 22 -22v-64h21c19 0 35 -12 41 -29c28 30 44 71 44 115c0 7 0 14 -1 21zM452 427v10c0 20 -16 37 -36 37s-36 -17 -36 -37v-10h72zM469 427c12 0 22 -10 22 -22v-85c0 -12 -10 -21 -22 -21h-106c-12 0 -22 9 -22 21v85c0 12 10 22 22 22v10
-c0 29 24 54 53 54s53 -25 53 -54v-10z" />
-    <glyph glyph-name="wallpaper" unicode="wallpaper" 
-d="M85 235v-150h150v-42h-150c-23 0 -42 19 -42 42v150h42zM427 85v150h42v-150c0 -23 -19 -42 -42 -42h-150v42h150zM427 469c23 0 42 -19 42 -42v-150h-42v150h-150v42h150zM363 331c0 -18 -14 -32 -32 -32s-32 14 -32 32s14 32 32 32s32 -14 32 -32zM213 235l64 -79
-l43 57l64 -85h-256zM85 427v-150h-42v150c0 23 19 42 42 42h150v-42h-150z" />
-    <glyph glyph-name="warning" unicode="warning" 
-d="M277 213v86h-42v-86h42zM277 128v43h-42v-43h42zM21 64l235 405l235 -405h-470z" />
-    <glyph glyph-name="watch" unicode="watch" 
-d="M128 256c0 -71 57 -128 128 -128s128 57 128 128s-57 128 -128 128s-128 -57 -128 -128zM427 256c0 -54 -26 -103 -65 -134l-21 -122h-170l-21 122c-40 31 -65 80 -65 134s25 103 65 134l21 122h170l21 -122c39 -31 65 -80 65 -134z" />
-    <glyph glyph-name="watch_later" unicode="watch_later" 
-d="M346 166l17 28l-96 58v111h-32v-128zM256 469c117 0 213 -96 213 -213s-96 -213 -213 -213s-213 96 -213 213s96 213 213 213z" />
-    <glyph glyph-name="wb_auto" unicode="wb_auto" 
-d="M220 171h40l-68 192h-43l-68 -192h41l15 42h68zM469 363h39l-44 -192h-37l-32 130l-32 -130h-38l-2 9c-28 -56 -85 -95 -152 -95c-94 0 -171 77 -171 171s77 171 171 171c54 0 102 -25 133 -64h16l26 -135l32 135h34l32 -135zM146 242l25 78l24 -78h-49z" />
-    <glyph glyph-name="wb_cloudy" unicode="wb_cloudy" 
-d="M413 298c55 -4 99 -50 99 -106c0 -59 -48 -107 -107 -107h-277c-71 0 -128 57 -128 128c0 66 50 120 114 127c27 51 80 87 142 87c78 0 142 -55 157 -129z" />
-    <glyph glyph-name="wb_incandescent" unicode="wb_incandescent" 
-d="M368 125l30 29l38 -38l-30 -30zM427 288h64v-43h-64v43zM320 377c38 -22 64 -63 64 -110c0 -71 -57 -128 -128 -128s-128 57 -128 128c0 47 26 88 64 110v103h128v-103zM85 288v-43h-64v43h64zM235 33v63h42v-63h-42zM76 116l38 39l30 -30l-38 -39z" />
-    <glyph glyph-name="wb_iridescent" unicode="wb_iridescent" 
-d="M106 86l-30 31l38 38l30 -30zM76 417l30 30l38 -38l-30 -30zM436 116l-30 -30l-38 39l30 30zM277 33h-42v63h42v-63zM406 447l30 -30l-38 -38l-30 30zM235 500h42v-63h-42v63zM107 203v128h298v-128h-298z" />
-    <glyph glyph-name="wb_sunny" unicode="wb_sunny" 
-d="M76 116l38 39l30 -30l-38 -39zM235 33v63h42v-63h-42zM256 395c71 0 128 -57 128 -128s-57 -128 -128 -128s-128 57 -128 128s57 128 128 128zM427 288h64v-43h-64v43zM368 125l30 29l38 -38l-30 -30zM436 417l-38 -38l-30 30l38 38zM277 500v-63h-42v63h42zM85 288v-43
-h-64v43h64zM144 409l-30 -30l-38 38l30 30z" />
-    <glyph glyph-name="wc" unicode="wc" 
-d="M352 384c-24 0 -43 19 -43 43s19 42 43 42s43 -18 43 -42s-19 -43 -43 -43zM160 384c-24 0 -43 19 -43 43s19 42 43 42s43 -18 43 -42s-19 -43 -43 -43zM384 43h-64v128h-64l54 162c6 17 23 30 41 30h2c18 0 35 -13 41 -30l54 -162h-64v-128zM117 43v160h-32v117
-c0 23 20 43 43 43h64c23 0 43 -20 43 -43v-117h-32v-160h-86z" />
-    <glyph glyph-name="web" unicode="web" 
-d="M427 128v192h-86v-192h86zM320 235v85h-235v-85h235zM320 128v85h-235v-85h235zM427 427c23 0 42 -20 42 -43v-256c0 -23 -19 -43 -42 -43h-342c-23 0 -42 20 -42 43v256c0 23 19 43 42 43h342z" />
-    <glyph glyph-name="web_asset" unicode="web_asset" 
-d="M405 128v213h-298v-213h298zM405 427c24 0 43 -20 43 -43v-256c0 -23 -20 -43 -43 -43h-298c-24 0 -43 20 -43 43v256c0 23 19 43 43 43h298z" />
-    <glyph glyph-name="weekend" unicode="weekend" 
-d="M384 405c23 0 43 -19 43 -42v-46c-25 -9 -43 -32 -43 -60v-44h-256v44c0 28 -18 51 -43 60v46c0 23 20 42 43 42h256zM448 299c23 0 43 -20 43 -43v-107c0 -23 -20 -42 -43 -42h-384c-23 0 -43 19 -43 42v107c0 23 20 43 43 43s43 -20 43 -43v-64h298v64
-c0 23 20 43 43 43z" />
-    <glyph glyph-name="whatshot" unicode="whatshot" 
-d="M250 107c57 0 102 45 102 102c0 30 -4 58 -12 86c-22 -29 -61 -47 -99 -55s-60 -31 -60 -66c0 -37 31 -67 69 -67zM288 498c83 -67 139 -170 139 -285c0 -94 -77 -170 -171 -170s-171 76 -171 170c0 72 26 139 69 190v-8c0 -44 33 -79 77 -79s73 35 73 79
-c0 46 -16 103 -16 103z" />
-    <glyph glyph-name="widgets" unicode="widgets" 
-d="M355 476l121 -121l-121 -120h93v-171h-171v171h78l-120 120v-78h-171v171h171v-93zM64 64v171h171v-171h-171z" />
-    <glyph glyph-name="wifi" unicode="wifi" 
-d="M107 235c83 82 216 82 298 0l-42 -43c-59 59 -155 59 -214 0zM192 149c35 35 93 35 128 0l-64 -64zM21 320c130 129 341 129 470 0l-43 -43c-106 106 -278 106 -384 0z" />
-    <glyph glyph-name="wifi_lock" unicode="wifi_lock" 
-d="M469 171v32c0 18 -14 32 -32 32s-32 -14 -32 -32v-32h64zM491 171c12 0 21 -10 21 -22v-85c0 -12 -9 -21 -21 -21h-107c-12 0 -21 9 -21 21v85c0 12 9 22 21 22v32c0 29 24 53 53 53s54 -24 54 -53v-32zM437 309c-59 0 -106 -47 -106 -106v-61l-75 -99l-256 341
-c71 54 160 85 256 85s185 -31 256 -85l-57 -76c-6 1 -12 1 -18 1z" />
-    <glyph glyph-name="wifi_tethering" unicode="wifi_tethering" 
-d="M256 448c118 0 213 -95 213 -213c0 -79 -42 -148 -106 -185l-22 37c51 30 86 85 86 148c0 94 -77 170 -171 170s-171 -76 -171 -170c0 -63 34 -118 85 -148l-21 -37c-64 37 -106 106 -106 185c0 118 95 213 213 213zM384 235c0 -47 -26 -89 -64 -111l-21 37
-c25 15 42 42 42 74c0 47 -38 85 -85 85s-85 -38 -85 -85c0 -32 17 -59 42 -74l-21 -37c-38 22 -64 64 -64 111c0 71 57 128 128 128s128 -57 128 -128zM256 277c23 0 43 -19 43 -42s-20 -43 -43 -43s-43 20 -43 43s20 42 43 42z" />
-    <glyph glyph-name="work" unicode="work" 
-d="M299 384v43h-86v-43h86zM427 384c24 0 42 -19 42 -43v-234c0 -24 -18 -43 -42 -43h-342c-24 0 -42 19 -42 43v234c0 24 18 43 42 43h86v43c0 24 18 42 42 42h86c24 0 42 -18 42 -42v-43h86z" />
-    <glyph glyph-name="wrap_text" unicode="wrap_text" 
-d="M363 277c47 0 85 -38 85 -85s-38 -85 -85 -85h-43v-43l-64 64l64 64v-43h48c23 0 43 20 43 43s-20 43 -43 43h-283v42h278zM427 405v-42h-342v42h342zM85 107v42h128v-42h-128z" />
-    <glyph glyph-name="youtube_searched_for" unicode="youtube_searched_for" 
-d="M363 213l106 -106l-31 -32l-107 107v16l-6 6c-24 -21 -56 -33 -90 -33c-26 0 -50 7 -71 19l32 31c12 -5 25 -8 39 -8c53 0 96 43 96 96s-43 96 -96 96s-96 -43 -96 -96h74l-88 -85l-82 85h53c0 75 62 139 139 139s139 -62 139 -139c0 -35 -13 -66 -34 -90l6 -6h17z" />
-    <glyph glyph-name="zoom_in" unicode="zoom_in" 
-d="M256 299h-43v-43h-21v43h-43v21h43v43h21v-43h43v-21zM203 213c53 0 96 43 96 96s-43 96 -96 96s-96 -43 -96 -96s43 -96 96 -96zM331 213l106 -106l-32 -32l-106 106v17l-6 6c-24 -21 -56 -33 -90 -33c-77 0 -139 61 -139 138s62 139 139 139s138 -62 138 -139
-c0 -34 -12 -66 -33 -90l6 -6h17z" />
-    <glyph glyph-name="zoom_out" unicode="zoom_out" 
-d="M149 320h107v-21h-107v21zM203 213c53 0 96 43 96 96s-43 96 -96 96s-96 -43 -96 -96s43 -96 96 -96zM331 213l106 -106l-32 -32l-106 106v17l-6 6c-24 -21 -56 -33 -90 -33c-77 0 -139 61 -139 138s62 139 139 139s138 -62 138 -139c0 -34 -12 -66 -33 -90l6 -6h17z" />
-    <glyph glyph-name="zoom_out_map" unicode="zoom_out_map" 
-d="M448 192v-128h-128l49 49l-62 61l31 31l61 -62zM192 64h-128v128l49 -49l61 62l31 -31l-62 -61zM64 320v128h128l-49 -49l62 -61l-31 -31l-61 62zM320 448h128v-128l-49 49l-61 -62l-31 31l62 61z" />
-    <glyph glyph-name="3" unicode="3" 
-d="M0 0z" />
-    <glyph glyph-name="d" unicode="d" 
-d="M0 0z" />
-    <glyph glyph-name="_" unicode="_" 
-d="M0 0z" />
-    <glyph glyph-name="r" unicode="r" 
-d="M0 0z" />
-    <glyph glyph-name="o" unicode="o" 
-d="M0 0z" />
-    <glyph glyph-name="t" unicode="t" 
-d="M0 0z" />
-    <glyph glyph-name="a" unicode="a" 
-d="M0 0z" />
-    <glyph glyph-name="i" unicode="i" 
-d="M0 0z" />
-    <glyph glyph-name="n" unicode="n" 
-d="M0 0z" />
-    <glyph glyph-name="c" unicode="c" 
-d="M0 0z" />
-    <glyph glyph-name="u" unicode="u" 
-d="M0 0z" />
-    <glyph glyph-name="e" unicode="e" 
-d="M0 0z" />
-    <glyph glyph-name="s" unicode="s" 
-d="M0 0z" />
-    <glyph glyph-name="l" unicode="l" 
-d="M0 0z" />
-    <glyph glyph-name="m" unicode="m" 
-d="M0 0z" />
-    <glyph glyph-name="b" unicode="b" 
-d="M0 0z" />
-    <glyph glyph-name="y" unicode="y" 
-d="M0 0z" />
-    <glyph glyph-name="w" unicode="w" 
-d="M0 0z" />
-    <glyph glyph-name="x" unicode="x" 
-d="M0 0z" />
-    <glyph glyph-name="p" unicode="p" 
-d="M0 0z" />
-    <glyph glyph-name="h" unicode="h" 
-d="M0 0z" />
-    <glyph glyph-name="g" unicode="g" 
-d="M0 0z" />
-    <glyph glyph-name="q" unicode="q" 
-d="M0 0z" />
-    <glyph glyph-name="j" unicode="j" 
-d="M0 0z" />
-    <glyph glyph-name="f" unicode="f" 
-d="M0 0z" />
-    <glyph glyph-name="v" unicode="v" 
-d="M0 0z" />
-    <glyph glyph-name="k" unicode="k" 
-d="M0 0z" />
-    <glyph glyph-name="z" unicode="z" 
-d="M0 0z" />
-    <glyph glyph-name="1" unicode="1" 
-d="M0 0z" />
-    <glyph glyph-name="2" unicode="2" 
-d="M0 0z" />
-    <glyph glyph-name="4" unicode="4" 
-d="M0 0z" />
-    <glyph glyph-name="5" unicode="5" 
-d="M0 0z" />
-    <glyph glyph-name="6" unicode="6" 
-d="M0 0z" />
-    <glyph glyph-name="7" unicode="7" 
-d="M0 0z" />
-    <glyph glyph-name="9" unicode="9" 
-d="M0 0z" />
-    <glyph glyph-name="8" unicode="8" 
-d="M0 0z" />
-    <glyph glyph-name="0" unicode="0" 
-d="M0 0z" />
-  </font>
-</defs></svg>
diff --git a/static/fonts/MaterialIcons-Regular.ttf b/static/fonts/MaterialIcons-Regular.ttf
deleted file mode 100644
index 7015564..0000000
Binary files a/static/fonts/MaterialIcons-Regular.ttf and /dev/null differ
diff --git a/template_render_test.go b/template_render_test.go
new file mode 100644
index 0000000..53233b1
--- /dev/null
+++ b/template_render_test.go
@@ -0,0 +1,321 @@
+/*
+ * Copyright © 2026 Musing Studio LLC.
+ *
+ * This file is part of WriteFreely.
+ *
+ * WriteFreely is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, included
+ * in the LICENSE file in this source code package.
+ */
+
+package writefreely
+
+import (
+	stdlog "log"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/writeas/web-core/auth"
+	wflog "github.com/writeas/web-core/log"
+
+	"github.com/writefreely/writefreely/config"
+	"github.com/writefreely/writefreely/key"
+)
+
+// This file contains integration tests that render real pages -- especially
+// authenticated "/me" pages and blog pages -- against a real (SQLite-backed)
+// App and asserts that template execution didn't fail.
+//
+// Detecting a failed template render is trickier than checking the HTTP
+// status code alone: html/template writes to the ResponseWriter as it
+// executes, so a mid-render failure can leave a 200 status already sent
+// with a truncated body, while the error itself only surfaces as a
+// log.Error call and, if the handler propagates it, a *second* attempt to
+// write the 500 error page on top of the partial output. So each check
+// here does three things:
+//   - capture web-core/log's error output during the request and fail if
+//     it contains "template:", the prefix Go's text/template package uses
+//     for every execution error
+//   - fail on a >=500 status
+//   - fail if the body contains the 500 page's own text, which would only
+//     appear if the internal-error template got rendered (possibly
+//     appended after partial output from the page that actually failed)
+
+// newTemplateTestApp builds a fully-initialized App backed by a temporary
+// SQLite database and disposable in-memory keys, for use in rendering
+// tests. It skips the test if the binary wasn't built with `-tags sqlite`.
+func newTemplateTestApp(t *testing.T, mutate func(cfg *config.Config)) (*App, *mux.Router) {
+	t.Helper()
+	if !SQLiteEnabled {
+		t.Skip("SQLite support not compiled in; run with `go test -tags sqlite` to run this test")
+	}
+
+	dir := t.TempDir()
+
+	cfg := config.New()
+	cfg.Server.TemplatesParentDir = ""
+	cfg.Server.PagesParentDir = ""
+	cfg.Server.StaticParentDir = "testdata"
+	cfg.App.Host = "http://localhost:8080"
+	cfg.App.SiteName = "Test Instance"
+	cfg.App.Federation = true
+	cfg.App.UpdateChecks = false
+	cfg.App.MinUsernameLen = 1
+	cfg.App.UserInvites = "user"
+	// Make the auto-created user blog fully public so we exercise the
+	// normal collection/post templates rather than the password-gate flow.
+	cfg.App.DefaultVisibility = "public"
+	cfg.App.LocalTimeline = true
+	cfg.Database.Type = driverSQLite
+	cfg.Database.FileName = filepath.Join(dir, "writefreely.db")
+
+	if mutate != nil {
+		mutate(cfg)
+	}
+
+	app := &App{cfg: cfg}
+
+	app.keys = &key.Keychain{}
+	if err := app.keys.GenerateKeys(); err != nil {
+		t.Fatalf("generate keys: %v", err)
+	}
+
+	if err := InitTemplates(app.cfg); err != nil {
+		t.Fatalf("init templates: %v", err)
+	}
+
+	app.InitSession()
+	app.InitDecoder()
+
+	connectToDatabase(app)
+	t.Cleanup(func() { app.db.Close() })
+
+	if err := adminInitDatabase(app); err != nil {
+		t.Fatalf("init database: %v", err)
+	}
+
+	initActivityPub(app)
+	if app.cfg.App.LocalTimeline {
+		initLocalTimeline(app)
+	}
+
+	router := mux.NewRouter()
+	InitRoutes(app, router)
+	app.InitStaticRoutes(router)
+
+	return app, router
+}
+
+// loginCookie returns a session cookie that authenticates as the given user,
+// bypassing the login form/handler entirely.
+func loginCookie(t *testing.T, app *App, u *User) *http.Cookie {
+	t.Helper()
+
+	r := httptest.NewRequest("GET", "/", nil)
+	w := httptest.NewRecorder()
+
+	session, err := app.sessionStore.New(r, cookieName)
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+	session.Values[cookieUserVal] = u.Cookie()
+	if err := session.Save(r, w); err != nil {
+		t.Fatalf("save session: %v", err)
+	}
+
+	for _, c := range w.Result().Cookies() {
+		if c.Name == cookieName {
+			return c
+		}
+	}
+	t.Fatal("login did not produce a session cookie")
+	return nil
+}
+
+// renderedRequest performs an HTTP request against the router and returns
+// the response along with any error-level log output produced while
+// handling it.
+func renderedRequest(t *testing.T, router *mux.Router, method, path string, cookies []*http.Cookie) (*httptest.ResponseRecorder, string) {
+	t.Helper()
+
+	var logBuf strings.Builder
+	prevErrorLog := wflog.ErrorLog
+	wflog.ErrorLog = stdlog.New(&logBuf, "", 0)
+	defer func() { wflog.ErrorLog = prevErrorLog }()
+
+	req := httptest.NewRequest(method, path, nil)
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	return rec, logBuf.String()
+}
+
+// assertRendersCleanly performs the request and fails the test if there's
+// any sign the page failed to render -- see the file-level comment for what
+// "any sign" means.
+func assertRendersCleanly(t *testing.T, router *mux.Router, method, path string, cookies []*http.Cookie, wantStatus int) *httptest.ResponseRecorder {
+	t.Helper()
+
+	rec, logOutput := renderedRequest(t, router, method, path, cookies)
+
+	if wantStatus > 0 && rec.Code != wantStatus {
+		t.Errorf("%s %s: status = %d, want %d (body: %s)", method, path, rec.Code, wantStatus, truncateForLog(rec.Body.String()))
+	}
+	if rec.Code >= http.StatusInternalServerError {
+		t.Errorf("%s %s: got server error status %d (body: %s)", method, path, rec.Code, truncateForLog(rec.Body.String()))
+	}
+	if strings.Contains(logOutput, "template:") {
+		t.Errorf("%s %s: template rendering error logged: %s", method, path, logOutput)
+	}
+	if strings.Contains(rec.Body.String(), "There seems to be an issue with this server") {
+		t.Errorf("%s %s: response contains the embedded 500 page, meaning rendering failed partway through:\n%s", method, path, truncateForLog(rec.Body.String()))
+	}
+
+	return rec
+}
+
+func truncateForLog(s string) string {
+	const max = 1000
+	if len(s) <= max {
+		return s
+	}
+	return s[:max] + "...(truncated)"
+}
+
+// createTemplateTestUser creates a user (and their auto-generated blog) and
+// a single published post in it, returning all three.
+func createTemplateTestUser(t *testing.T, app *App, username string) (*User, *Collection, *Post) {
+	t.Helper()
+
+	hashedPass, err := auth.HashPass([]byte("testpassword"))
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+
+	u := &User{Username: username, HashedPass: hashedPass}
+	if err := app.db.CreateUser(app.cfg, u, "", ""); err != nil {
+		t.Fatalf("create user %q: %v", username, err)
+	}
+
+	coll, err := app.db.GetCollection(username)
+	if err != nil {
+		t.Fatalf("get collection for %q: %v", username, err)
+	}
+
+	title := "Hello World"
+	content := "This is a **test** post used to exercise template rendering.\n\nIt has multiple paragraphs, and a [link](https://example.com)."
+	post, err := app.db.CreatePost(u.ID, coll.ID, &SubmittedPost{Title: &title, Content: &content})
+	if err != nil {
+		t.Fatalf("create post: %v", err)
+	}
+
+	return u, coll, post
+}
+
+// TestTemplateRendering_MeAndBlogPages exercises the authenticated "/me"
+// pages and blog rendering across single-user and multi-user instances (the
+// latter with Chorus both on and off), asserting nothing fails to render.
+func TestTemplateRendering_MeAndBlogPages(t *testing.T) {
+	configs := []struct {
+		name   string
+		mutate func(cfg *config.Config)
+	}{
+		{
+			name: "SingleUser",
+			mutate: func(cfg *config.Config) {
+				cfg.App.SingleUser = true
+			},
+		},
+		{
+			name: "MultiUser_ChorusOff",
+			mutate: func(cfg *config.Config) {
+				cfg.App.SingleUser = false
+				cfg.App.Chorus = false
+			},
+		},
+		{
+			name: "MultiUser_ChorusOn",
+			mutate: func(cfg *config.Config) {
+				cfg.App.SingleUser = false
+				cfg.App.Chorus = true
+			},
+		},
+	}
+
+	for _, tc := range configs {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			app, router := newTemplateTestApp(t, tc.mutate)
+			u, coll, post := createTemplateTestUser(t, app, "tester")
+			cookie := loginCookie(t, app, u)
+
+			slug := post.Slug.String
+			if slug == "" {
+				slug = post.ID
+			}
+
+			blogPrefix := ""
+			if !app.cfg.App.SingleUser {
+				blogPrefix = "/" + coll.Alias
+			}
+
+			type pageCase struct {
+				name       string
+				path       string
+				authed     bool
+				wantStatus int // 0 means "just don't 5xx or fail to render"
+			}
+
+			cases := []pageCase{
+				// Blog rendering
+				{name: "blog index (anon)", path: blogPrefix + "/", authed: false, wantStatus: http.StatusOK},
+				{name: "blog index (owner)", path: blogPrefix + "/", authed: true, wantStatus: http.StatusOK},
+				{name: "blog archive (anon)", path: blogPrefix + "/archive/", authed: false, wantStatus: http.StatusOK},
+				{name: "post view (anon)", path: blogPrefix + "/" + slug, authed: false, wantStatus: http.StatusOK},
+				{name: "post view (owner)", path: blogPrefix + "/" + slug, authed: true, wantStatus: http.StatusOK},
+				{name: "post edit (owner)", path: blogPrefix + "/" + slug + "/edit", authed: true, wantStatus: http.StatusOK},
+
+				// Reader
+				{name: "reader", path: "/read", authed: false, wantStatus: http.StatusOK},
+
+				// Authenticated "/me" pages
+				{name: "me: collections list", path: "/me/c/", authed: true, wantStatus: http.StatusOK},
+				{name: "me: edit collection", path: "/me/c/" + coll.Alias, authed: true, wantStatus: http.StatusOK},
+				{name: "me: collection stats", path: "/me/c/" + coll.Alias + "/stats", authed: true, wantStatus: http.StatusOK},
+				{name: "me: posts list", path: "/me/posts/", authed: true, wantStatus: http.StatusOK},
+				{name: "me: export", path: "/me/export", authed: true, wantStatus: http.StatusOK},
+				{name: "me: import", path: "/me/import", authed: true, wantStatus: http.StatusOK},
+				{name: "me: invites", path: "/me/invites", authed: true, wantStatus: http.StatusOK},
+				{name: "me: settings", path: "/me/settings", authed: true, wantStatus: http.StatusOK},
+			}
+
+			if app.cfg.App.SingleUser {
+				cases = append(cases, pageCase{name: "pad: new post", path: "/me/new", authed: true, wantStatus: http.StatusOK})
+			} else {
+				cases = append(cases, pageCase{name: "pad: new post", path: "/new", authed: true, wantStatus: http.StatusOK})
+				cases = append(cases,
+					pageCase{name: "home (anon)", path: "/", authed: false},
+					pageCase{name: "home (authed)", path: "/", authed: true},
+				)
+			}
+
+			for _, c := range cases {
+				c := c
+				t.Run(c.name, func(t *testing.T) {
+					var cookies []*http.Cookie
+					if c.authed {
+						cookies = []*http.Cookie{cookie}
+					}
+					assertRendersCleanly(t, router, "GET", c.path, cookies, c.wantStatus)
+				})
+			}
+		})
+	}
+}
diff --git a/templates.go b/templates.go
index 484bb99..5d9468e 100644
--- a/templates.go
+++ b/templates.go
@@ -1,240 +1,262 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"errors"
+	"fmt"
 	"html/template"
 	"io"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 
 	"github.com/dustin/go-humanize"
 	"github.com/writeas/web-core/l10n"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/config"
 )
 
 var (
 	templates = map[string]*template.Template{}
 	pages     = map[string]*template.Template{}
 	userPages = map[string]*template.Template{}
 	funcMap   = template.FuncMap{
 		"largeNumFmt": largeNumFmt,
 		"pluralize":   pluralize,
 		"isRTL":       isRTL,
 		"isLTR":       isLTR,
 		"localstr":    localStr,
 		"localhtml":   localHTML,
 		"tolower":     strings.ToLower,
 		"title":       strings.Title,
 		"hasPrefix":   strings.HasPrefix,
 		"hasSuffix":   strings.HasSuffix,
 		"dict":        dict,
 	}
 )
 
 const (
 	templatesDir = "templates"
 	pagesDir     = "pages"
 )
 
 func showUserPage(w http.ResponseWriter, name string, obj interface{}) {
 	if obj == nil {
 		log.Error("showUserPage: data is nil!")
 		return
 	}
 	if err := userPages[filepath.Join("user", name+".tmpl")].ExecuteTemplate(w, name, obj); err != nil {
 		log.Error("Error parsing %s: %v", name, err)
 	}
 }
 
 func initTemplate(parentDir, name string) {
 	if debugging {
 		log.Info("  " + filepath.Join(parentDir, templatesDir, name+".tmpl"))
 	}
 
 	files := []string{
 		filepath.Join(parentDir, templatesDir, name+".tmpl"),
 		filepath.Join(parentDir, templatesDir, "include", "footer.tmpl"),
 		filepath.Join(parentDir, templatesDir, "base.tmpl"),
 		filepath.Join(parentDir, templatesDir, "user", "include", "silenced.tmpl"),
 	}
 	if name == "collection" || name == "collection-tags" || name == "collection-archive" || name == "chorus-collection" || name == "read" {
 		// These pages list out collection posts, so we also parse templatesDir + "include/posts.tmpl"
 		files = append(files, filepath.Join(parentDir, templatesDir, "include", "posts.tmpl"))
 	}
 	if name == "chorus-collection" || name == "chorus-collection-post" {
 		files = append(files, filepath.Join(parentDir, templatesDir, "user", "include", "header.tmpl"))
 	}
 	if name == "collection" || name == "collection-tags" || name == "collection-archive" || name == "collection-post" || name == "post" || name == "chorus-collection" || name == "chorus-collection-post" {
 		files = append(files, filepath.Join(parentDir, templatesDir, "include", "post-render.tmpl"))
 	}
 	templates[name] = template.Must(template.New("").Funcs(funcMap).ParseFiles(files...))
 }
 
 func initPage(parentDir, path, key string) {
 	if debugging {
 		log.Info("  [%s] %s", key, path)
 	}
 
 	files := []string{
 		path,
 		filepath.Join(parentDir, templatesDir, "include", "footer.tmpl"),
 		filepath.Join(parentDir, templatesDir, "base.tmpl"),
 		filepath.Join(parentDir, templatesDir, "user", "include", "silenced.tmpl"),
 	}
 
 	if key == "login.tmpl" || key == "landing.tmpl" || key == "signup.tmpl" {
 		files = append(files, filepath.Join(parentDir, templatesDir, "include", "oauth.tmpl"))
 	}
 
 	pages[key] = template.Must(template.New("").Funcs(funcMap).ParseFiles(files...))
 }
 
 func initUserPage(parentDir, path, key string) {
 	if debugging {
 		log.Info("  [%s] %s", key, path)
 	}
 
 	userPages[key] = template.Must(template.New(key).Funcs(funcMap).ParseFiles(
 		path,
 		filepath.Join(parentDir, templatesDir, "user", "include", "header.tmpl"),
 		filepath.Join(parentDir, templatesDir, "user", "include", "footer.tmpl"),
 		filepath.Join(parentDir, templatesDir, "user", "include", "silenced.tmpl"),
 		filepath.Join(parentDir, templatesDir, "user", "include", "nav.tmpl"),
 	))
 }
 
+// missingDirError returns a helpful error when required templates/pages directory doesn't exist.
+func missingDirError(name, dir string, err error) error {
+	if !os.IsNotExist(err) {
+		return err
+	}
+	abs, absErr := filepath.Abs(dir)
+	if absErr != nil {
+		abs = dir
+	}
+	return fmt.Errorf("unable to find %s directory, expected at %q", name, abs)
+}
+
 // InitTemplates loads all template files from the configured parent dir.
 func InitTemplates(cfg *config.Config) error {
 	log.Info("Loading templates...")
-	tmplFiles, err := os.ReadDir(filepath.Join(cfg.Server.TemplatesParentDir, templatesDir))
+	templatesPath := filepath.Join(cfg.Server.TemplatesParentDir, templatesDir)
+	tmplFiles, err := os.ReadDir(templatesPath)
 	if err != nil {
-		return err
+		return missingDirError(templatesDir, templatesPath, err)
 	}
 
 	for _, f := range tmplFiles {
 		if !f.IsDir() && !strings.HasPrefix(f.Name(), ".") {
 			parts := strings.Split(f.Name(), ".")
 			key := parts[0]
 			initTemplate(cfg.Server.TemplatesParentDir, key)
 		}
 	}
 
 	log.Info("Loading pages...")
 	// Initialize all static pages that use the base template
-	err = filepath.Walk(filepath.Join(cfg.Server.PagesParentDir, pagesDir), func(path string, i os.FileInfo, err error) error {
+	pagesPath := filepath.Join(cfg.Server.PagesParentDir, pagesDir)
+	err = filepath.Walk(pagesPath, func(path string, i os.FileInfo, err error) error {
 		if err != nil {
+			if path == pagesPath {
+				return missingDirError(pagesDir, pagesPath, err)
+			}
 			return err
 		}
 		if !i.IsDir() && !strings.HasPrefix(i.Name(), ".") {
 			key := i.Name()
 			initPage(cfg.Server.PagesParentDir, path, key)
 		}
 
 		return nil
 	})
 	if err != nil {
 		return err
 	}
 
 	log.Info("Loading user pages...")
 	// Initialize all user pages that use base templates
-	err = filepath.Walk(filepath.Join(cfg.Server.TemplatesParentDir, templatesDir, "user"), func(path string, f os.FileInfo, err error) error {
+	userPath := filepath.Join(cfg.Server.TemplatesParentDir, templatesDir, "user")
+	err = filepath.Walk(userPath, func(path string, f os.FileInfo, err error) error {
 		if err != nil {
+			if path == userPath {
+				return missingDirError(filepath.Join(templatesDir, "user"), userPath, err)
+			}
 			return err
 		}
 		if !f.IsDir() && !strings.HasPrefix(f.Name(), ".") {
 			corePath := path
 			if cfg.Server.TemplatesParentDir != "" {
 				corePath = corePath[len(cfg.Server.TemplatesParentDir)+1:]
 			}
 			parts := strings.Split(corePath, string(filepath.Separator))
 			key := f.Name()
 			if len(parts) > 2 {
 				key = filepath.Join(parts[1], f.Name())
 			}
 			initUserPage(cfg.Server.TemplatesParentDir, path, key)
 		}
 
 		return nil
 	})
 	if err != nil {
 		return err
 	}
 
 	return nil
 }
 
 // renderPage retrieves the given template and renders it to the given io.Writer.
 // If something goes wrong, the error is logged and returned.
 func renderPage(w io.Writer, tmpl string, data interface{}) error {
 	err := pages[tmpl].ExecuteTemplate(w, "base", data)
 	if err != nil {
 		log.Error("%v", err)
 	}
 	return err
 }
 
 func largeNumFmt(n int64) string {
 	return humanize.Comma(n)
 }
 
 func pluralize(singular, plural string, n int64) string {
 	if n == 1 {
 		return singular
 	}
 	return plural
 }
 
 func isRTL(d string) bool {
 	return d == "rtl"
 }
 
 func isLTR(d string) bool {
 	return d == "ltr" || d == "auto"
 }
 
 func localStr(term, lang string) string {
 	s := l10n.Strings(lang)[term]
 	if s == "" {
 		s = l10n.Strings("")[term]
 	}
 	return s
 }
 
 func localHTML(term, lang string) template.HTML {
 	s := l10n.Strings(lang)[term]
 	if s == "" {
 		s = l10n.Strings("")[term]
 	}
 	s = strings.Replace(s, "write.as", "<a href=\"https://writefreely.org\">writefreely</a>", 1)
 	return template.HTML(s)
 }
 
 // from: https://stackoverflow.com/a/18276968/1549194
 func dict(values ...interface{}) (map[string]interface{}, error) {
 	if len(values)%2 != 0 {
 		return nil, errors.New("dict: invalid number of parameters")
 	}
 	dict := make(map[string]interface{}, len(values)/2)
 	for i := 0; i < len(values); i += 2 {
 		key, ok := values[i].(string)
 		if !ok {
 			return nil, errors.New("dict: keys must be strings")
 		}
 		dict[key] = values[i+1]
 	}
 	return dict, nil
 }
diff --git a/templates/base.tmpl b/templates/base.tmpl
index 4440860..de046a8 100644
--- a/templates/base.tmpl
+++ b/templates/base.tmpl
@@ -1,95 +1,95 @@
 {{define "base"}}<!DOCTYPE HTML>
 <html>
 	<head>
 		{{ template "head" . }}
 		<link rel="stylesheet" type="text/css" href="/css/{{.Theme}}.css" />
 		{{if .CustomCSS}}<link rel="stylesheet" type="text/css" href="/local/custom.css" />{{end}}
 		<link rel="shortcut icon" href="/favicon.ico" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 
 		<meta name="application-name" content="{{.SiteName}}">
 		<meta name="application-url" content="{{.Host}}">
 		<meta property="og:site_name" content="{{.SiteName}}" />
 	</head>
 	<body {{template "body-attrs" .}}>
 		<div id="overlay"></div>
 		<header>
 			{{ if .Chorus }}<nav id="full-nav">
 				<div class="left-side">
 					<h2><a href="/">{{.SiteName}}</a></h2>
 				</div>
 			{{ else }}
 				<h2><a href="/">{{.SiteName}}</a></h2>
 			{{ end }}
 			{{if not .SingleUser}}
 			<nav id="user-nav">
 				{{if .Username}}
 				<nav class="dropdown-nav">
 					<ul><li class="has-submenu"><a>{{.Username}}</a> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /><ul>
-							{{if .IsAdmin}}<li><a href="/admin">Admin dashboard</a></li>{{end}}
+							{{if .IsAdmin}}<li><a href="/admin">Admin dashboard{{if and .UpdateChecks .UpdateAvailable}}<span class="blip">!</span>{{end}}</a></li>{{end}}
 							<li><a href="/me/settings">Account settings</a></li>
 							<li><a href="/me/import">Import posts</a></li>
 							<li><a href="/me/export">Export</a></li>
 							{{if .CanInvite}}<li><a href="/me/invites">Invite people</a></li>{{end}}
 							<li class="separator"><hr /></li>
 							<li><a href="/me/logout">Log out</a></li>
 						</ul></li>
 					</ul>
 				</nav>
 				{{end}}
 				<nav class="tabs">
 					{{ if and .SimpleNav (not .SingleUser) }}
 					{{if and (and .LocalTimeline .CanViewReader) .Chorus}}<a href="/"{{if eq .Path "/"}} class="selected"{{end}}>Home</a>{{end}}
 					{{ end }}
 					{{if or .Chorus (not .Username)}}<a href="/about"{{if eq .Path "/about"}} class="selected"{{end}}>About</a>{{end}}
 					{{ if not .SingleUser }}
 						{{ if .Username }}
 					{{if or (not .Chorus) (gt .MaxBlogs 1)}}<a href="/me/c/"{{if eq .Path "/me/c/"}} class="selected"{{end}}>Blogs</a>{{end}}
 					{{if and (and .Chorus (eq .MaxBlogs 1)) .Username}}<a href="/{{.Username}}/"{{if eq .Path (printf "/%s/" .Username)}} class="selected"{{end}}>My Posts</a>{{end}}
 					{{if not .DisableDrafts}}<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>{{end}}
 						{{ end }}
 					{{if and (and  .LocalTimeline .CanViewReader) (not .Chorus)}}<a href="/read"{{if eq .Path "/read"}} class="selected"{{end}}>Reader</a>{{end}}
 					{{if eq .SignupPath "/signup"}}<a href="/signup"{{if eq .Path "/signup"}} class="selected"{{end}}>Sign up</a>{{end}}
 					{{if and (not .Username) (not .Private)}}<a href="/login"{{if eq .Path "/login"}} class="selected"{{end}}>Log in</a>{{else if .SimpleNav}}<a href="/me/logout">Log out</a>{{end}}
 					{{ end }}
 				</nav>
 				{{if .Chorus}}{{if .Username}}<div class="right-side" style="font-size: 0.86em;">
 							<a class="simple-btn" href="/new">New Post</a>
 						</div>{{end}}
 					</nav>
 				{{end}}
 			</nav>
 			{{end}}
 		</header>
 
 		<div id="official-writing">
 			{{ template "content" . }}
 		</div>
 
 		{{ template "footer" . }}
 		
 		{{if not .JSDisabled}}
 		<script type="text/javascript" src="/js/menu.js"></script>
 		<script type="text/javascript">
 		{{if .WebFonts}}
 		try { // Google Fonts
 		  WebFontConfig = {
 			custom: { families: [ 'Lora:400,700:latin', 'Open+Sans:400,700:latin' ], urls: [ '/css/fonts.css' ] }
 		  };
 		  (function() {
 			var wf = document.createElement('script');
 			wf.src = '/js/webfont.js';
 			wf.type = 'text/javascript';
 			wf.async = 'true';
 			var s = document.getElementsByTagName('script')[0];
 			s.parentNode.insertBefore(wf, s);
 			})();
 		} catch (e) { /* ¯\_(ツ)_/¯ */ }
 		{{end}}
 		</script>
 		{{else}}
 			{{if .WebFonts}}<link href="/css/fonts.css" rel="stylesheet" type="text/css" />{{end}}
 		{{end}}
 	</body>
 </html>{{end}}
 {{define "body-attrs"}}{{end}}
diff --git a/templates/user/collection.tmpl b/templates/user/collection.tmpl
index ed5af8d..40c66e5 100644
--- a/templates/user/collection.tmpl
+++ b/templates/user/collection.tmpl
@@ -1,320 +1,320 @@
 {{define "collection"}}
 {{template "header" .}}
 
 <style>
 textarea.section.norm {
 	font-family: Lora,'Palatino Linotype','Book Antiqua','New York','DejaVu serif',serif !important;
 	min-height: 10em;
 	max-height: 20em;
 	resize: vertical;
 }
 @media (pointer: coarse) {
 	.codable {
 		font-size: 0.75em !important;
 		height: 17em !important;
 	}
 }
 </style>
 
 <div class="content-container snug">
 	<div id="overlay"></div>
 
 	{{if .Silenced}}
 		{{template "user-silenced"}}
 	{{end}}
 
 	{{template "collection-breadcrumbs" .}}
 
 	<h1>Customize</h1>
 
 	{{template "collection-nav" (dict "Alias" .Alias "Path" .Path "SingleUser" .SingleUser)}}
 
 	{{if .Flashes}}<ul class="errors">
 		{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
 	</ul>{{end}}
 
 <form name="customize-form" action="/api/collections/{{.Alias}}" method="post" onsubmit="return disableSubmit()">
 <div id="collection-options">
 	<div style="text-align:center">
 		<h1><input type="text" name="title" id="title" value="{{.DisplayTitle}}" placeholder="Title" maxlength="255" /></h1>
 		<p><input type="text" name="description" id="description" value="{{.Description}}" placeholder="Description" maxlength="160" /></p>
 	</div>
 
 	<div class="option">
 		<h2><a name="preferred-url"></a>URL</h2>
 		<div class="section">
-			{{if eq .Alias .Username}}<p style="font-size: 0.8em">This blog uses your username in its URL{{if .Federation}} and fediverse handle{{end}}. You can change it in your <a href="/me/settings">Account Settings</a>.</p>{{end}}
+			{{if eq .Alias .UserPage.Username}}<p style="font-size: 0.8em">This blog uses your username in its URL{{if .Federation}} and fediverse handle{{end}}. You can change it in your <a href="/me/settings">Account Settings</a>.</p>{{end}}
 			<ul style="list-style:none">
 				<li>
 					{{.FriendlyHost}}/{{if not .SingleUser}}<strong>{{.Alias}}</strong>/{{end}}
 				</li>
 				<li>
 					<strong id="normal-handle-env" class="fedi-handle" {{if not .Federation}}style="display:none"{{end}}>@<span id="fedi-handle">{{.Alias}}</span>@<span id="fedi-domain">{{.FriendlyHost}}</span></strong>
 				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Publicity</h2>
 		<div class="section">
 			<ul style="list-style:none">
 				<li>
 					<label><input type="radio" name="visibility" id="visibility-unlisted" value="0" {{if .IsUnlisted}}checked="checked"{{end}} />
 						Unlisted
 					</label>
 					<p>This blog is visible to {{if .Private}}any registered user on this instance{{else}}anyone with its link{{end}}.</p>
 				</li>
 				<li>
 				<label class="option-text"><input type="radio" name="visibility" id="visibility-private" value="2" {{if .IsPrivate}}checked="checked"{{end}} />
 						Private
 					</label>
 					<p>Only you may read this blog (while you're logged in).</p>
 				</li>
 				<li>
 					<label class="option-text"><input type="radio" name="visibility" id="visibility-protected" value="4" {{if .IsProtected}}checked="checked"{{end}} />
 						Password-protected: <input type="password" class="low-profile" name="password" id="collection-pass" autocomplete="new-password" placeholder="{{if .IsProtected}}xxxxxxxxxxxxxxxx{{else}}a memorable password{{end}}" />
 					</label>
 					<p>A password is required to read this blog.</p>
 				</li>
 				{{if not .SingleUser}}
 				<li>
 					<label class="option-text{{if not .LocalTimeline}} disabled{{end}}"><input type="radio" name="visibility" id="visibility-public" value="1" {{if .IsPublic}}checked="checked"{{end}} {{if not .LocalTimeline}}disabled="disabled"{{end}} />
 						Public
 					</label>
 					{{if .LocalTimeline}}<p>This blog is displayed on the public <a href="/read">reader</a>, and is visible to {{if .Private}}any registered user on this instance{{else}}anyone with its link{{end}}.</p>
 					{{else}}<p>The public reader is currently turned off for this community.</p>{{end}}
 				</li>
 				{{end}}
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2 id="updates">Updates</h2>
 		<div class="section">
 			<p class="explain">Keep readers updated with your latest posts wherever they are.</p>
 			<ul style="list-style:none">
 				<li>
 					<label class="option-text"><input type="checkbox" checked="checked" disabled />
 						RSS feed
 					</label>
 					<p class="describe">Readers can subscribe to your blog's <a href="{{.CanonicalURL}}feed/" target="feed">RSS feed</a> with their favorite RSS reader.</p>
 				</li>
 				{{if .EmailCfg.Enabled}}
 				<li>
 					<label class="option-text" id="email-sub-label"><input type="checkbox" name="email_subs" id="email_subs" {{if .EmailSubsEnabled}}checked="checked"{{end}} />
 						Email subscriptions
 					</label>
 					<p class="describe">
 						Let readers subscribe to your blog via email, and optionally accept private replies.
 					</p>
 					<div id="custom-letter-reply" style="font-size: .8em; margin-top: -0.5em; margin-left: 1.8em; margin-bottom: 1em;" {{if not .EmailSubsEnabled}}style="display:none"{{end}}>
 						Allow replies to this address:
 						<input type="email" name="letter_reply" id="letter_reply" placeholder="me@example.com" value="{{.LetterReplyTo}}" {{if not .EmailSubsEnabled}}disabled{{end}} />
 					</div>
 				</li>
 				{{end}}
                 {{if .Federation}}
 				<li>
 					<label class="option-text" id="federate-label"><input type="checkbox" name="federate" id="federate" {{if .Federation}}checked="checked"{{end}} disabled />
 						Federation
 					</label>
 					<strong id="normal-handle-env" class="fedi-handle">@<span id="fedi-handle">{{.Alias}}</span>@<span id="fedi-domain">{{.FriendlyHost}}</span></strong>
 					<p class="describe">Allow others to follow your blog and interact with your posts in the fediverse. <a href="https://video.writeas.org/videos/watch/cc55e615-d204-417c-9575-7b57674cc6f3" target="video">See how it works</a>.</p>
 				</li>
 				{{end}}
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Display Format</h2>
 		<div class="section">
 			<p class="explain">Customize how your posts display on your page.
 			</p>
 			<ul style="list-style:none">
 				<li>
 					<label><input type="radio" name="format" id="format-blog" value="blog" {{if or (not .Format) (eq .Format "blog")}}checked="checked"{{end}} />
 						Blog
 					</label>
 					<p>Dates are shown. Latest posts listed first.</p>
 				</li>
 				<li>
 					<label class="option-text"><input type="radio" name="format" id="format-novel" value="novel" {{if eq .Format "novel"}}checked="checked"{{end}} />
 						Novel
 					</label>
 					<p>No dates shown. Oldest posts first.</p>
 				</li>
 				<li>
 					<label class="option-text"><input type="radio" name="format" id="format-notebook" value="notebook" {{if eq .Format "notebook"}}checked="checked"{{end}} />
 						Notebook
 					</label>
 					<p>No dates shown. Latest posts first.</p>
 				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Text Rendering</h2>
 		<div class="section">
 			<p class="explain">Customize how plain text renders on your blog.</p>
 			<ul style="list-style:none">
 				<li>
 					<label class="option-text disabled"><input type="checkbox" name="markdown" checked="checked" disabled />
 						Markdown
 					</label>
 				</li>
 				<li>
 					<label><input type="checkbox" name="mathjax" {{if .RenderMathJax}}checked="checked"{{end}} />
 						MathJax
 					</label>
 				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Custom CSS</h2>
 		<div class="section">
 			<textarea id="css-editor" class="section codable" name="style_sheet">{{.StyleSheet}}</textarea>
 			<p class="explain">See our guide on <a href="https://writefreely.org/docs/latest/writer/css">customization</a>.</p>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Post Signature</h2>
 		<div class="section">
 			<p class="explain">This content will be added to the end of every post on this blog, as if it were part of the post itself. Markdown, HTML, and shortcodes are allowed.</p>
 			<textarea id="signature" class="section norm" name="signature">{{.Signature}}</textarea>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Verification</h2>
 		<div class="section">
 			<p class="explain">Verify that you own another site on the open web, fediverse, etc. For example, enter your Mastodon profile address here, then on Mastodon add a link back to this blog &mdash; it will show up as <a href="https://joinmastodon.org/verification" target="mastoverified">verified</a> there.</p>
 			<input type="text" name="verification_link" style="width:100%" value="{{.Verification}}" placeholder="https://writing.exchange/@writefreely" />
 			<p class="explain">This adds a <code>rel="me"</code> code in your blog's <code>&lt;head&gt;</code>.</p>
 		</div>
 	</div>
 
 	{{if .UserPage.StaticPage.AppCfg.Monetization}}
 	<div class="option">
 		<h2>Web Monetization</h2>
 		<div class="section">
 			<p class="explain">Web Monetization enables you to receive micropayments from readers via <a href="https://interledger.org">Interledger</a>. Add your payment pointer to enable Web Monetization on your blog.</p>
 			<input type="text" name="monetization_pointer" style="width:100%" value="{{.Collection.Monetization}}" placeholder="$wallet.example.com/alice" />
 		</div>
 	</div>
 	{{end}}
 
 	<div class="option" style="text-align: center; margin-top: 4em;">
 		<input type="submit" id="save-changes" value="Save changes" />
 		<p><a href="{{if .SingleUser}}/{{else}}/{{.Alias}}/{{end}}">View Blog</a></p>
 		{{if ne .Alias .Username}}<p><a class="danger" href="#modal-delete" onclick="promptDelete();">Delete Blog...</a></p>{{end}}
 	</div>
 </div>
 </form>
 </div>
 
 		<div id="modal-delete" class="modal">
 			<h2>Are you sure you want to delete this blog?</h2>
 			<div class="body short">
 				<p style="text-align:left">This will permanently erase <strong>{{.DisplayTitle}}</strong> ({{.FriendlyHost}}/{{.Alias}}) from the internet. Any posts on this blog will be saved and made into drafts (found on your <a href="/me/posts/">Drafts</a> page).</p>
 				<p>If you're sure you want to delete this blog, enter its name in the box below and press <strong>Delete</strong>.</p>
 
 				<ul id="delete-errors" class="errors"></ul>
 
 				<input id="confirm-text" placeholder="{{.Alias}}" type="text" class="boxy" style="margin-top: 0.5em;" />
 				<div style="text-align:right; margin-top: 1em;">
 					<a id="cancel-delete" style="margin-right:2em" href="#">Cancel</a>
 					<button id="btn-delete" class="danger" onclick="deleteBlog(); return false;">Delete</button>
 				</div>
 			</div>
 		</div>
 
 <script src="/js/h.js"></script>
 <script src="/js/modals.js"></script>
 <script src="/js/ace.js" type="text/javascript" charset="utf-8"></script>
 <script>
 H.getEl('cancel-delete').on('click', closeModals);
 var deleteBlog = function(e) {
 	if (document.getElementById('confirm-text').value != '{{.Alias}}') {
 		document.getElementById('delete-errors').innerHTML = '<li class="urgent">Enter <strong>{{.Alias}}</strong> in the box below.</li>';
 		return;
 	}
 	// Clear errors
 	document.getElementById('delete-errors').innerHTML = '';
 	document.getElementById('btn-delete').innerHTML = 'Deleting...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/collections/{{.Alias}}?web=1";
 	http.open("DELETE", url, true);
 	http.setRequestHeader("Content-type", "application/json");
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			if (http.status == 204) {
 				window.location = '/me/c/';
 			} else {
 				var data = JSON.parse(http.responseText);
 				document.getElementById('delete-errors').innerHTML = '<li class="urgent">'+data.error_msg+'</li>';
 				document.getElementById('btn-delete').innerHTML = 'Delete';
 			}
 		}
 	};
 	http.send(null);
 };
 
 function createHidden(theForm, key, value) {
     var input = document.createElement('input');
     input.type = 'hidden';
     input.name = key;
     input.value = value;
     theForm.appendChild(input);
 }
 function disableSubmit() {
 	var $form = document.forms['customize-form'];
 	createHidden($form, 'style_sheet', cssEditor.getSession().getValue());
 	var $btn = document.getElementById("save-changes");
 	$btn.value = "Saving changes...";
 	$btn.disabled = true;
 	return true;
 }
 function promptDelete() {
 	showModal("delete");
 }
 
 var $fediDomain = document.getElementById('fedi-domain');
 var $fediCustomDomain = document.getElementById('fedi-custom-domain');
 var $customDomain = document.getElementById('domain-alias');
 var $customHandleEnv = document.getElementById('custom-handle-env');
 var $normalHandleEnv = document.getElementById('normal-handle-env');
 
 var $emailSubsCheck = document.getElementById('email_subs');
 var $letterReply = document.getElementById('letter_reply');
 H.getEl('email_subs').on('click', function() {
     let show = $emailSubsCheck.checked
     $letterReply.disabled = !show
 })
 
 if (matchMedia('(pointer:fine)').matches) {
 	// Only initialize Ace editor on devices with a mouse
 	var opt = {
 		showLineNumbers: false,
 		showPrintMargin: 0,
 		minLines: 10,
 		maxLines: 40,
 	};
 	var theme = "ace/theme/chrome";
 	var cssEditor = ace.edit("css-editor");
 	cssEditor.setTheme(theme);
 	cssEditor.session.setMode("ace/mode/css");
 	cssEditor.setOptions(opt);
 	cssEditor.resize(true);
 }
 </script>
 
 {{template "footer" .}}
 {{end}}
diff --git a/templates/user/import.tmpl b/templates/user/import.tmpl
index 547d3dd..53a95d2 100644
--- a/templates/user/import.tmpl
+++ b/templates/user/import.tmpl
@@ -1,64 +1,65 @@
 {{define "import"}}
 {{template "header" .}}
 	<style>
 		input[type=file] {
 			padding: 0;
 			font-size: 0.86em;
 			display: block;
 			margin: 0.5rem 0;
 		}
 		label {
 			display: block;
 			margin: 1em 0;
 		}
 	</style>
 
 <div class="snug content-container">
 	<h1 id="import-header">Import posts</h1>
 	{{if .Message}}
 	<div class="alert {{if .InfoMsg}}info{{else}}success{{end}}">
 		<p>{{.Message}}</p>
 	</div>
 	{{end}}
 	{{if .Flashes}}
 		<ul class="errors">
 			{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
 		</ul>
 	{{end}}
 	<p>Publish plain text or Markdown files to your account by uploading them below.</p>
 	<div class="formContainer">
 		<form id="importPosts" class="prominent" enctype="multipart/form-data" action="/api/me/import" method="POST">
+			{{ .CSRFField }}
 			<label>Select some files to import:
 				<input id="fileInput" class="fileInput" name="files" type="file" multiple accept="text/*"/>
 			</label>
 			<input id="fileDates" name="fileDates" hidden/>
 			<label>
 				Import these posts to:
 				<select name="collection">
 					{{range $i, $el := .Collections}}
 						<option value="{{.Alias}}" {{if eq $i 0}}selected{{end}}>{{.DisplayTitle}}</option>
 					{{end}}
 					<option value="">Drafts</option>
 				</select>
 			</label>
 			<script>
 				// timezone offset in seconds
 				const tzOffsetSec = new Date().getTimezoneOffset() * 60;
 				const fileInput = document.getElementById('fileInput');
 				const fileDates = document.getElementById('fileDates');
 				fileInput.addEventListener('change', (e) => {
 					const files = e.target.files;
 					let dateMap = {};
 					for (let file of files) {
 						// convert from milliseconds to seconds and adjust for tz
 						dateMap[file.name] = Math.round(file.lastModified / 1000) + tzOffsetSec;
 					}
 					fileDates.value = JSON.stringify(dateMap);
 				})
 			</script>
 			<input type="submit" value="Import" />
 		</form>
 	</div>
 </div>
 {{template "footer" .}}
 {{end}}
diff --git a/templates/user/include/header.tmpl b/templates/user/include/header.tmpl
index ff57568..450856b 100644
--- a/templates/user/include/header.tmpl
+++ b/templates/user/include/header.tmpl
@@ -1,117 +1,117 @@
 {{define "user-navigation"}}
 	<header class="{{if .SingleUser}}singleuser{{else}}multiuser{{end}}">
 		<nav id="full-nav">
 		{{if .SingleUser}}
 			<nav id="user-nav">
 				<nav class="dropdown-nav">
 					<ul><li><a href="/" title="View blog" class="title">{{.SiteName}}</a> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" />
 						<ul>
-							{{if .IsAdmin}}<li><a href="/admin">Admin dashboard</a></li>{{end}}
+							{{if .IsAdmin}}<li><a href="/admin">Admin dashboard{{if and .UpdateChecks .UpdateAvailable}}<span class="blip">!</span>{{end}}</a></li>{{end}}
 							<li><a href="/me/settings">Account settings</a></li>
 							<li><a href="/me/import">Import posts</a></li>
 							<li><a href="/me/export">Export</a></li>
 							<li class="separator"><hr /></li>
 							<li><a href="/me/logout">Log out</a></li>
 						</ul></li>
 					</ul>
 				</nav>
 				<nav class="tabs">
 					<a href="/me/c/{{.UserPage.Username}}" {{if and (hasPrefix .Path "/me/c/") (hasSuffix .Path .UserPage.Username)}}class="selected"{{end}}>Customize</a>
 					<a href="/me/c/{{.UserPage.Username}}/stats" {{if hasSuffix .Path "/stats"}}class="selected"{{end}}>Stats</a>
 					<a href="/me/c/{{.UserPage.Username}}/subscribers" {{if hasSuffix .Path "/subscribers"}}class="selected"{{end}}>Subscribers</a>
 					<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>
 				</nav>
 			</nav>
 			<div class="right-side">
 				<a class="simple-btn" href="/me/new">New Post</a>
 			</div>
 		{{else}}
 			<div class="left-side">
 				<h1><a href="/" title="Return to editor">{{.SiteName}}</a></h1>
 			</div>
 			<nav id="user-nav">
-				{{if .Username}}
+				{{if .UserPage.Username}}
 				<nav class="dropdown-nav">
-					<ul><li class="has-submenu"><a>{{.Username}}</a> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /><ul>
-							{{if .IsAdmin}}<li><a href="/admin">Admin dashboard</a></li>{{end}}
+					<ul><li class="has-submenu"><a>{{.UserPage.Username}}</a> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /><ul>
+							{{if .IsAdmin}}<li><a href="/admin">Admin dashboard{{if and .UpdateChecks .UpdateAvailable}}<span class="blip">!</span>{{end}}</a></li>{{end}}
 							<li><a href="/me/settings">Account settings</a></li>
 							<li><a href="/me/import">Import posts</a></li>
 							<li><a href="/me/export">Export</a></li>
 							{{if .CanInvite}}<li><a href="/me/invites">Invite people</a></li>{{end}}
 							<li class="separator"><hr /></li>
 							<li><a href="/me/logout">Log out</a></li>
 						</ul></li>
 					</ul>
 				</nav>
 				{{end}}
 				<nav class="tabs">
 					{{if .SimpleNav}}
 						{{ if not .SingleUser }}
 						{{if and (and .LocalTimeline .CanViewReader) .Chorus}}<a href="/"{{if eq .Path "/"}} class="selected"{{end}}>Home</a>{{end}}
 						{{ end }}
 						<a href="/about">About</a>
 						{{ if not .SingleUser }}
-							{{ if .Username }}
+							{{ if .UserPage.Username }}
 						{{if gt .MaxBlogs 1}}<a href="/me/c/"{{if eq .Path "/me/c/"}} class="selected"{{end}}>Blogs</a>{{end}}
-						{{if and .Chorus (eq .MaxBlogs 1)}}<a href="/{{.Username}}/"{{if eq .Path (printf "/%s/" .Username)}} class="selected"{{end}}>My Posts</a>{{end}}
+						{{if and .Chorus (eq .MaxBlogs 1)}}<a href="/{{.UserPage.Username}}/"{{if eq .Path (printf "/%s/" .UserPage.Username)}} class="selected"{{end}}>My Posts</a>{{end}}
 						{{if not .DisableDrafts}}<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>{{end}}
 							{{ end }}
 						{{if and (and .LocalTimeline .CanViewReader) (not .Chorus)}}<a href="/read">Reader</a>{{end}}
-						{{if and (and (and .Chorus .OpenRegistration) (not .Username)) (or (not .Private) (ne .Landing ""))}}<a href="/signup"{{if eq .Path "/signup"}} class="selected"{{end}}>Sign up</a>{{end}}
-						{{if .Username}}<a href="/me/logout">Log out</a>{{else}}<a href="/login">Log in</a>{{end}}
+						{{if and (and (and .Chorus .OpenRegistration) (not .UserPage.Username)) (or (not .Private) (ne .Landing ""))}}<a href="/signup"{{if eq .Path "/signup"}} class="selected"{{end}}>Sign up</a>{{end}}
+						{{if .UserPage.Username}}<a href="/me/logout">Log out</a>{{else}}<a href="/login">Log in</a>{{end}}
 						{{ end }}
 					{{else}}
 						<a href="/me/c/"{{if eq .Path "/me/c/"}} class="selected"{{end}}>Blogs</a>
 						{{if not .DisableDrafts}}<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>{{end}}
 						{{if and (and .LocalTimeline .CanViewReader) (not .Chorus)}}<a href="/read">Reader</a>{{end}}
 					{{end}}
 				</nav>
 			</nav>
-			{{if .Username}}
+			{{if .UserPage.Username}}
 				<div class="right-side">
 					<a class="simple-btn" href="/{{if .CollAlias}}#{{.CollAlias}}{{end}}">New Post</a>
 				</div>
 			{{end}}
 		{{end}}
 		</nav>
 	</header>
 {{end}}
 {{define "header"}}<!DOCTYPE HTML>
 <html>
 <head>
 	<meta charset="utf-8">
 
 	<title>{{.PageTitle}} {{if .Separator}}{{.Separator}}{{else}}&mdash;{{end}} {{.SiteName}}</title>
 
 	<link rel="stylesheet" type="text/css" href="/css/write.css" />
 	{{if .CustomCSS}}<link rel="stylesheet" type="text/css" href="/local/custom.css" />{{end}}
 	<link rel="shortcut icon" href="/favicon.ico" />
 	<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 	<meta name="theme-color" content="#888888" />
 	<meta name="apple-mobile-web-app-title" content="{{.SiteName}}">
 	<link rel="apple-touch-icon" sizes="152x152" href="/img/touch-icon-152.png">
 	<link rel="apple-touch-icon" sizes="167x167" href="/img/touch-icon-167.png">
 	<link rel="apple-touch-icon" sizes="180x180" href="/img/touch-icon-180.png">
 </head>
 <body id="me">
 	{{template "user-navigation" .}}
 	<div id="official-writing">
 {{end}}
 
 {{define "admin-header"}}
 <header class="admin">
 	<h1>Admin</h1>
 	<nav id="admin" class="pager">
 		<a href="/admin" {{if eq .Path "/admin"}}class="selected"{{end}}>Dashboard</a>
 		<a href="/admin/settings" {{if eq .Path "/admin/settings"}}class="selected"{{end}}>Settings</a>
 		{{if not .SingleUser}}
-		<a href="/admin/users" {{if eq .Path "/admin/users"}}class="selected"{{end}}>Users</a>
-		<a href="/admin/pages" {{if eq .Path "/admin/pages"}}class="selected"{{end}}>Pages</a>
-		{{if .UpdateChecks}}<a href="/admin/updates" {{if eq .Path "/admin/updates"}}class="selected"{{end}}>Updates{{if .UpdateAvailable}}<span class="blip">!</span>{{end}}</a>{{end}}
-		{{end}}
-		{{if not .Forest}}
-		<a href="/admin/monitor" {{if eq .Path "/admin/monitor"}}class="selected"{{end}}>Monitor</a>
+			<a href="/admin/users" {{if eq .Path "/admin/users"}}class="selected"{{end}}>Users</a>
+			<a href="/admin/pages" {{if eq .Path "/admin/pages"}}class="selected"{{end}}>Pages</a>
 		{{end}}
+		{{if .UpdateChecks}}<a href="/admin/updates" {{if eq .Path "/admin/updates"}}class="selected"{{end}}>Updates{{if .UpdateAvailable}}<span class="blip">!</span>{{end}}</a>{{end}}
+		{{if not .Forest -}}
+			<a href="/admin/monitor" {{if eq .Path "/admin/monitor"}}class="selected"{{end}}>Monitor</a>
+		{{- end}}
 	</nav>
 </header>
 {{end}}
diff --git a/templates/user/invite.tmpl b/templates/user/invite.tmpl
index ea22f22..fae19f6 100644
--- a/templates/user/invite.tmpl
+++ b/templates/user/invite.tmpl
@@ -1,84 +1,85 @@
 {{define "invite"}}
 {{template "header" .}}
 <style>
 .half {
 	margin-right: 0.5em;
 }
 .half + .half {
 	margin-left: 0.5em;
 	margin-right: 0;
 }
 table.classy {
 	width: 100%;
 }
 table.classy.export a {
 	text-transform: initial;
 }
 table td {
 	font-size: 0.86em;
 }
 </style>
 
 <div class="snug content-container">
 	{{if .Silenced}}
 		{{template "user-silenced"}}
 	{{end}}
 	<h1>Invite people</h1>
 	<p>Invite others to join <em>{{.SiteName}}</em> by generating and sharing invite links below.</p>
 
 	<form style="margin: 2em 0" class="prominent" action="/api/me/invites" method="post">
+		{{ .CSRFField }}
 		<div class="row">
 			<div class="half">
 				<label for="uses">Maximum number of uses:</label>
 				<select id="uses" name="uses" {{if .Silenced}}disabled{{end}}>
 					<option value="0">No limit</option>
 					<option value="1">1 use</option>
 					<option value="5">5 uses</option>
 					<option value="10">10 uses</option>
 					<option value="25">25 uses</option>
 					<option value="50">50 uses</option>
 					<option value="100">100 uses</option>
 				</select>
 			</div>
 			<div class="half">
 				<label for="expires">Expire after:</label>
 				<select id="expires" name="expires" {{if .Silenced}}disabled{{end}}>
 					<option value="0">Never</option>
 					<option value="30">30 minutes</option>
 					<option value="60">1 hour</option>
 					<option value="360">6 hours</option>
 					<option value="720">12 hours</option>
 					<option value="1440">1 day</option>
 					<option value="4320">3 days</option>
 					<option value="10080">1 week</option>
 				</select>
 			</div>
 		</div>
 		<div class="row">
 			<input type="submit" value="Generate" {{if .Silenced}}disabled title="You cannot generate invites while your account is silenced."{{end}} />
 		</div>
 	</form>
 
 	<table class="classy export">
 		<tr>
 			<th>Link</th>
 			<th>Uses</th>
 			<th>Expires</th>
 		</tr>
 		{{range .Invites}}
 		<tr>
 			<td><a href="{{$.Host}}/invite/{{.ID}}">{{$.Host}}/invite/{{.ID}}</a></td>
 			<td>{{.Uses}}{{if gt .MaxUses.Int64 0}} / {{.MaxUses.Int64}}{{end}}</td>
 			<td>{{ if .Expires }}{{if .Expired}}Expired{{else}}{{.ExpiresFriendly}}{{end}}{{ else }}&infin;{{ end }}</td>
 		</tr>
 		{{else}}
 		<tr>
 			<td colspan="3">No invites generated yet.</td>
 		</tr>
 		{{end}}
 	</table>
 
 </div>
 
 {{template "footer" .}}
 {{end}}
diff --git a/templates/user/settings.tmpl b/templates/user/settings.tmpl
index fbec62c..4796b31 100644
--- a/templates/user/settings.tmpl
+++ b/templates/user/settings.tmpl
@@ -1,231 +1,234 @@
 {{define "settings"}}
 {{template "header" .}}
 
 <style type="text/css">
 .option { margin: 2em 0em; }
 h2 {
 	margin-top: 2.5em;
 }
 h3 { font-weight: normal; }
 .section p, .section label {
 	font-size: 0.86em;
 }
 .oauth-provider img {
 	max-height: 2.75em;
 	vertical-align: middle;
 }
 .modal {
 	position: fixed;
 }
 </style>
 <div class="content-container snug">
 	<div id="overlay"></div>
 
 	{{if .Silenced}}
 		{{template "user-silenced"}}
 	{{end}}
 	<h1>{{if .IsLogOut}}Before you go...{{else}}Account Settings{{end}}</h1>
 	{{if .Flashes}}<ul class="errors">
 		{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
 	</ul>{{end}}
 
 	{{ if .IsLogOut }}
 	<div class="alert info">
 		<p class="introduction">Please add an <strong>email address</strong> and/or <strong>passphrase</strong> so you can log in again later.</p>
 	</div>
 	{{ else }}
 	<div>
 		<p>Change your account settings here.</p>
 	</div>
 
 	<form method="post" action="/api/me/self" autocomplete="false">
+		{{ .CSRFField }}
 		<div class="option">
 			<h3>Username</h3>
 			<div class="section">
 				<input type="text" name="username" value="{{.Username}}" tabindex="1" />
 				<input type="submit" value="Update" style="margin-left: 1em;" />
 			</div>
 		</div>
 	</form>
 	{{ end }}
 
 	{{if not .DisablePasswordAuth}}
 	<form method="post" action="/api/me/self" autocomplete="false">
+		{{ .CSRFField }}
 		<input type="hidden" name="logout" value="{{.IsLogOut}}" />
 		<div class="option">
 			<h3>Passphrase</h3>
 			<div class="section">
 				{{if and (not .HasPass) (not .IsLogOut)}}<div class="alert info"><p>Add a passphrase to easily log into your account.</p></div>{{end}}
 				{{if .HasPass}}<p>Current passphrase</p>
 				<input type="password" name="current-pass" maxlength="72" placeholder="Current passphrase" tabindex="1" /> <input class="show" type="checkbox" id="show-cur-pass" /><label for="show-cur-pass"> Show</label>
 				<p>New passphrase</p>
 				{{end}}
 				{{if .IsLogOut}}<input type="text" value="{{.Username}}" style="display:none" />{{end}}
 				<input type="password" name="new-pass" maxlength="72" autocomplete="new-password" placeholder="New passphrase" tabindex="{{if .IsLogOut}}1{{else}}2{{end}}" /> <input class="show" type="checkbox" id="show-new-pass" /><label for="show-new-pass"> Show</label>
 			</div>
 		</div>
 
 		<div class="option">
 			<h3>Email</h3>
 			<div class="section">
 				{{if and (not .Email) (not .IsLogOut)}}<div class="alert info"><p>Add your email to get:</p>
 				<ul>
 					<li>No-passphrase login</li>
 					<li>Account recovery if you forget your passphrase</li>
 				</ul></div>{{end}}
 				<input type="email" name="email" style="letter-spacing: 1px" placeholder="Email address" value="{{.Email}}" size="40" tabindex="{{if .IsLogOut}}2{{else}}3{{end}}" />
 			</div>
 		</div>
 
 		<div class="option" style="text-align: center;">
 			<input type="submit" value="Save changes" tabindex="4" />
 		</div>
 	</form>
 	{{end}}
 
 	{{ if .OauthSection }}
 		{{ if .OauthAccounts }}
 		<div class="option">
 			<h2>Linked Accounts</h2>
 			<p>These are your linked external accounts.</p>
 			{{ range $oauth_account := .OauthAccounts }}
 				<form method="post" action="/api/me/oauth/remove" autocomplete="false">
+					{{ $.CSRFField }}
 					<input type="hidden" name="provider" value="{{ $oauth_account.Provider }}" />
 					<input type="hidden" name="client_id" value="{{ $oauth_account.ClientID }}" />
 					<input type="hidden" name="remote_user_id" value="{{ $oauth_account.RemoteUserID }}" />
 					<div class="section oauth-provider">
 						{{ if $oauth_account.DisplayName}}
 							{{ if $oauth_account.AllowDisconnect}}
 							<input type="submit" value="Remove {{.DisplayName}}" />
 							{{else}}
 							<a class="btn cta"><strong>{{.DisplayName}}</strong></a>
 							{{end}}
 						{{else}}
 							<img src="/img/mark/{{$oauth_account.Provider}}.png" alt="{{ $oauth_account.Provider | title }}" />
 							<input type="submit" value="Remove {{ $oauth_account.Provider | title }}" />
 						{{end}}
 					</div>
 				</form>
 			{{ end }}
 		</div>
 		{{ end }}
 		{{ if or .OauthSlack .OauthWriteAs .OauthGitLab .OauthGeneric .OauthGitea }}
 		<div class="option">
 			<h2>Link External Accounts</h2>
 			<p>Connect additional accounts to enable logging in with those providers, instead of using your username and password.</p>
 			<div class="row signinbtns">
 			{{ if .OauthWriteAs }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="writeas-login" href="/oauth/write.as?attach=t">
 						<img src="/img/mark/writeas-white.png" alt="Write.as" />
 						Link <strong>Write.as</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthSlack }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="slack-login" href="/oauth/slack?attach=t">
 						<img src="/img/mark/slack.png" alt="Slack" />
 						Link <strong>Slack</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthGitLab }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="gitlab-login" href="/oauth/gitlab?attach=t">
 						<img src="/img/mark/gitlab.png" alt="GitLab" />
 						Link <strong>{{.GitLabDisplayName}}</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthGitea }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="gitea-login" href="/oauth/gitea?attach=t">
 						<img src="/img/mark/gitea.png" alt="Gitea" />
 						Link <strong>{{.GiteaDisplayName}}</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthGeneric }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="generic-oauth-login" href="/oauth/generic?attach=t">
 						Link <strong>{{ .OauthGenericDisplayName }}</strong>
 					</a>
 				</div>
 			{{ end }}
 			</div>
 		</div>
 		{{ end }}
 	{{ end }}
 
 	{{ if and .OpenDeletion (not .IsAdmin) }}
 		<h2>Incinerator</h2>
 		<div class="alert danger">
 			<div class="row">
 				<div>
 					<h3>Delete your account</h3>
 					<p>Permanently erase all your data, with no way to recover it.</p>
 				</div>
 				<button class="cta danger" onclick="prepareDeleteUser()">Delete your account...</button>
 			</div>
 		</div>
 	{{end}}
 </div>
 
 <div id="modal-delete-user" class="modal">
 	<h2>Are you sure?</h2>
 	<div class="body">
 		<p style="text-align:left">This action <strong>cannot</strong> be undone. It will immediately and permanently erase your account, including your blogs and posts. Before continuing, you might want to <a href="/me/export">export your data</a>.</p>
 		<p>If you're sure, please type <strong>{{.Username}}</strong> to confirm.</p>
 
 		<ul id="delete-errors" class="errors"></ul>
 
 		<form action="/me/delete" method="post" onsubmit="confirmDeletion()">
 			{{ .CSRFField }}
 			<input id="confirm-text" placeholder="{{.Username}}" type="text" class="confirm boxy" name="confirm-username" style="margin-top: 0.5em;" />
 			<div style="text-align:right; margin-top: 1em;">
 				<a id="cancel-delete" style="margin-right:2em" href="#">Cancel</a>
 				<input class="danger" type="submit" id="confirm-delete" value="Delete your account" disabled />
 			</div>
 	</div>
 </div>
 
 <script src="/js/h.js"></script>
 <script src="/js/modals.js"></script>
 <script>
 var showChecks = document.querySelectorAll('input.show');
 for (var i=0; i<showChecks.length; i++) {
 	showChecks[i].addEventListener('click', function() {
 		var prevEl = this.previousElementSibling;
 		if (prevEl.type == "password") {
 			prevEl.type = "text";
 		} else {
 			prevEl.type = "password";
 		}
 	});
 }
 
 {{ if and .OpenDeletion (not .IsAdmin) }}
 	H.getEl('cancel-delete').on('click', closeModals);
 
 	let $confirmDelBtn = document.getElementById('confirm-delete');
 	let $confirmText = document.getElementById('confirm-text')
 	$confirmText.addEventListener('input', function() {
 		$confirmDelBtn.disabled = this.value !== '{{.Username}}'
 	});
 
 	function prepareDeleteUser() {
 		$confirmText.value = ''
 		showModal('delete-user')
 		$confirmText.focus()
 	}
 
 	function confirmDeletion() {
 		$confirmDelBtn.disabled = true
 		$confirmDelBtn.value = 'Deleting...'
 	}
 {{ end }}
 </script>
 
 {{template "footer" .}}
 {{end}}
diff --git a/unregisteredusers.go b/unregisteredusers.go
index 9473c89..c7690bd 100644
--- a/unregisteredusers.go
+++ b/unregisteredusers.go
@@ -1,148 +1,170 @@
 /*
  * Copyright © 2018-2019 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"net/http"
 
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
 )
 
+// canRegister reports whether a new account may be created given the instance's registration setting and the given
+// invite code. When registration is open, anyone may sign up. When it's closed, a valid, still-active invite code is
+// required -- otherwise any non-empty value (or none at all) would be enough to create an account. This is the single
+// gate every signup path (web, API, and OAuth) must pass through so the checks can't be side-stepped by hitting a
+// different endpoint.
+func (app *App) canRegister(inviteCode string) error {
+	if app.cfg.App.OpenRegistration {
+		return nil
+	}
+	i, err := app.db.GetUserInvite(inviteCode)
+	if err != nil {
+		return impart.HTTPError{http.StatusForbidden, "Registration is closed"}
+	}
+	if !i.Active(app.db) {
+		return impart.HTTPError{http.StatusNotFound, "Invite link has expired."}
+	}
+	return nil
+}
+
 func handleWebSignup(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 
 	// Get params
 	var ur userRegistration
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&ur)
 		if err != nil {
 			log.Error("Couldn't parse signup JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse signup form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&ur, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode signup form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
+	if err := app.canRegister(ur.InviteCode); err != nil {
+		return err
+	}
 	ur.Web = true
 	ur.Normalize = true
 
 	to := "/"
 	if app.cfg.App.SimpleNav {
 		to = "/new"
 	}
 	if ur.InviteCode != "" {
 		to = "/invite/" + ur.InviteCode
 	}
 	_, err := signupWithRegistration(app, ur, w, r)
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			session, _ := app.sessionStore.Get(r, cookieName)
 			if session != nil {
 				session.AddFlash(err.Message)
 				session.Save(r, w)
 				return impart.HTTPError{http.StatusFound, to}
 			}
 		}
 		return err
 	}
 	return impart.HTTPError{http.StatusFound, to}
 }
 
 // { "username": "asdf" }
 // result: { code: 204 }
 func handleUsernameCheck(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 
 	// Get params
 	var d struct {
 		Username string `json:"username"`
 	}
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&d)
 		if err != nil {
 			log.Error("Couldn't decode username check: %v\n", err)
 			return ErrBadFormData
 		}
 	} else {
 		return impart.HTTPError{http.StatusNotAcceptable, "Must be JSON request"}
 	}
 
 	// Check if username is okay
 	finalUsername := getSlug(d.Username, "")
 	if finalUsername == "" {
 		errMsg := "Invalid username"
 		if d.Username != "" {
 			// Username was provided, but didn't convert into valid latin characters
 			errMsg += " - must have at least 2 letters or numbers"
 		}
 		return impart.HTTPError{http.StatusBadRequest, errMsg + "."}
 	}
 	if app.db.PostIDExists(finalUsername) {
 		return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 	}
 	var un string
 	err := app.db.QueryRow("SELECT username FROM users WHERE username = ?", finalUsername).Scan(&un)
 	switch {
 	case err == sql.ErrNoRows:
 		return impart.WriteSuccess(w, finalUsername, http.StatusOK)
 	case err != nil:
 		log.Error("Couldn't SELECT username: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, "We messed up."}
 	}
 
 	// Username was found, so it's taken
 	return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 }
 
 func getValidUsername(app *App, reqName, prevName string) (string, *impart.HTTPError) {
 	// Check if username is okay
 	finalUsername := getSlug(reqName, "")
 	if finalUsername == "" {
 		errMsg := "Invalid username"
 		if reqName != "" {
 			// Username was provided, but didn't convert into valid latin characters
 			errMsg += " - must have at least 2 letters or numbers"
 		}
 		return "", &impart.HTTPError{http.StatusBadRequest, errMsg + "."}
 	}
 	if finalUsername == prevName {
 		return "", &impart.HTTPError{http.StatusNotModified, "Username unchanged."}
 	}
 	if app.db.PostIDExists(finalUsername) {
 		return "", &impart.HTTPError{http.StatusConflict, "Username is already taken."}
 	}
 	var un string
 	err := app.db.QueryRow("SELECT username FROM users WHERE username = ?", finalUsername).Scan(&un)
 	switch {
 	case err == sql.ErrNoRows:
 		return finalUsername, nil
 	case err != nil:
 		log.Error("Couldn't SELECT username: %v", err)
 		return "", &impart.HTTPError{http.StatusInternalServerError, "We messed up."}
 	}
 
 	// Username was found, so it's taken
 	return "", &impart.HTTPError{http.StatusConflict, "Username is already taken."}
 }
diff --git a/users.go b/users.go
index 449427d..b111212 100644
--- a/users.go
+++ b/users.go
@@ -1,140 +1,158 @@
 /*
  * Copyright © 2018-2019, 2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"time"
 
 	"github.com/guregu/null/zero"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/key"
 )
 
 type UserStatus int
 
 const (
 	UserActive = iota
 	UserSilenced
 )
 
 type (
 	userCredentials struct {
 		Alias string `json:"alias" schema:"alias"`
 		Pass  string `json:"pass" schema:"pass"`
 		Email string `json:"email" schema:"email"`
 		Web   bool   `json:"web" schema:"-"`
 		To    string `json:"-" schema:"to"`
 
 		EmailLogin bool `json:"via_email" schema:"via_email"`
 	}
 
 	userRegistration struct {
 		userCredentials
 		InviteCode string `json:"invite_code" schema:"invite_code"`
 		Honeypot   string `json:"fullname" schema:"fullname"`
 		Normalize  bool   `json:"normalize" schema:"normalize"`
 		Signup     bool   `json:"signup" schema:"signup"`
 
 		// Feature fields
 		Description  string `json:"description" schema:"description"`
 		Monetization string `json:"monetization" schema:"monetization"`
 	}
 
 	// AuthUser contains information for a newly authenticated user (either
 	// from signing up or logging in).
 	AuthUser struct {
 		AccessToken string `json:"access_token,omitempty"`
 		Password    string `json:"password,omitempty"`
 		User        *User  `json:"user"`
 
 		// Verbose user data
 		Posts       *[]PublicPost `json:"posts,omitempty"`
 		Collections *[]Collection `json:"collections,omitempty"`
 	}
 
 	// User is a consistent user object in the database and all contexts (auth
 	// and non-auth) in the API.
 	User struct {
 		ID         int64       `json:"-"`
 		Username   string      `json:"username"`
 		HashedPass []byte      `json:"-"`
 		HasPass    bool        `json:"has_pass"`
 		Email      zero.String `json:"email"`
 		Created    time.Time   `json:"created"`
 		Status     UserStatus  `json:"status"`
 
 		clearEmail string `json:"email"`
 	}
 
 	userMeStats struct {
 		TotalCollections, TotalArticles, CollectionPosts uint64
 	}
 
 	ExportUser struct {
 		*User
 		Collections    *[]CollectionObj `json:"collections"`
 		AnonymousPosts []PublicPost     `json:"posts"`
 	}
 
 	PublicUser struct {
 		Username string `json:"username"`
 	}
+
+	// UserFilter describes the criteria for selecting users in bulk
+	// moderation actions (see ModerateUsers). A zero value matches all
+	// non-admin users.
+	UserFilter struct {
+		Since, Until  *time.Time // account creation window
+		NoInvite      bool       // only users who signed up without an invite
+		NoOAuth       bool       // only users who didn't register via OAuth
+		MaxPosts      int        // only users with at most this many posts; -1 = no limit
+		IncludeAdmins bool       // include admins in results (listing only; never for silence/delete)
+	}
+
+	// FilteredUser pairs a matched user with their post count, for display
+	// and the --max-posts filter.
+	FilteredUser struct {
+		*User
+		PostCount int64
+	}
 )
 
 // EmailClear decrypts and returns the user's email, caching it in the user
 // object.
 func (u *User) EmailClear(keys *key.Keychain) string {
 	if u.clearEmail != "" {
 		return u.clearEmail
 	}
 
 	if u.Email.Valid && u.Email.String != "" {
 		email, err := data.Decrypt(keys.EmailKey, []byte(u.Email.String))
 		if err != nil {
 			log.Error("Error decrypting user email: %v", err)
 		} else {
 			u.clearEmail = string(email)
 			return u.clearEmail
 		}
 	}
 	return ""
 }
 
 func (u User) CreatedFriendly() string {
 	/*
 		// TODO: accept a locale in this method and use that for the format
 		var loc monday.Locale = monday.LocaleEnUS
 		return monday.Format(u.Created, monday.DateTimeFormatsByLocale[loc], loc)
 	*/
 	return u.Created.Format("January 2, 2006, 3:04 PM")
 }
 
 // Cookie strips down an AuthUser to contain only information necessary for
 // cookies.
 func (u User) Cookie() *User {
 	u.HashedPass = []byte{}
 
 	return &u
 }
 
 func (u *User) IsAdmin() bool {
 	// TODO: get this from database
 	return u.ID == 1
 }
 
 func (u *User) IsSilenced() bool {
 	return u.Status&UserSilenced != 0
 }
 
 func (u *User) IsEmailSubscriber(app *App, collID int64) bool {
 	return app.db.IsEmailSubscriber("", u.ID, collID)
 }
diff --git a/webfinger.go b/webfinger.go
index 0c52f72..a5bc577 100644
--- a/webfinger.go
+++ b/webfinger.go
@@ -1,145 +1,279 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/writeas/go-webfinger"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/config"
 )
 
 type wfResolver struct {
 	db  *datastore
 	cfg *config.Config
 }
 
 var wfUserNotFoundErr = impart.HTTPError{http.StatusNotFound, "User not found."}
 
 func (wfr wfResolver) FindUser(username string, host, requestHost string, r []webfinger.Rel) (*webfinger.Resource, error) {
 	var c *Collection
 	var err error
 	if username == host {
 		c = instanceColl
 	} else if wfr.cfg.App.SingleUser {
 		c, err = wfr.db.GetCollectionByID(1)
 	} else {
 		c, err = wfr.db.GetCollection(username)
 	}
 	if err != nil {
 		log.Error("Unable to get blog: %v", err)
 		return nil, err
 	}
 	c.hostName = wfr.cfg.App.Host
 
 	if !c.IsInstanceColl() {
 		silenced, err := wfr.db.IsUserSilenced(c.OwnerID)
 		if err != nil {
 			log.Error("webfinger find user: check is silenced: %v", err)
 			return nil, err
 		}
 		if silenced {
 			return nil, wfUserNotFoundErr
 		}
 	}
 	if wfr.cfg.App.SingleUser {
 		// Ensure handle matches user-chosen one on single-user blogs
 		if username != c.Alias {
 			log.Info("Username '%s' is not handle '%s'", username, c.Alias)
 			return nil, wfUserNotFoundErr
 		}
 	}
 	// Only return information if site has federation enabled.
 	// TODO: enable two levels of federation? Unlisted or Public on timelines?
 	if !wfr.cfg.App.Federation {
 		return nil, wfUserNotFoundErr
 	}
 
 	res := webfinger.Resource{
 		Subject: "acct:" + username + "@" + host,
 		Aliases: []string{
 			c.CanonicalURL(),
 			c.FederatedAccount(),
 		},
 		Links: []webfinger.Link{
 			{
 				HRef: c.CanonicalURL(),
 				Type: "text/html",
 				Rel:  "https://webfinger.net/rel/profile-page",
 			},
 			{
 				HRef: c.FederatedAccount(),
 				Type: "application/activity+json",
 				Rel:  "self",
 			},
 		},
 	}
 	return &res, nil
 }
 
 func (wfr wfResolver) DummyUser(username string, hostname string, r []webfinger.Rel) (*webfinger.Resource, error) {
 	return nil, wfUserNotFoundErr
 }
 
 func (wfr wfResolver) IsNotFoundError(err error) bool {
 	return err == wfUserNotFoundErr
 }
 
+// errBlockedRemoteAddr is returned when a webfinger lookup would connect to
+// a private, loopback, link-local, or otherwise disallowed address.
+var errBlockedRemoteAddr = errors.New("refusing to connect to a private or internal address")
+
+// safeWebfingerHTTPClient is a hardened HTTP client for fetching remote
+// webfinger documents. It validates the resolved IP address of every
+// connection (including redirects) at dial time, so DNS rebinding can't be
+// used to bypass the check.
+var safeWebfingerHTTPClient = &http.Client{
+	Timeout: 10 * time.Second,
+	Transport: &http.Transport{
+		DialContext: safeDialContext,
+	},
+	CheckRedirect: func(req *http.Request, via []*http.Request) error {
+		if len(via) >= 5 {
+			return errors.New("too many redirects")
+		}
+		if req.URL.Scheme != "https" {
+			return fmt.Errorf("refusing to follow redirect to non-https scheme %q", req.URL.Scheme)
+		}
+		return nil
+	},
+}
+
+func safeDialContext(ctx context.Context, network, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+	ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, err
+	}
+	var lastErr error
+	for _, ip := range ips {
+		if !isPublicAddr(ip.IP) {
+			lastErr = fmt.Errorf("%w: %s", errBlockedRemoteAddr, ip.IP)
+			continue
+		}
+		var d net.Dialer
+		conn, err := d.DialContext(ctx, network, net.JoinHostPort(ip.IP.String(), port))
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return conn, nil
+	}
+	if lastErr == nil {
+		lastErr = fmt.Errorf("no addresses found for %s", host)
+	}
+	return nil, lastErr
+}
+
+// isPublicAddr reports whether ip is safe to connect to, i.e. not a
+// loopback, private, link-local, multicast, or otherwise special-purpose
+// address that could be used to reach internal services or cloud metadata
+// endpoints via SSRF.
+func isPublicAddr(ip net.IP) bool {
+	if ip == nil {
+		return false
+	}
+	if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() || ip.IsInterfaceLocalMulticast() ||
+		ip.IsMulticast() || ip.IsUnspecified() {
+		return false
+	}
+	if ip4 := ip.To4(); ip4 != nil {
+		// 100.64.0.0/10 (Carrier-Grade NAT) and 169.254.169.254-style
+		// cloud metadata addresses are covered by IsLinkLocalUnicast above,
+		// but explicitly block the CGNAT range too.
+		if ip4[0] == 100 && ip4[1]&0xc0 == 64 {
+			return false
+		}
+	}
+	// Extract any embedded IPv4 and re-run the same checks against it. The
+	// recursion terminates because embeddedIPv4 only returns a To4() address,
+	// for which it then returns nil.
+	if embedded := embeddedIPv4(ip); embedded != nil {
+		if !isPublicAddr(embedded) {
+			return false
+		}
+	}
+	return true
+}
+
+// embeddedIPv4 returns the IPv4 address encoded inside an IPv6 transition
+// address (6to4, NAT64, Teredo, or the deprecated IPv4-compatible format), or
+// nil if ip embeds none.
+func embeddedIPv4(ip net.IP) net.IP {
+	// Already an IPv4 address: nothing embedded to extract.
+	if ip.To4() != nil {
+		return nil
+	}
+	ip16 := ip.To16()
+	if ip16 == nil {
+		return nil
+	}
+	switch {
+	case ip16[0] == 0x20 && ip16[1] == 0x02:
+		// 6to4: 2002:AABB:CCDD::/16 -> A.B.C.D
+		return net.IPv4(ip16[2], ip16[3], ip16[4], ip16[5]).To4()
+	case ip16[0] == 0x20 && ip16[1] == 0x01 && ip16[2] == 0x00 && ip16[3] == 0x00:
+		// Teredo: 2001:0000::/32. The client IPv4 is the last 32 bits, stored
+		// bitwise-inverted.
+		return net.IPv4(^ip16[12], ^ip16[13], ^ip16[14], ^ip16[15]).To4()
+	case ip16[0] == 0x00 && ip16[1] == 0x64 && ip16[2] == 0xff && ip16[3] == 0x9b:
+		// NAT64 well-known prefix 64:ff9b::/96 and local prefix
+		// 64:ff9b:1::/48. Both carry the embedded IPv4 in the last 32 bits.
+		return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15]).To4()
+	}
+	// IPv4-compatible IPv6 (deprecated): ::/96, e.g. ::127.0.0.1 == ::7f00:1.
+	// The first 12 bytes are zero. Loopback (::1) and unspecified (::) are
+	// already rejected by the callers before extraction, so treating them as
+	// embedding 0.0.0.1 / 0.0.0.0 here is harmless.
+	for _, b := range ip16[:12] {
+		if b != 0 {
+			return nil
+		}
+	}
+	return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15]).To4()
+}
+
 // RemoteLookup looks up a user by handle at a remote server
 // and returns the actor URL
 func RemoteLookup(handle string) string {
 	handle = strings.TrimLeft(handle, "@")
 	// let's take the server part of the handle
 	parts := strings.Split(handle, "@")
-	resp, err := http.Get("https://" + parts[1] + "/.well-known/webfinger?resource=acct:" + handle)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		log.Error("Invalid webfinger handle: %s", handle)
+		return ""
+	}
+	domain := parts[1]
+
+	resp, err := safeWebfingerHTTPClient.Get("https://" + domain + "/.well-known/webfinger?resource=acct:" + handle)
 	if err != nil {
 		log.Error("Error on webfinger request: %v", err)
 		return ""
 	}
+	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		log.Error("Error on webfinger response: %v", err)
 		return ""
 	}
 
 	var result webfinger.Resource
 	err = json.Unmarshal(body, &result)
 	if err != nil {
 		log.Error("Unable to parse webfinger response: %v", err)
 		return ""
 	}
 
 	var href string
 	// iterate over webfinger links and find the one with
 	// a self "rel"
 	for _, link := range result.Links {
 		if link.Rel == "self" {
 			href = link.HRef
 		}
 	}
 
 	// if we didn't find it with the above then
 	// try using aliases
 	if href == "" {
 		// take the last alias because mastodon has the
 		// https://instance.tld/@user first which
 		// doesn't work as an href
 		href = result.Aliases[len(result.Aliases)-1]
 	}
 
 	return href
 }