diff --git a/collections.go b/collections.go
index ea5b929..da803e1 100644
--- a/collections.go
+++ b/collections.go
@@ -1,1047 +1,1052 @@
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"math"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strconv"
 	"strings"
 	"unicode"
 
 	"github.com/gorilla/mux"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/bots"
 	"github.com/writeas/web-core/log"
 	waposts "github.com/writeas/web-core/posts"
 	"github.com/writeas/writefreely/author"
 	"github.com/writeas/writefreely/page"
 )
 
 type (
 	// TODO: add Direction to db
 	// TODO: add Language to db
 	Collection struct {
 		ID          int64          `datastore:"id" json:"-"`
 		Alias       string         `datastore:"alias" schema:"alias" json:"alias"`
 		Title       string         `datastore:"title" schema:"title" json:"title"`
 		Description string         `datastore:"description" schema:"description" json:"description"`
 		Direction   string         `schema:"dir" json:"dir,omitempty"`
 		Language    string         `schema:"lang" json:"lang,omitempty"`
 		StyleSheet  string         `datastore:"style_sheet" schema:"style_sheet" json:"style_sheet"`
 		Script      string         `datastore:"script" schema:"script" json:"script,omitempty"`
 		Public      bool           `datastore:"public" json:"public"`
 		Visibility  collVisibility `datastore:"private" json:"-"`
 		Format      string         `datastore:"format" json:"format,omitempty"`
 		Views       int64          `json:"views"`
 		OwnerID     int64          `datastore:"owner_id" json:"-"`
 		PublicOwner bool           `datastore:"public_owner" json:"-"`
 		URL         string         `json:"url,omitempty"`
 
 		db *datastore
 	}
 	CollectionObj struct {
 		Collection
 		TotalPosts int           `json:"total_posts"`
 		Owner      *User         `json:"owner,omitempty"`
 		Posts      *[]PublicPost `json:"posts,omitempty"`
 	}
 	DisplayCollection struct {
 		*CollectionObj
 		Prefix      string
 		IsTopLevel  bool
 		CurrentPage int
 		TotalPages  int
 		Format      *CollectionFormat
 	}
 	SubmittedCollection struct {
 		// Data used for updating a given collection
 		ID      int64
 		OwnerID uint64
 
 		// Form helpers
 		PreferURL string `schema:"prefer_url" json:"prefer_url"`
 		Privacy   int    `schema:"privacy" json:"privacy"`
 		Pass      string `schema:"password" json:"password"`
 		MathJax   bool   `schema:"mathjax" json:"mathjax"`
+		Highlight bool   `schema:"highlight" json:"highlight"`
 		Handle    string `schema:"handle" json:"handle"`
 
 		// Actual collection values updated in the DB
 		Alias       *string         `schema:"alias" json:"alias"`
 		Title       *string         `schema:"title" json:"title"`
 		Description *string         `schema:"description" json:"description"`
 		StyleSheet  *sql.NullString `schema:"style_sheet" json:"style_sheet"`
 		Script      *sql.NullString `schema:"script" json:"script"`
 		Visibility  *int            `schema:"visibility" json:"public"`
 		Format      *sql.NullString `schema:"format" json:"format"`
 	}
 	CollectionFormat struct {
 		Format string
 	}
 
 	collectionReq struct {
 		// Information about the collection request itself
 		prefix, alias, domain string
 		isCustomDomain        bool
 
 		// User-related fields
 		isCollOwner bool
 	}
 )
 
 func (sc *SubmittedCollection) FediverseHandle() string {
 	if sc.Handle == "" {
 		return apCustomHandleDefault
 	}
 	return getSlug(sc.Handle, "")
 }
 
 // collVisibility represents the visibility level for the collection.
 type collVisibility int
 
 // Visibility levels. Values are bitmasks, stored in the database as
 // decimal numbers. If adding types, append them to this list. If removing,
 // replace the desired visibility with a new value.
 const CollUnlisted collVisibility = 0
 const (
 	CollPublic collVisibility = 1 << iota
 	CollPrivate
 	CollProtected
 )
 
 func (cf *CollectionFormat) Ascending() bool {
 	return cf.Format == "novel"
 }
 func (cf *CollectionFormat) ShowDates() bool {
 	return cf.Format == "blog"
 }
 func (cf *CollectionFormat) PostsPerPage() int {
 	if cf.Format == "novel" {
 		return postsPerPage
 	}
 	return postsPerPage
 }
 
 // Valid returns whether or not a format value is valid.
 func (cf *CollectionFormat) Valid() bool {
 	return cf.Format == "blog" ||
 		cf.Format == "novel" ||
 		cf.Format == "notebook"
 }
 
 // NewFormat creates a new CollectionFormat object from the Collection.
 func (c *Collection) NewFormat() *CollectionFormat {
 	cf := &CollectionFormat{Format: c.Format}
 
 	// Fill in default format
 	if cf.Format == "" {
 		cf.Format = "blog"
 	}
 
 	return cf
 }
 
 func (c *Collection) IsUnlisted() bool {
 	return c.Visibility == 0
 }
 
 func (c *Collection) IsPrivate() bool {
 	return c.Visibility&CollPrivate != 0
 }
 
 func (c *Collection) IsProtected() bool {
 	return c.Visibility&CollProtected != 0
 }
 
 func (c *Collection) IsPublic() bool {
 	return c.Visibility&CollPublic != 0
 }
 
 func (c *Collection) FriendlyVisibility() string {
 	if c.IsPrivate() {
 		return "Private"
 	}
 	if c.IsPublic() {
 		return "Public"
 	}
 	if c.IsProtected() {
 		return "Password-protected"
 	}
 	return "Unlisted"
 }
 
 func (c *Collection) ShowFooterBranding() bool {
 	// TODO: implement this setting
 	return true
 }
 
 // CanonicalURL returns a fully-qualified URL to the collection.
 func (c *Collection) CanonicalURL() string {
 	return c.RedirectingCanonicalURL(false)
 }
 
 func (c *Collection) DisplayCanonicalURL() string {
 	us := c.CanonicalURL()
 	u, err := url.Parse(us)
 	if err != nil {
 		return us
 	}
 	p := u.Path
 	if p == "/" {
 		p = ""
 	}
 	return u.Hostname() + p
 }
 
 func (c *Collection) RedirectingCanonicalURL(isRedir bool) string {
 	if isSingleUser {
 		return hostName + "/"
 	}
 
 	return fmt.Sprintf("%s/%s/", hostName, c.Alias)
 }
 
 // PrevPageURL provides a full URL for the previous page of collection posts,
 // returning a /page/N result for pages >1
 func (c *Collection) PrevPageURL(prefix string, n int, tl bool) string {
 	u := ""
 	if n == 2 {
 		// Previous page is 1; no need for /page/ prefix
 		if prefix == "" {
 			u = "/"
 		}
 		// Else leave off trailing slash
 	} else {
 		u = fmt.Sprintf("/page/%d", n-1)
 	}
 
 	if tl {
 		return u
 	}
 	return "/" + prefix + c.Alias + u
 }
 
 // NextPageURL provides a full URL for the next page of collection posts
 func (c *Collection) NextPageURL(prefix string, n int, tl bool) string {
 	if tl {
 		return fmt.Sprintf("/page/%d", n+1)
 	}
 	return fmt.Sprintf("/%s%s/page/%d", prefix, c.Alias, n+1)
 }
 
 func (c *Collection) DisplayTitle() string {
 	if c.Title != "" {
 		return c.Title
 	}
 	return c.Alias
 }
 
 func (c *Collection) StyleSheetDisplay() template.CSS {
 	return template.CSS(c.StyleSheet)
 }
 
 // ForPublic modifies the Collection for public consumption, such as via
 // the API.
 func (c *Collection) ForPublic() {
 	c.URL = c.CanonicalURL()
 }
 
 var isLowerLetter = regexp.MustCompile("[a-z]").MatchString
 
 func (c *Collection) PersonObject(ids ...int64) *activitystreams.Person {
 	accountRoot := c.FederatedAccount()
 	p := activitystreams.NewPerson(accountRoot)
 	p.URL = c.CanonicalURL()
 	uname := c.Alias
 	p.PreferredUsername = uname
 	p.Name = c.DisplayTitle()
 	p.Summary = c.Description
 	if p.Name != "" {
 		if av := c.AvatarURL(); av != "" {
 			p.Icon = activitystreams.Image{
 				Type:      "Image",
 				MediaType: "image/png",
 				URL:       av,
 			}
 		}
 	}
 
 	collID := c.ID
 	if len(ids) > 0 {
 		collID = ids[0]
 	}
 	pub, priv := c.db.GetAPActorKeys(collID)
 	if pub != nil {
 		p.AddPubKey(pub)
 		p.SetPrivKey(priv)
 	}
 
 	return p
 }
 
 func (c *Collection) AvatarURL() string {
 	fl := string(unicode.ToLower([]rune(c.DisplayTitle())[0]))
 	if !isLowerLetter(fl) {
 		return ""
 	}
 	return hostName + "/img/avatars/" + fl + ".png"
 }
 
 func (c *Collection) FederatedAPIBase() string {
 	return hostName + "/"
 }
 
 func (c *Collection) FederatedAccount() string {
 	accountUser := c.Alias
 	return c.FederatedAPIBase() + "api/collections/" + accountUser
 }
 
 func (c *Collection) RenderMathJax() bool {
 	return c.db.CollectionHasAttribute(c.ID, "render_mathjax")
 }
 
+func (c *Collection) CodeHighlight() bool {
+	return c.db.CollectionHasAttribute(c.ID, "code_highlight")
+}
+
 func newCollection(app *app, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r.Header.Get("Content-Type"))
 	alias := r.FormValue("alias")
 	title := r.FormValue("title")
 
 	var missingParams, accessToken string
 	var u *User
 	c := struct {
 		Alias string `json:"alias" schema:"alias"`
 		Title string `json:"title" schema:"title"`
 		Web   bool   `json:"web" schema:"web"`
 	}{}
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&c)
 		if err != nil {
 			log.Error("Couldn't parse post update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		// TODO: move form parsing to formDecoder
 		c.Alias = alias
 		c.Title = title
 	}
 
 	if c.Alias == "" {
 		if c.Title != "" {
 			// If only a title was given, just use it to generate the alias.
 			c.Alias = getSlug(c.Title, "")
 		} else {
 			missingParams += "`alias` "
 		}
 	}
 	if c.Title == "" {
 		missingParams += "`title` "
 	}
 	if missingParams != "" {
 		return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Parameter(s) %srequired.", missingParams)}
 	}
 
 	if reqJSON && !c.Web {
 		accessToken = r.Header.Get("Authorization")
 		if accessToken == "" {
 			return ErrNoAccessToken
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 	}
 
 	if !author.IsValidUsername(app.cfg, c.Alias) {
 		return impart.HTTPError{http.StatusPreconditionFailed, "Collection alias isn't valid."}
 	}
 
 	var coll *Collection
 	var err error
 	if accessToken != "" {
 		coll, err = app.db.CreateCollectionFromToken(c.Alias, c.Title, accessToken)
 		if err != nil {
 			// TODO: handle this
 			return err
 		}
 	} else {
 		coll, err = app.db.CreateCollection(c.Alias, c.Title, u.ID)
 		if err != nil {
 			// TODO: handle this
 			return err
 		}
 	}
 
 	res := &CollectionObj{Collection: *coll}
 
 	if reqJSON {
 		return impart.WriteSuccess(w, res, http.StatusCreated)
 	}
 	redirectTo := "/me/c/"
 	// TODO: redirect to pad when necessary
 	return impart.HTTPError{http.StatusFound, redirectTo}
 }
 
 func apiCheckCollectionPermissions(app *app, r *http.Request, c *Collection) (int64, error) {
 	accessToken := r.Header.Get("Authorization")
 	var userID int64 = -1
 	if accessToken != "" {
 		userID = app.db.GetUserID(accessToken)
 	}
 	isCollOwner := userID == c.OwnerID
 	if c.IsPrivate() && !isCollOwner {
 		// Collection is private, but user isn't authenticated
 		return -1, ErrCollectionNotFound
 	}
 	if c.IsProtected() {
 		// TODO: check access token
 		return -1, ErrCollectionUnauthorizedRead
 	}
 
 	return userID, nil
 }
 
 // fetchCollection handles the API endpoint for retrieving collection data.
 func fetchCollection(app *app, w http.ResponseWriter, r *http.Request) error {
 	accept := r.Header.Get("Accept")
 	if strings.Contains(accept, "application/activity+json") {
 		return handleFetchCollectionActivities(app, w, r)
 	}
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
 	// TODO: move this logic into a common getCollection function
 	// Get base Collection data
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return err
 	}
 	// Redirect users who aren't requesting JSON
 	reqJSON := IsJSON(r.Header.Get("Content-Type"))
 	if !reqJSON {
 		return impart.HTTPError{http.StatusFound, c.CanonicalURL()}
 	}
 
 	// Check permissions
 	userID, err := apiCheckCollectionPermissions(app, r, c)
 	if err != nil {
 		return err
 	}
 	isCollOwner := userID == c.OwnerID
 
 	// Fetch extra data about the Collection
 	res := &CollectionObj{Collection: *c}
 	if c.PublicOwner {
 		u, err := app.db.GetUserByID(res.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		} else {
 			res.Owner = u
 		}
 	}
 	app.db.GetPostsCount(res, isCollOwner)
 	// Strip non-public information
 	res.Collection.ForPublic()
 
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 // fetchCollectionPosts handles an API endpoint for retrieving a collection's
 // posts.
 func fetchCollectionPosts(app *app, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return err
 	}
 
 	// Check permissions
 	userID, err := apiCheckCollectionPermissions(app, r, c)
 	if err != nil {
 		return err
 	}
 	isCollOwner := userID == c.OwnerID
 
 	// Get page
 	page := 1
 	if p := r.FormValue("page"); p != "" {
 		pInt, _ := strconv.Atoi(p)
 		if pInt > 0 {
 			page = pInt
 		}
 	}
 
 	posts, err := app.db.GetPosts(c, page, isCollOwner, false)
 	if err != nil {
 		return err
 	}
 	coll := &CollectionObj{Collection: *c, Posts: posts}
 	app.db.GetPostsCount(coll, isCollOwner)
 	// Strip non-public information
 	coll.Collection.ForPublic()
 
 	// Transform post bodies if needed
 	if r.FormValue("body") == "html" {
 		for _, p := range *coll.Posts {
 			p.Content = waposts.ApplyMarkdown([]byte(p.Content))
 		}
 	}
 
 	return impart.WriteSuccess(w, coll, http.StatusOK)
 }
 
 type CollectionPage struct {
 	page.StaticPage
 	*DisplayCollection
 	IsCustomDomain bool
 	IsWelcome      bool
 	IsOwner        bool
 	CanPin         bool
 	Username       string
 	Collections    *[]Collection
 	PinnedPosts    *[]PublicPost
 }
 
 func (c *CollectionObj) ScriptDisplay() template.JS {
 	return template.JS(c.Script)
 }
 
 var jsSourceCommentReg = regexp.MustCompile("(?m)^// src:(.+)$")
 
 func (c *CollectionObj) ExternalScripts() []template.URL {
 	scripts := []template.URL{}
 	if c.Script == "" {
 		return scripts
 	}
 
 	matches := jsSourceCommentReg.FindAllStringSubmatch(c.Script, -1)
 	for _, m := range matches {
 		scripts = append(scripts, template.URL(strings.TrimSpace(m[1])))
 	}
 	return scripts
 }
 
 func (c *CollectionObj) CanShowScript() bool {
 	return false
 }
 
 func processCollectionRequest(cr *collectionReq, vars map[string]string, w http.ResponseWriter, r *http.Request) error {
 	cr.prefix = vars["prefix"]
 	cr.alias = vars["collection"]
 	// Normalize the URL, redirecting user to consistent post URL
 	if cr.alias != strings.ToLower(cr.alias) {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", strings.ToLower(cr.alias))}
 	}
 
 	return nil
 }
 
 // processCollectionPermissions checks the permissions for the given
 // collectionReq, returning a Collection if access is granted; otherwise this
 // renders any necessary collection pages, for example, if requesting a custom
 // domain that doesn't yet have a collection associated, or if a collection
 // requires a password. In either case, this will return nil, nil -- thus both
 // values should ALWAYS be checked to determine whether or not to continue.
 func processCollectionPermissions(app *app, cr *collectionReq, u *User, w http.ResponseWriter, r *http.Request) (*Collection, error) {
 	// Display collection if this is a collection
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(cr.alias)
 	}
 	// TODO: verify we don't reveal the existence of a private collection with redirection
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if err.Status == http.StatusNotFound {
 				if cr.isCustomDomain {
 					// User is on the site from a custom domain
 					//tErr := pages["404-domain.tmpl"].ExecuteTemplate(w, "base", pageForHost(page.StaticPage{}, r))
 					//if tErr != nil {
 					//log.Error("Unable to render 404-domain page: %v", err)
 					//}
 					return nil, nil
 				}
 				if len(cr.alias) >= minIDLen && len(cr.alias) <= maxIDLen {
 					// Alias is within post ID range, so just be sure this isn't a post
 					if app.db.PostIDExists(cr.alias) {
 						// TODO: use StatusFound for vanity post URLs when we implement them
 						return nil, impart.HTTPError{http.StatusMovedPermanently, "/" + cr.alias}
 					}
 				}
 				// Redirect if necessary
 				newAlias := app.db.GetCollectionRedirect(cr.alias)
 				if newAlias != "" {
 					return nil, impart.HTTPError{http.StatusFound, "/" + newAlias + "/"}
 				}
 			}
 		}
 		return nil, err
 	}
 
 	// Update CollectionRequest to reflect owner status
 	cr.isCollOwner = u != nil && u.ID == c.OwnerID
 
 	// Check permissions
 	if !cr.isCollOwner {
 		if c.IsPrivate() {
 			return nil, ErrCollectionNotFound
 		} else if c.IsProtected() {
 			uname := ""
 			if u != nil {
 				uname = u.Username
 			}
 
 			// See if we've authorized this collection
 			authd := isAuthorizedForCollection(app, c.Alias, r)
 
 			if !authd {
 				p := struct {
 					page.StaticPage
 					*CollectionObj
 					Username string
 					Next     string
 					Flashes  []template.HTML
 				}{
 					StaticPage:    pageForReq(app, r),
 					CollectionObj: &CollectionObj{Collection: *c},
 					Username:      uname,
 					Next:          r.FormValue("g"),
 					Flashes:       []template.HTML{},
 				}
 				// Get owner information
 				p.CollectionObj.Owner, err = app.db.GetUserByID(c.OwnerID)
 				if err != nil {
 					// Log the error and just continue
 					log.Error("Error getting user for collection: %v", err)
 				}
 
 				flashes, _ := getSessionFlashes(app, w, r, nil)
 				for _, flash := range flashes {
 					p.Flashes = append(p.Flashes, template.HTML(flash))
 				}
 				err = templates["password-collection"].ExecuteTemplate(w, "password-collection", p)
 				if err != nil {
 					log.Error("Unable to render password-collection: %v", err)
 					return nil, err
 				}
 				return nil, nil
 			}
 		}
 	}
 	return c, nil
 }
 
 func checkUserForCollection(app *app, cr *collectionReq, r *http.Request, isPostReq bool) (*User, error) {
 	u := getUserSession(app, r)
 	return u, nil
 }
 
 func newDisplayCollection(c *Collection, cr *collectionReq, page int) *DisplayCollection {
 	coll := &DisplayCollection{
 		CollectionObj: &CollectionObj{Collection: *c},
 		CurrentPage:   page,
 		Prefix:        cr.prefix,
 		IsTopLevel:    isSingleUser,
 		Format:        c.NewFormat(),
 	}
 	c.db.GetPostsCount(coll.CollectionObj, cr.isCollOwner)
 	return coll
 }
 
 func getCollectionPage(vars map[string]string) int {
 	page := 1
 	var p int
 	p, _ = strconv.Atoi(vars["page"])
 	if p > 0 {
 		page = p
 	}
 	return page
 }
 
 // handleViewCollection displays the requested Collection
 func handleViewCollection(app *app, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	cr := &collectionReq{}
 
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 
 	// Serve ActivityStreams data now, if requested
 	if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
 		ac := c.PersonObject()
 		ac.Context = []interface{}{activitystreams.Namespace}
 		return impart.RenderActivityJSON(w, ac, http.StatusOK)
 	}
 
 	// Fetch extra data about the Collection
 	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
 	coll := newDisplayCollection(c, cr, page)
 
 	coll.TotalPages = int(math.Ceil(float64(coll.TotalPosts) / float64(coll.Format.PostsPerPage())))
 	if coll.TotalPages > 0 && page > coll.TotalPages {
 		redirURL := fmt.Sprintf("/page/%d", coll.TotalPages)
 		if !app.cfg.App.SingleUser {
 			redirURL = fmt.Sprintf("/%s%s%s", cr.prefix, coll.Alias, redirURL)
 		}
 		return impart.HTTPError{http.StatusFound, redirURL}
 	}
 
 	coll.Posts, _ = app.db.GetPosts(c, page, cr.isCollOwner, false)
 
 	// Serve collection
 	displayPage := CollectionPage{
 		DisplayCollection: coll,
 		StaticPage:        pageForReq(app, r),
 		IsCustomDomain:    cr.isCustomDomain,
 		IsWelcome:         r.FormValue("greeting") != "",
 	}
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	if owner == nil {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 	}
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj)
 
 	err = templates["collection"].ExecuteTemplate(w, "collection", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection index: %v", err)
 	}
 
 	// Update collection view count
 	go func() {
 		// Don't update if owner is viewing the collection.
 		if u != nil && u.ID == coll.OwnerID {
 			return
 		}
 		// Only update for human views
 		if r.Method == "HEAD" || bots.IsBot(r.UserAgent()) {
 			return
 		}
 
 		_, err := app.db.Exec("UPDATE collections SET view_count = view_count + 1 WHERE id = ?", coll.ID)
 		if err != nil {
 			log.Error("Unable to update collections count: %v", err)
 		}
 	}()
 
 	return err
 }
 
 func handleViewCollectionTag(app *app, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	tag := vars["tag"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 
 	coll := newDisplayCollection(c, cr, page)
 
 	coll.Posts, _ = app.db.GetPostsTagged(c, tag, page, cr.isCollOwner)
 	if coll.Posts != nil && len(*coll.Posts) == 0 {
 		return ErrCollectionPageNotFound
 	}
 
 	// Serve collection
 	displayPage := struct {
 		CollectionPage
 		Tag string
 	}{
 		CollectionPage: CollectionPage{
 			DisplayCollection: coll,
 			StaticPage:        pageForReq(app, r),
 			IsCustomDomain:    cr.isCustomDomain,
 		},
 		Tag: tag,
 	}
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	if owner == nil {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 	}
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj)
 
 	err = templates["collection-tags"].ExecuteTemplate(w, "collection-tags", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection tag page: %v", err)
 	}
 
 	return nil
 }
 
 func handleCollectionPostRedirect(app *app, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	loc := fmt.Sprintf("/%s", slug)
 	if !app.cfg.App.SingleUser {
 		loc = fmt.Sprintf("/%s/%s", cr.alias, slug)
 	}
 	return impart.HTTPError{http.StatusFound, loc}
 }
 
 func existingCollection(app *app, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r.Header.Get("Content-Type"))
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 	isWeb := r.FormValue("web") == "1"
 
 	var u *User
 	if reqJSON && !isWeb {
 		// Ensure an access token was given
 		accessToken := r.Header.Get("Authorization")
 		u = &User{}
 		u.ID = app.db.GetUserID(accessToken)
 		if u.ID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 	}
 
 	if r.Method == "DELETE" {
 		err := app.db.DeleteCollection(collAlias, u.ID)
 		if err != nil {
 			// TODO: if not HTTPError, report error to admin
 			log.Error("Unable to delete collection: %s", err)
 			return err
 		}
 		addSessionFlash(app, w, r, "Deleted your blog, "+collAlias+".", nil)
 		return impart.HTTPError{Status: http.StatusNoContent}
 	}
 
 	c := SubmittedCollection{OwnerID: uint64(u.ID)}
 	var err error
 
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&c)
 		if err != nil {
 			log.Error("Couldn't parse collection update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse collection update form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&c, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode collection update form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	err = app.db.UpdateCollection(&c, collAlias)
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if reqJSON {
 				return err
 			}
 			addSessionFlash(app, w, r, err.Message, nil)
 			return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
 		} else {
 			log.Error("Couldn't update collection: %v\n", err)
 			return err
 		}
 	}
 
 	if reqJSON {
 		return impart.WriteSuccess(w, struct {
 		}{}, http.StatusOK)
 	}
 
 	addSessionFlash(app, w, r, "Blog updated!", nil)
 	return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
 }
 
 // collectionAliasFromReq takes a request and returns the collection alias
 // if it can be ascertained, as well as whether or not the collection uses a
 // custom domain.
 func collectionAliasFromReq(r *http.Request) string {
 	vars := mux.Vars(r)
 	alias := vars["subdomain"]
 	isSubdomain := alias != ""
 	if !isSubdomain {
 		// Fall back to write.as/{collection} since this isn't a custom domain
 		alias = vars["collection"]
 	}
 	return alias
 }
 
 func handleWebCollectionUnlock(app *app, w http.ResponseWriter, r *http.Request) error {
 	var readReq struct {
 		Alias string `schema:"alias" json:"alias"`
 		Pass  string `schema:"password" json:"password"`
 		Next  string `schema:"to" json:"to"`
 	}
 
 	// Get params
 	if impart.ReqJSON(r) {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&readReq)
 		if err != nil {
 			log.Error("Couldn't parse readReq JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse readReq form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&readReq, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode readReq form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	if readReq.Alias == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Need a collection `alias` to read."}
 	}
 	if readReq.Pass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Please supply a password."}
 	}
 
 	var collHashedPass []byte
 	err := app.db.QueryRow("SELECT password FROM collectionpasswords INNER JOIN collections ON id = collection_id WHERE alias = ?", readReq.Alias).Scan(&collHashedPass)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			log.Error("No collectionpassword found when trying to read collection %s", readReq.Alias)
 			return impart.HTTPError{http.StatusInternalServerError, "Something went very wrong. The humans have been alerted."}
 		}
 		return err
 	}
 
 	if !auth.Authenticated(collHashedPass, []byte(readReq.Pass)) {
 		return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 	}
 
 	// Success; set cookie
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
 	if err == nil {
 		session.Values[readReq.Alias] = true
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Didn't save unlocked blog '%s': %v", readReq.Alias, err)
 		}
 	}
 
 	next := "/" + readReq.Next
 	if !app.cfg.App.SingleUser {
 		next = "/" + readReq.Alias + next
 	}
 	return impart.HTTPError{http.StatusFound, next}
 }
 
 func isAuthorizedForCollection(app *app, alias string, r *http.Request) bool {
 	authd := false
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
 	if err == nil {
 		_, authd = session.Values[alias]
 	}
 	return authd
 }
diff --git a/database.go b/database.go
index 0c79e10..e9f052e 100644
--- a/database.go
+++ b/database.go
@@ -1,2140 +1,2155 @@
 package writefreely
 
 import (
 	"database/sql"
 	"fmt"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/go-sql-driver/mysql"
 	"github.com/guregu/null"
 	"github.com/guregu/null/zero"
 	uuid "github.com/nu7hatch/gouuid"
 	"github.com/writeas/impart"
 	"github.com/writeas/nerds/store"
 	"github.com/writeas/web-core/activitypub"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/id"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/query"
 	"github.com/writeas/writefreely/author"
 )
 
 const (
 	mySQLErrDuplicateKey = 1062
 )
 
 type writestore interface {
 	CreateUser(*User, string) error
 	UpdateUserEmail(keys *keychain, userID int64, email string) error
 	UpdateEncryptedUserEmail(int64, []byte) error
 	GetUserByID(int64) (*User, error)
 	GetUserForAuth(string) (*User, error)
 	GetUserForAuthByID(int64) (*User, error)
 	GetUserNameFromToken(string) (string, error)
 	GetUserDataFromToken(string) (int64, string, error)
 	GetAPIUser(header string) (*User, error)
 	GetUserID(accessToken string) int64
 	GetUserIDPrivilege(accessToken string) (userID int64, sudo bool)
 	DeleteToken(accessToken []byte) error
 	FetchLastAccessToken(userID int64) string
 	GetAccessToken(userID int64) (string, error)
 	GetTemporaryAccessToken(userID int64, validSecs int) (string, error)
 	GetTemporaryOneTimeAccessToken(userID int64, validSecs int, oneTime bool) (string, error)
 	DeleteAccount(userID int64) (l *string, err error)
 	ChangeSettings(app *app, u *User, s *userSettings) error
 	ChangePassphrase(userID int64, sudo bool, curPass string, hashedPass []byte) error
 
 	GetCollections(u *User) (*[]Collection, error)
 	GetPublishableCollections(u *User) (*[]Collection, error)
 	GetMeStats(u *User) userMeStats
 	GetTopPosts(u *User, alias string) (*[]PublicPost, error)
 	GetAnonymousPosts(u *User) (*[]PublicPost, error)
 	GetUserPosts(u *User) (*[]PublicPost, error)
 
 	CreateOwnedPost(post *SubmittedPost, accessToken, collAlias string) (*PublicPost, error)
 	CreatePost(userID, collID int64, post *SubmittedPost) (*Post, error)
 	UpdateOwnedPost(post *AuthenticatedPost, userID int64) error
 	GetEditablePost(id, editToken string) (*PublicPost, error)
 	PostIDExists(id string) bool
 	GetPost(id string, collectionID int64) (*PublicPost, error)
 	GetOwnedPost(id string, ownerID int64) (*PublicPost, error)
 	GetPostProperty(id string, collectionID int64, property string) (interface{}, error)
 
 	CreateCollectionFromToken(string, string, string) (*Collection, error)
 	CreateCollection(string, string, int64) (*Collection, error)
 	GetCollectionBy(condition string, value interface{}) (*Collection, error)
 	GetCollection(alias string) (*Collection, error)
 	GetCollectionForPad(alias string) (*Collection, error)
 	GetCollectionByID(id int64) (*Collection, error)
 	UpdateCollection(c *SubmittedCollection, alias string) error
 	DeleteCollection(alias string, userID int64) error
 
 	UpdatePostPinState(pinned bool, postID string, collID, ownerID, pos int64) error
 	GetLastPinnedPostPos(collID int64) int64
 	GetPinnedPosts(coll *CollectionObj) (*[]PublicPost, error)
 	RemoveCollectionRedirect(t *sql.Tx, alias string) error
 	GetCollectionRedirect(alias string) (new string)
 	IsCollectionAttributeOn(id int64, attr string) bool
 	CollectionHasAttribute(id int64, attr string) bool
 
 	CanCollect(cpr *ClaimPostRequest, userID int64) bool
 	AttemptClaim(p *ClaimPostRequest, query string, params []interface{}, slugIdx int) (sql.Result, error)
 	DispersePosts(userID int64, postIDs []string) (*[]ClaimPostResult, error)
 	ClaimPosts(userID int64, collAlias string, posts *[]ClaimPostRequest) (*[]ClaimPostResult, error)
 
 	GetPostsCount(c *CollectionObj, includeFuture bool)
 	GetPosts(c *Collection, page int, includeFuture, forceRecentFirst bool) (*[]PublicPost, error)
 	GetPostsTagged(c *Collection, tag string, page int, includeFuture bool) (*[]PublicPost, error)
 
 	GetAPFollowers(c *Collection) (*[]RemoteUser, error)
 	GetAPActorKeys(collectionID int64) ([]byte, []byte)
 
 	GetDynamicContent(id string) (string, *time.Time, error)
 	UpdateDynamicContent(id, content string) error
 }
 
 type datastore struct {
 	*sql.DB
 }
 
 func (db *datastore) CreateUser(u *User, collectionTitle string) error {
 	// New users get a `users` and `collections` row.
 	t, err := db.Begin()
 	if err != nil {
 		return err
 	}
 
 	if db.PostIDExists(u.Username) {
 		return impart.HTTPError{http.StatusConflict, "Invalid collection name."}
 	}
 
 	// 1. Add to `users` table
 	// NOTE: Assumes User's Password is already hashed!
 	res, err := t.Exec("INSERT INTO users (username, password, email, created) VALUES (?, ?, ?, NOW())", u.Username, u.HashedPass, u.Email)
 	if err != nil {
 		t.Rollback()
 		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 			if mysqlErr.Number == mySQLErrDuplicateKey {
 				return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 			}
 		}
 
 		log.Error("Rolling back users INSERT: %v\n", err)
 		return err
 	}
 	u.ID, err = res.LastInsertId()
 	if err != nil {
 		t.Rollback()
 		log.Error("Rolling back after LastInsertId: %v\n", err)
 		return err
 	}
 
 	// 2. Create user's Collection
 	if collectionTitle == "" {
 		collectionTitle = u.Username
 	}
 	res, err = t.Exec("INSERT INTO collections (alias, title, description, privacy, owner_id, view_count) VALUES (?, ?, ?, ?, ?, ?)", u.Username, collectionTitle, "", CollUnlisted, u.ID, 0)
 	if err != nil {
 		t.Rollback()
 		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 			if mysqlErr.Number == mySQLErrDuplicateKey {
 				return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 			}
 		}
 		log.Error("Rolling back collections INSERT: %v\n", err)
 		return err
 	}
 
 	db.RemoveCollectionRedirect(t, u.Username)
 
 	err = t.Commit()
 	if err != nil {
 		t.Rollback()
 		log.Error("Rolling back after Commit(): %v\n", err)
 		return err
 	}
 
 	return nil
 }
 
 // FIXME: We're returning errors inconsistently in this file. Do we use Errorf
 // for returned value, or impart?
 func (db *datastore) UpdateUserEmail(keys *keychain, userID int64, email string) error {
 	encEmail, err := data.Encrypt(keys.emailKey, email)
 	if err != nil {
 		return fmt.Errorf("Couldn't encrypt email %s: %s\n", email, err)
 	}
 
 	return db.UpdateEncryptedUserEmail(userID, encEmail)
 }
 
 func (db *datastore) UpdateEncryptedUserEmail(userID int64, encEmail []byte) error {
 	_, err := db.Exec("UPDATE users SET email = ? WHERE id = ?", encEmail, userID)
 	if err != nil {
 		return fmt.Errorf("Unable to update user email: %s", err)
 	}
 
 	return nil
 }
 
 func (db *datastore) CreateCollectionFromToken(alias, title, accessToken string) (*Collection, error) {
 	userID := db.GetUserID(accessToken)
 	if userID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return db.CreateCollection(alias, title, userID)
 }
 
 func (db *datastore) GetUserCollectionCount(userID int64) (uint64, error) {
 	var collCount uint64
 	err := db.QueryRow("SELECT COUNT(*) FROM collections WHERE owner_id = ?", userID).Scan(&collCount)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user from database."}
 	case err != nil:
 		log.Error("Couldn't get collections count for user %d: %v", userID, err)
 		return 0, err
 	}
 
 	return collCount, nil
 }
 
 func (db *datastore) CreateCollection(alias, title string, userID int64) (*Collection, error) {
 	if db.PostIDExists(alias) {
 		return nil, impart.HTTPError{http.StatusConflict, "Invalid collection name."}
 	}
 
 	// All good, so create new collection
 	res, err := db.Exec("INSERT INTO collections (alias, title, description, privacy, owner_id, view_count) VALUES (?, ?, ?, ?, ?, ?)", alias, title, "", CollUnlisted, userID, 0)
 	if err != nil {
 		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 			if mysqlErr.Number == mySQLErrDuplicateKey {
 				return nil, impart.HTTPError{http.StatusConflict, "Collection already exists."}
 			}
 		}
 		log.Error("Couldn't add to collections: %v\n", err)
 		return nil, err
 	}
 
 	c := &Collection{
 		Alias:       alias,
 		Title:       title,
 		OwnerID:     userID,
 		PublicOwner: false,
 	}
 
 	c.ID, err = res.LastInsertId()
 	if err != nil {
 		log.Error("Couldn't get collection LastInsertId: %v\n", err)
 	}
 
 	return c, nil
 }
 
 func (db *datastore) GetUserByID(id int64) (*User, error) {
 	u := &User{ID: id}
 
 	err := db.QueryRow("SELECT username, password, email, created FROM users WHERE id = ?", id).Scan(&u.Username, &u.HashedPass, &u.Email, &u.Created)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user password: %v", err)
 		return nil, err
 	}
 
 	return u, nil
 }
 
 // DoesUserNeedAuth returns true if the user hasn't provided any methods for
 // authenticating with the account, such a passphrase or email address.
 // Any errors are reported to admin and silently quashed, returning false as the
 // result.
 func (db *datastore) DoesUserNeedAuth(id int64) bool {
 	var pass, email []byte
 
 	// Find out if user has an email set first
 	err := db.QueryRow("SELECT password, email FROM users WHERE id = ?", id).Scan(&pass, &email)
 	switch {
 	case err == sql.ErrNoRows:
 		// ERROR. Don't give false positives on needing auth methods
 		return false
 	case err != nil:
 		// ERROR. Don't give false positives on needing auth methods
 		log.Error("Couldn't SELECT user %d from users: %v", id, err)
 		return false
 	}
 	// User doesn't need auth if there's an email
 	return len(email) == 0 && len(pass) == 0
 }
 
 func (db *datastore) IsUserPassSet(id int64) (bool, error) {
 	var pass []byte
 	err := db.QueryRow("SELECT password FROM users WHERE id = ?", id).Scan(&pass)
 	switch {
 	case err == sql.ErrNoRows:
 		return false, nil
 	case err != nil:
 		log.Error("Couldn't SELECT user %d from users: %v", id, err)
 		return false, err
 	}
 
 	return len(pass) > 0, nil
 }
 
 func (db *datastore) GetUserForAuth(username string) (*User, error) {
 	u := &User{Username: username}
 
 	err := db.QueryRow("SELECT id, password, email, created FROM users WHERE username = ?", username).Scan(&u.ID, &u.HashedPass, &u.Email, &u.Created)
 	switch {
 	case err == sql.ErrNoRows:
 		// Check if they've entered the wrong, unnormalized username
 		username = getSlug(username, "")
 		if username != u.Username {
 			err = db.QueryRow("SELECT id FROM users WHERE username = ? LIMIT 1", username).Scan(&u.ID)
 			if err == nil {
 				return db.GetUserForAuth(username)
 			}
 		}
 		return nil, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user password: %v", err)
 		return nil, err
 	}
 
 	return u, nil
 }
 
 func (db *datastore) GetUserForAuthByID(userID int64) (*User, error) {
 	u := &User{ID: userID}
 
 	err := db.QueryRow("SELECT id, password, email, created FROM users WHERE id = ?", u.ID).Scan(&u.ID, &u.HashedPass, &u.Email, &u.Created)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT userForAuthByID: %v", err)
 		return nil, err
 	}
 
 	return u, nil
 }
 
 func (db *datastore) GetUserNameFromToken(accessToken string) (string, error) {
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return "", ErrNoAccessToken
 	}
 
 	var oneTime bool
 	var username string
 	err := db.QueryRow("SELECT username, one_time FROM accesstokens LEFT JOIN users ON user_id = id WHERE token = ? AND (expires IS NULL OR expires > NOW())", t).Scan(&username, &oneTime)
 	switch {
 	case err == sql.ErrNoRows:
 		return "", ErrBadAccessToken
 	case err != nil:
 		return "", ErrInternalGeneral
 	}
 
 	// Delete token if it was one-time
 	if oneTime {
 		db.DeleteToken(t[:])
 	}
 
 	return username, nil
 }
 
 func (db *datastore) GetUserDataFromToken(accessToken string) (int64, string, error) {
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return 0, "", ErrNoAccessToken
 	}
 
 	var userID int64
 	var oneTime bool
 	var username string
 	err := db.QueryRow("SELECT user_id, username, one_time FROM accesstokens LEFT JOIN users ON user_id = id WHERE token = ? AND (expires IS NULL OR expires > NOW())", t).Scan(&userID, &username, &oneTime)
 	switch {
 	case err == sql.ErrNoRows:
 		return 0, "", ErrBadAccessToken
 	case err != nil:
 		return 0, "", ErrInternalGeneral
 	}
 
 	// Delete token if it was one-time
 	if oneTime {
 		db.DeleteToken(t[:])
 	}
 
 	return userID, username, nil
 }
 
 func (db *datastore) GetAPIUser(header string) (*User, error) {
 	uID := db.GetUserID(header)
 	if uID == -1 {
 		return nil, fmt.Errorf(ErrUserNotFound.Error())
 	}
 	return db.GetUserByID(uID)
 }
 
 // GetUserID takes a hexadecimal accessToken, parses it into its binary
 // representation, and gets any user ID associated with the token. If no user
 // is associated, -1 is returned.
 func (db *datastore) GetUserID(accessToken string) int64 {
 	i, _ := db.GetUserIDPrivilege(accessToken)
 	return i
 }
 
 func (db *datastore) GetUserIDPrivilege(accessToken string) (userID int64, sudo bool) {
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return -1, false
 	}
 
 	var oneTime bool
 	err := db.QueryRow("SELECT user_id, sudo, one_time FROM accesstokens WHERE token = ? AND (expires IS NULL OR expires > NOW())", t).Scan(&userID, &sudo, &oneTime)
 	switch {
 	case err == sql.ErrNoRows:
 		return -1, false
 	case err != nil:
 		return -1, false
 	}
 
 	// Delete token if it was one-time
 	if oneTime {
 		db.DeleteToken(t[:])
 	}
 
 	return
 }
 
 func (db *datastore) DeleteToken(accessToken []byte) error {
 	res, err := db.Exec("DELETE FROM accesstokens WHERE token = ?", accessToken)
 	if err != nil {
 		return err
 	}
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		return impart.HTTPError{http.StatusNotFound, "Token is invalid or doesn't exist"}
 	}
 	return nil
 }
 
 // FetchLastAccessToken creates a new non-expiring, valid access token for the given
 // userID.
 func (db *datastore) FetchLastAccessToken(userID int64) string {
 	var t []byte
 	err := db.QueryRow("SELECT token FROM accesstokens WHERE user_id = ? AND (expires IS NULL OR expires > NOW()) ORDER BY created DESC LIMIT 1", userID).Scan(&t)
 	switch {
 	case err == sql.ErrNoRows:
 		return ""
 	case err != nil:
 		log.Error("Failed selecting from accesstoken: %v", err)
 		return ""
 	}
 
 	u, err := uuid.Parse(t)
 	if err != nil {
 		return ""
 	}
 	return u.String()
 }
 
 // GetAccessToken creates a new non-expiring, valid access token for the given
 // userID.
 func (db *datastore) GetAccessToken(userID int64) (string, error) {
 	return db.GetTemporaryOneTimeAccessToken(userID, 0, false)
 }
 
 // GetTemporaryAccessToken creates a new valid access token for the given
 // userID that remains valid for the given time in seconds. If validSecs is 0,
 // the access token doesn't automatically expire.
 func (db *datastore) GetTemporaryAccessToken(userID int64, validSecs int) (string, error) {
 	return db.GetTemporaryOneTimeAccessToken(userID, validSecs, false)
 }
 
 // GetTemporaryOneTimeAccessToken creates a new valid access token for the given
 // userID that remains valid for the given time in seconds and can only be used
 // once if oneTime is true. If validSecs is 0, the access token doesn't
 // automatically expire.
 func (db *datastore) GetTemporaryOneTimeAccessToken(userID int64, validSecs int, oneTime bool) (string, error) {
 	u, err := uuid.NewV4()
 	if err != nil {
 		log.Error("Unable to generate token: %v", err)
 		return "", err
 	}
 
 	// Insert UUID to `accesstokens`
 	binTok := u[:]
 
 	expirationVal := "NULL"
 	if validSecs > 0 {
 		expirationVal = fmt.Sprintf("DATE_ADD(NOW(), INTERVAL %d SECOND)", validSecs)
 	}
 
 	_, err = db.Exec("INSERT INTO accesstokens (token, user_id, created, one_time, expires) VALUES (?, ?, NOW(), ?, "+expirationVal+")", string(binTok), userID, oneTime)
 	if err != nil {
 		log.Error("Couldn't INSERT accesstoken: %v", err)
 		return "", err
 	}
 
 	return u.String(), nil
 }
 
 func (db *datastore) CreateOwnedPost(post *SubmittedPost, accessToken, collAlias string) (*PublicPost, error) {
 	var userID, collID int64 = -1, -1
 	var coll *Collection
 	var err error
 	if accessToken != "" {
 		userID = db.GetUserID(accessToken)
 		if userID == -1 {
 			return nil, ErrBadAccessToken
 		}
 		if collAlias != "" {
 			coll, err = db.GetCollection(collAlias)
 			if err != nil {
 				return nil, err
 			}
 			if coll.OwnerID != userID {
 				return nil, ErrForbiddenCollection
 			}
 			collID = coll.ID
 		}
 	}
 
 	rp := &PublicPost{}
 	rp.Post, err = db.CreatePost(userID, collID, post)
 	if err != nil {
 		return rp, err
 	}
 	if coll != nil {
 		coll.ForPublic()
 		rp.Collection = &CollectionObj{Collection: *coll}
 	}
 	return rp, nil
 }
 
 func (db *datastore) CreatePost(userID, collID int64, post *SubmittedPost) (*Post, error) {
 	idLen := postIDLen
 	friendlyID := store.GenerateFriendlyRandomString(idLen)
 
 	// Handle appearance / font face
 	appearance := post.Font
 	if !post.isFontValid() {
 		appearance = "norm"
 	}
 
 	var err error
 	ownerID := sql.NullInt64{
 		Valid: false,
 	}
 	ownerCollID := sql.NullInt64{
 		Valid: false,
 	}
 	slug := sql.NullString{"", false}
 
 	// If an alias was supplied, we'll add this to the collection as well.
 	if userID > 0 {
 		ownerID.Int64 = userID
 		ownerID.Valid = true
 		if collID > 0 {
 			ownerCollID.Int64 = collID
 			ownerCollID.Valid = true
 			var slugVal string
 			if post.Title != nil && *post.Title != "" {
 				slugVal = getSlug(*post.Title, post.Language.String)
 				if slugVal == "" {
 					slugVal = getSlug(*post.Content, post.Language.String)
 				}
 			} else {
 				slugVal = getSlug(*post.Content, post.Language.String)
 			}
 			if slugVal == "" {
 				slugVal = friendlyID
 			}
 			slug = sql.NullString{slugVal, true}
 		}
 	}
 
 	created := time.Now()
 	if post.Created != nil {
 		created, err = time.Parse("2006-01-02T15:04:05Z", *post.Created)
 		if err != nil {
 			log.Error("Unable to parse Created time '%s': %v", *post.Created, err)
 			created = time.Now()
 		}
 	}
 
 	stmt, err := db.Prepare("INSERT INTO posts (id, slug, title, content, text_appearance, language, rtl, privacy, owner_id, collection_id, created, updated, view_count) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NOW(), ?)")
 	if err != nil {
 		return nil, err
 	}
 	defer stmt.Close()
 	_, err = stmt.Exec(friendlyID, slug, post.Title, post.Content, appearance, post.Language, post.IsRTL, 0, ownerID, ownerCollID, created, 0)
 	if err != nil {
 		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 			if mysqlErr.Number == mySQLErrDuplicateKey {
 				// Duplicate entry error; try a new slug
 				// TODO: make this a little more robust
 				slug = sql.NullString{id.GenSafeUniqueSlug(slug.String), true}
 				_, err = stmt.Exec(friendlyID, slug, post.Title, post.Content, appearance, post.Language, post.IsRTL, 0, ownerID, ownerCollID, created, 0)
 				if err != nil {
 					return nil, handleFailedPostInsert(fmt.Errorf("Retried slug generation, still failed: %v", err))
 				}
 			} else {
 				return nil, handleFailedPostInsert(err)
 			}
 		} else {
 			return nil, handleFailedPostInsert(err)
 		}
 	}
 
 	// TODO: return Created field in proper format
 	return &Post{
 		ID:           friendlyID,
 		Slug:         null.NewString(slug.String, slug.Valid),
 		Font:         appearance,
 		Language:     zero.NewString(post.Language.String, post.Language.Valid),
 		RTL:          zero.NewBool(post.IsRTL.Bool, post.IsRTL.Valid),
 		OwnerID:      null.NewInt(userID, true),
 		CollectionID: null.NewInt(userID, true),
 		Created:      created.Truncate(time.Second).UTC(),
 		Updated:      time.Now().Truncate(time.Second).UTC(),
 		Title:        zero.NewString(*(post.Title), true),
 		Content:      *(post.Content),
 	}, nil
 }
 
 // UpdateOwnedPost updates an existing post with only the given fields in the
 // supplied AuthenticatedPost.
 func (db *datastore) UpdateOwnedPost(post *AuthenticatedPost, userID int64) error {
 	params := []interface{}{}
 	var queryUpdates, sep, authCondition string
 	if post.Slug != nil && *post.Slug != "" {
 		queryUpdates += sep + "slug = ?"
 		sep = ", "
 		params = append(params, getSlug(*post.Slug, ""))
 	}
 	if post.Content != nil {
 		queryUpdates += sep + "content = ?"
 		sep = ", "
 		params = append(params, post.Content)
 	}
 	if post.Title != nil {
 		queryUpdates += sep + "title = ?"
 		sep = ", "
 		params = append(params, post.Title)
 	}
 	if post.Language.Valid {
 		queryUpdates += sep + "language = ?"
 		sep = ", "
 		params = append(params, post.Language.String)
 	}
 	if post.IsRTL.Valid {
 		queryUpdates += sep + "rtl = ?"
 		sep = ", "
 		params = append(params, post.IsRTL.Bool)
 	}
 	if post.Font != "" {
 		queryUpdates += sep + "text_appearance = ?"
 		sep = ", "
 		params = append(params, post.Font)
 	}
 	if post.Created != nil {
 		createTime, err := time.Parse(postMetaDateFormat, *post.Created)
 		if err != nil {
 			log.Error("Unable to parse Created date: %v", err)
 			return fmt.Errorf("That's the incorrect format for Created date.")
 		}
 		queryUpdates += sep + "created = ?"
 		sep = ", "
 		params = append(params, createTime)
 	}
 
 	// WHERE parameters...
 	// id = ?
 	params = append(params, post.ID)
 	// AND owner_id = ?
 	authCondition = "(owner_id = ?)"
 	params = append(params, userID)
 
 	if queryUpdates == "" {
 		return ErrPostNoUpdatableVals
 	}
 
 	queryUpdates += sep + "updated = NOW()"
 
 	res, err := db.Exec("UPDATE posts SET "+queryUpdates+" WHERE id = ? AND "+authCondition, params...)
 	if err != nil {
 		log.Error("Unable to update owned post: %v", err)
 		return err
 	}
 
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		// Show the correct error message if nothing was updated
 		var dummy int
 		err := db.QueryRow("SELECT 1 FROM posts WHERE id = ? AND "+authCondition, post.ID, params[len(params)-1]).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return ErrUnauthorizedEditPost
 		case err != nil:
 			log.Error("Failed selecting from posts: %v", err)
 		}
 		return nil
 	}
 
 	return nil
 }
 
 func (db *datastore) GetCollectionBy(condition string, value interface{}) (*Collection, error) {
 	c := &Collection{}
 
 	// FIXME: change Collection to reflect database values. Add helper functions to get actual values
 	var styleSheet, script, format zero.String
 	row := db.QueryRow("SELECT id, alias, title, description, style_sheet, script, format, owner_id, privacy, view_count FROM collections WHERE "+condition, value)
 
 	err := row.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &styleSheet, &script, &format, &c.OwnerID, &c.Visibility, &c.Views)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, impart.HTTPError{http.StatusNotFound, "Collection doesn't exist."}
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 	c.StyleSheet = styleSheet.String
 	c.Script = script.String
 	c.Format = format.String
 	c.Public = c.IsPublic()
 
 	c.db = db
 
 	return c, nil
 }
 
 func (db *datastore) GetCollection(alias string) (*Collection, error) {
 	return db.GetCollectionBy("alias = ?", alias)
 }
 
 func (db *datastore) GetCollectionForPad(alias string) (*Collection, error) {
 	c := &Collection{Alias: alias}
 
 	row := db.QueryRow("SELECT id, alias, title, description, privacy FROM collections WHERE alias = ?", alias)
 
 	err := row.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &c.Visibility)
 	switch {
 	case err == sql.ErrNoRows:
 		return c, impart.HTTPError{http.StatusNotFound, "Collection doesn't exist."}
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return c, ErrInternalGeneral
 	}
 	c.Public = c.IsPublic()
 
 	return c, nil
 }
 
 func (db *datastore) GetCollectionByID(id int64) (*Collection, error) {
 	return db.GetCollectionBy("id = ?", id)
 }
 
 func (db *datastore) GetCollectionFromDomain(host string) (*Collection, error) {
 	return db.GetCollectionBy("host = ?", host)
 }
 
 func (db *datastore) UpdateCollection(c *SubmittedCollection, alias string) error {
 	q := query.NewUpdate().
 		SetStringPtr(c.Title, "title").
 		SetStringPtr(c.Description, "description").
 		SetNullString(c.StyleSheet, "style_sheet").
 		SetNullString(c.Script, "script")
 
 	if c.Format != nil {
 		cf := &CollectionFormat{Format: c.Format.String}
 		if cf.Valid() {
 			q.SetNullString(c.Format, "format")
 		}
 	}
 
 	var updatePass bool
 	if c.Visibility != nil && (collVisibility(*c.Visibility)&CollProtected == 0 || c.Pass != "") {
 		q.SetIntPtr(c.Visibility, "privacy")
 		if c.Pass != "" {
 			updatePass = true
 		}
 	}
 
 	// WHERE values
 	q.Where("alias = ? AND owner_id = ?", alias, c.OwnerID)
 
 	if q.Updates == "" {
 		return ErrPostNoUpdatableVals
 	}
 
 	// Find any current domain
 	var collID int64
 	var rowsAffected int64
 	var changed bool
 	var res sql.Result
 	err := db.QueryRow("SELECT id FROM collections WHERE alias = ?", alias).Scan(&collID)
 	if err != nil {
 		log.Error("Failed selecting from collections: %v. Some things won't work.", err)
 	}
 
 	// Update MathJax value
 	if c.MathJax {
 		_, err = db.Exec("INSERT INTO collectionattributes (collection_id, attribute, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = ?", collID, "render_mathjax", "1", "1")
 		if err != nil {
 			log.Error("Unable to insert render_mathjax value: %v", err)
 			return err
 		}
 	} else {
 		_, err = db.Exec("DELETE FROM collectionattributes WHERE collection_id = ? AND attribute = ?", collID, "render_mathjax")
 		if err != nil {
 			log.Error("Unable to delete render_mathjax value: %v", err)
 			return err
 		}
 	}
 
+	// Update CodeHighlight value
+	if c.Highlight {
+		_, err = db.Exec("INSERT INTO collectionattributes (collection_id, attribute, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = ?", collID, "code_highlight", "1", "1")
+		if err != nil {
+			log.Error("Unable to insert code_highlight value: %v", err)
+			return err
+		}
+	} else {
+		_, err = db.Exec("DELETE FROM collectionattributes WHERE collection_id = ? AND attribute = ?", collID, "code_highlight")
+		if err != nil {
+			log.Error("Unable to delete code_highlight value: %v", err)
+			return err
+		}
+	}
+
 	// Update rest of the collection data
 	res, err = db.Exec("UPDATE collections SET "+q.Updates+" WHERE "+q.Conditions, q.Params...)
 	if err != nil {
 		log.Error("Unable to update collection: %v", err)
 		return err
 	}
 
 	rowsAffected, _ = res.RowsAffected()
 	if !changed || rowsAffected == 0 {
 		// Show the correct error message if nothing was updated
 		var dummy int
 		err := db.QueryRow("SELECT 1 FROM collections WHERE alias = ? AND owner_id = ?", alias, c.OwnerID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return ErrUnauthorizedEditPost
 		case err != nil:
 			log.Error("Failed selecting from collections: %v", err)
 		}
 		if !updatePass {
 			return nil
 		}
 	}
 
 	if updatePass {
 		hashedPass, err := auth.HashPass([]byte(c.Pass))
 		if err != nil {
 			log.Error("Unable to create hash: %s", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 		}
 		_, err = db.Exec("INSERT INTO collectionpasswords (collection_id, password) VALUES ((SELECT id FROM collections WHERE alias = ?), ?) ON DUPLICATE KEY UPDATE password = ?", alias, hashedPass, hashedPass)
 		if err != nil {
 			return err
 		}
 	}
 
 	return nil
 }
 
 const postCols = "id, slug, text_appearance, language, rtl, privacy, owner_id, collection_id, pinned_position, created, updated, view_count, title, content"
 
 // getEditablePost returns a PublicPost with the given ID only if the given
 // edit token is valid for the post.
 func (db *datastore) GetEditablePost(id, editToken string) (*PublicPost, error) {
 	// FIXME: code duplicated from getPost()
 	// TODO: add slight logic difference to getPost / one func
 	var ownerName sql.NullString
 	p := &Post{}
 
 	row := db.QueryRow("SELECT "+postCols+", (SELECT username FROM users WHERE users.id = posts.owner_id) AS username FROM posts WHERE id = ? LIMIT 1", id)
 	err := row.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content, &ownerName)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrPostNotFound
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 
 	if p.Content == "" {
 		return nil, ErrPostUnpublished
 	}
 
 	res := p.processPost()
 	if ownerName.Valid {
 		res.Owner = &PublicUser{Username: ownerName.String}
 	}
 
 	return &res, nil
 }
 
 func (db *datastore) PostIDExists(id string) bool {
 	var dummy bool
 	err := db.QueryRow("SELECT 1 FROM posts WHERE id = ?", id).Scan(&dummy)
 	return err == nil && dummy
 }
 
 // GetPost gets a public-facing post object from the database. If collectionID
 // is > 0, the post will be retrieved by slug and collection ID, rather than
 // post ID.
 // TODO: break this into two functions:
 //   - GetPost(id string)
 //   - GetCollectionPost(slug string, collectionID int64)
 func (db *datastore) GetPost(id string, collectionID int64) (*PublicPost, error) {
 	var ownerName sql.NullString
 	p := &Post{}
 
 	var row *sql.Row
 	var where string
 	params := []interface{}{id}
 	if collectionID > 0 {
 		where = "slug = ? AND collection_id = ?"
 		params = append(params, collectionID)
 	} else {
 		where = "id = ?"
 	}
 	row = db.QueryRow("SELECT "+postCols+", (SELECT username FROM users WHERE users.id = posts.owner_id) AS username FROM posts WHERE "+where+" LIMIT 1", params...)
 	err := row.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content, &ownerName)
 	switch {
 	case err == sql.ErrNoRows:
 		if collectionID > 0 {
 			return nil, ErrCollectionPageNotFound
 		}
 		return nil, ErrPostNotFound
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 
 	if p.Content == "" {
 		return nil, ErrPostUnpublished
 	}
 
 	res := p.processPost()
 	if ownerName.Valid {
 		res.Owner = &PublicUser{Username: ownerName.String}
 	}
 
 	return &res, nil
 }
 
 // TODO: don't duplicate getPost() functionality
 func (db *datastore) GetOwnedPost(id string, ownerID int64) (*PublicPost, error) {
 	p := &Post{}
 
 	var row *sql.Row
 	where := "id = ? AND owner_id = ?"
 	params := []interface{}{id, ownerID}
 	row = db.QueryRow("SELECT "+postCols+" FROM posts WHERE "+where+" LIMIT 1", params...)
 	err := row.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, ErrPostNotFound
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, err
 	}
 
 	if p.Content == "" {
 		return nil, ErrPostUnpublished
 	}
 
 	res := p.processPost()
 
 	return &res, nil
 }
 
 func (db *datastore) GetPostProperty(id string, collectionID int64, property string) (interface{}, error) {
 	propSelects := map[string]string{
 		"views": "view_count AS views",
 	}
 	selectQuery, ok := propSelects[property]
 	if !ok {
 		return nil, impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Invalid property: %s.", property)}
 	}
 
 	var res interface{}
 	var row *sql.Row
 	if collectionID != 0 {
 		row = db.QueryRow("SELECT "+selectQuery+" FROM posts WHERE slug = ? AND collection_id = ? LIMIT 1", id, collectionID)
 	} else {
 		row = db.QueryRow("SELECT "+selectQuery+" FROM posts WHERE id = ? LIMIT 1", id)
 	}
 	err := row.Scan(&res)
 	switch {
 	case err == sql.ErrNoRows:
 		return nil, impart.HTTPError{http.StatusNotFound, "Post not found."}
 	case err != nil:
 		log.Error("Failed selecting post: %v", err)
 		return nil, err
 	}
 
 	return res, nil
 }
 
 // GetPostsCount modifies the CollectionObj to include the correct number of
 // standard (non-pinned) posts. It will return future posts if `includeFuture`
 // is true.
 func (db *datastore) GetPostsCount(c *CollectionObj, includeFuture bool) {
 	var count int64
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= NOW()"
 	}
 	err := db.QueryRow("SELECT COUNT(*) FROM posts WHERE collection_id = ? AND pinned_position IS NULL "+timeCondition, c.ID).Scan(&count)
 	switch {
 	case err == sql.ErrNoRows:
 		c.TotalPosts = 0
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		c.TotalPosts = 0
 	}
 
 	c.TotalPosts = int(count)
 }
 
 // GetPosts retrieves all standard (non-pinned) posts for the given Collection.
 // It will return future posts if `includeFuture` is true.
 // TODO: change includeFuture to isOwner, since that's how it's used
 func (db *datastore) GetPosts(c *Collection, page int, includeFuture, forceRecentFirst bool) (*[]PublicPost, error) {
 	collID := c.ID
 
 	cf := c.NewFormat()
 	order := "DESC"
 	if cf.Ascending() && !forceRecentFirst {
 		order = "ASC"
 	}
 
 	pagePosts := cf.PostsPerPage()
 	start := page*pagePosts - pagePosts
 	if page == 0 {
 		start = 0
 		pagePosts = 1000
 	}
 
 	limitStr := ""
 	if page > 0 {
 		limitStr = fmt.Sprintf(" LIMIT %d, %d", start, pagePosts)
 	}
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= NOW()"
 	}
 	rows, err := db.Query("SELECT "+postCols+" FROM posts WHERE collection_id = ? AND pinned_position IS NULL "+timeCondition+" ORDER BY created "+order+limitStr, collID)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve collection posts."}
 	}
 	defer rows.Close()
 
 	// TODO: extract this common row scanning logic for queries using `postCols`
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 		p.formatContent(c, includeFuture)
 
 		posts = append(posts, p.processPost())
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 // GetPostsTagged retrieves all posts on the given Collection that contain the
 // given tag.
 // It will return future posts if `includeFuture` is true.
 // TODO: change includeFuture to isOwner, since that's how it's used
 func (db *datastore) GetPostsTagged(c *Collection, tag string, page int, includeFuture bool) (*[]PublicPost, error) {
 	collID := c.ID
 
 	cf := c.NewFormat()
 	order := "DESC"
 	if cf.Ascending() {
 		order = "ASC"
 	}
 
 	pagePosts := cf.PostsPerPage()
 	start := page*pagePosts - pagePosts
 	if page == 0 {
 		start = 0
 		pagePosts = 1000
 	}
 
 	limitStr := ""
 	if page > 0 {
 		limitStr = fmt.Sprintf(" LIMIT %d, %d", start, pagePosts)
 	}
 	timeCondition := ""
 	if !includeFuture {
 		timeCondition = "AND created <= NOW()"
 	}
 	rows, err := db.Query("SELECT "+postCols+" FROM posts WHERE collection_id = ? AND LOWER(content) RLIKE ? "+timeCondition+" ORDER BY created "+order+limitStr, collID, "#"+strings.ToLower(tag)+"[[:>:]]")
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve collection posts."}
 	}
 	defer rows.Close()
 
 	// TODO: extract this common row scanning logic for queries using `postCols`
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Font, &p.Language, &p.RTL, &p.Privacy, &p.OwnerID, &p.CollectionID, &p.PinnedPosition, &p.Created, &p.Updated, &p.ViewCount, &p.Title, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 		p.formatContent(c, includeFuture)
 
 		posts = append(posts, p.processPost())
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetAPFollowers(c *Collection) (*[]RemoteUser, error) {
 	rows, err := db.Query("SELECT actor_id, inbox, shared_inbox FROM remotefollows f INNER JOIN remoteusers u ON f.remote_user_id = u.id WHERE collection_id = ?", c.ID)
 	if err != nil {
 		log.Error("Failed selecting from followers: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve followers."}
 	}
 	defer rows.Close()
 
 	followers := []RemoteUser{}
 	for rows.Next() {
 		f := RemoteUser{}
 		err = rows.Scan(&f.ActorID, &f.Inbox, &f.SharedInbox)
 		followers = append(followers, f)
 	}
 	return &followers, nil
 }
 
 // CanCollect returns whether or not the given user can add the given post to a
 // collection. This is true when a post is already owned by the user.
 // NOTE: this is currently only used to potentially add owned posts to a
 // collection. This has the SIDE EFFECT of also generating a slug for the post.
 // FIXME: make this side effect more explicit (or extract it)
 func (db *datastore) CanCollect(cpr *ClaimPostRequest, userID int64) bool {
 	var title, content string
 	var lang sql.NullString
 	err := db.QueryRow("SELECT title, content, language FROM posts WHERE id = ? AND owner_id = ?", cpr.ID, userID).Scan(&title, &content, &lang)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Failed on post CanCollect(%s, %d): %v", cpr.ID, userID, err)
 		return false
 	}
 
 	// Since we have the post content and the post is collectable, generate the
 	// post's slug now.
 	cpr.Slug = getSlugFromPost(title, content, lang.String)
 
 	return true
 }
 
 func (db *datastore) AttemptClaim(p *ClaimPostRequest, query string, params []interface{}, slugIdx int) (sql.Result, error) {
 	qRes, err := db.Exec(query, params...)
 	if err != nil {
 		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 			if mysqlErr.Number == mySQLErrDuplicateKey && slugIdx > -1 {
 				s := id.GenSafeUniqueSlug(p.Slug)
 				if s == p.Slug {
 					// Sanity check to prevent infinite recursion
 					return qRes, fmt.Errorf("GenSafeUniqueSlug generated nothing unique: %s", s)
 				}
 				p.Slug = s
 				params[slugIdx] = p.Slug
 				return db.AttemptClaim(p, query, params, slugIdx)
 			}
 		}
 		return qRes, fmt.Errorf("attemptClaim: %s", err)
 	}
 	return qRes, nil
 }
 
 func (db *datastore) DispersePosts(userID int64, postIDs []string) (*[]ClaimPostResult, error) {
 	postClaimReqs := map[string]bool{}
 	res := []ClaimPostResult{}
 	for i := range postIDs {
 		postID := postIDs[i]
 
 		r := ClaimPostResult{Code: 0, ErrorMessage: ""}
 
 		// Perform post validation
 		if postID == "" {
 			r.ErrorMessage = "Missing post ID. "
 		}
 		if _, ok := postClaimReqs[postID]; ok {
 			r.Code = 429
 			r.ErrorMessage = "You've already tried anonymizing this post."
 			r.ID = postID
 			res = append(res, r)
 			continue
 		}
 		postClaimReqs[postID] = true
 
 		var err error
 		// Get full post information to return
 		var fullPost *PublicPost
 		fullPost, err = db.GetPost(postID, 0)
 		if err != nil {
 			if err, ok := err.(impart.HTTPError); ok {
 				r.Code = err.Status
 				r.ErrorMessage = err.Message
 				r.ID = postID
 				res = append(res, r)
 				continue
 			} else {
 				log.Error("Error getting post in dispersePosts: %v", err)
 			}
 		}
 		if fullPost.OwnerID.Int64 != userID {
 			r.Code = http.StatusConflict
 			r.ErrorMessage = "Post is already owned by someone else."
 			r.ID = postID
 			res = append(res, r)
 			continue
 		}
 
 		var qRes sql.Result
 		var query string
 		var params []interface{}
 		// Do AND owner_id = ? for sanity.
 		// This should've been caught and returned with a good error message
 		// just above.
 		query = "UPDATE posts SET collection_id = NULL WHERE id = ? AND owner_id = ?"
 		params = []interface{}{postID, userID}
 		qRes, err = db.Exec(query, params...)
 		if err != nil {
 			r.Code = http.StatusInternalServerError
 			r.ErrorMessage = "A glitch happened on our end."
 			r.ID = postID
 			res = append(res, r)
 			log.Error("dispersePosts (post %s): %v", postID, err)
 			continue
 		}
 
 		// Post was successfully dispersed
 		r.Code = http.StatusOK
 		r.Post = fullPost
 
 		rowsAffected, _ := qRes.RowsAffected()
 		if rowsAffected == 0 {
 			// This was already claimed, but return 200
 			r.Code = http.StatusOK
 		}
 		res = append(res, r)
 	}
 
 	return &res, nil
 }
 
 func (db *datastore) ClaimPosts(userID int64, collAlias string, posts *[]ClaimPostRequest) (*[]ClaimPostResult, error) {
 	postClaimReqs := map[string]bool{}
 	res := []ClaimPostResult{}
 	postCollAlias := collAlias
 	for i := range *posts {
 		p := (*posts)[i]
 		if &p == nil {
 			continue
 		}
 
 		r := ClaimPostResult{Code: 0, ErrorMessage: ""}
 
 		// Perform post validation
 		if p.ID == "" {
 			r.ErrorMessage = "Missing post ID `id`. "
 		}
 		if _, ok := postClaimReqs[p.ID]; ok {
 			r.Code = 429
 			r.ErrorMessage = "You've already tried claiming this post."
 			r.ID = p.ID
 			res = append(res, r)
 			continue
 		}
 		postClaimReqs[p.ID] = true
 
 		canCollect := db.CanCollect(&p, userID)
 		if !canCollect && p.Token == "" {
 			// TODO: ensure post isn't owned by anyone else when a valid modify
 			// token is given.
 			r.ErrorMessage += "Missing post Edit Token `token`."
 		}
 		if r.ErrorMessage != "" {
 			// Post validate failed
 			r.Code = http.StatusBadRequest
 			r.ID = p.ID
 			res = append(res, r)
 			continue
 		}
 
 		var err error
 		var qRes sql.Result
 		var query string
 		var params []interface{}
 		var slugIdx int = -1
 		var coll *Collection
 		if collAlias == "" {
 			// Posts are being claimed at /posts/claim, not
 			// /collections/{alias}/collect, so use given individual collection
 			// to associate post with.
 			postCollAlias = p.CollectionAlias
 		}
 		if postCollAlias != "" {
 			// Associate this post with a collection
 			if p.CreateCollection {
 				// This is a new collection
 				// TODO: consider removing this. This seriously complicates this
 				// method and adds another (unnecessary?) logic path.
 				coll, err = db.CreateCollection(postCollAlias, "", userID)
 				if err != nil {
 					if err, ok := err.(impart.HTTPError); ok {
 						r.Code = err.Status
 						r.ErrorMessage = err.Message
 					} else {
 						r.Code = http.StatusInternalServerError
 						r.ErrorMessage = "Unknown error occurred creating collection"
 					}
 					r.ID = p.ID
 					res = append(res, r)
 					continue
 				}
 			} else {
 				// Attempt to add to existing collection
 				coll, err = db.GetCollection(postCollAlias)
 				if err != nil {
 					if err, ok := err.(impart.HTTPError); ok {
 						if err.Status == http.StatusNotFound {
 							// Show obfuscated "forbidden" response, as if attempting to add to an
 							// unowned blog.
 							r.Code = ErrForbiddenCollection.Status
 							r.ErrorMessage = ErrForbiddenCollection.Message
 						} else {
 							r.Code = err.Status
 							r.ErrorMessage = err.Message
 						}
 					} else {
 						r.Code = http.StatusInternalServerError
 						r.ErrorMessage = "Unknown error occurred claiming post with collection"
 					}
 					r.ID = p.ID
 					res = append(res, r)
 					continue
 				}
 				if coll.OwnerID != userID {
 					r.Code = ErrForbiddenCollection.Status
 					r.ErrorMessage = ErrForbiddenCollection.Message
 					r.ID = p.ID
 					res = append(res, r)
 					continue
 				}
 			}
 			if p.Slug == "" {
 				p.Slug = p.ID
 			}
 			if canCollect {
 				// User already owns this post, so just add it to the given
 				// collection.
 				query = "UPDATE posts SET collection_id = ?, slug = ? WHERE id = ? AND owner_id = ?"
 				params = []interface{}{coll.ID, p.Slug, p.ID, userID}
 				slugIdx = 1
 			} else {
 				query = "UPDATE posts SET owner_id = ?, collection_id = ?, slug = ? WHERE id = ? AND modify_token = ? AND owner_id IS NULL"
 				params = []interface{}{userID, coll.ID, p.Slug, p.ID, p.Token}
 				slugIdx = 2
 			}
 		} else {
 			query = "UPDATE posts SET owner_id = ? WHERE id = ? AND modify_token = ? AND owner_id IS NULL"
 			params = []interface{}{userID, p.ID, p.Token}
 		}
 		qRes, err = db.AttemptClaim(&p, query, params, slugIdx)
 		if err != nil {
 			r.Code = http.StatusInternalServerError
 			r.ErrorMessage = "An unknown error occurred."
 			r.ID = p.ID
 			res = append(res, r)
 			log.Error("claimPosts (post %s): %v", p.ID, err)
 			continue
 		}
 
 		// Get full post information to return
 		var fullPost *PublicPost
 		if p.Token != "" {
 			fullPost, err = db.GetEditablePost(p.ID, p.Token)
 		} else {
 			fullPost, err = db.GetPost(p.ID, 0)
 		}
 		if err != nil {
 			if err, ok := err.(impart.HTTPError); ok {
 				r.Code = err.Status
 				r.ErrorMessage = err.Message
 				r.ID = p.ID
 				res = append(res, r)
 				continue
 			}
 		}
 		if fullPost.OwnerID.Int64 != userID {
 			r.Code = http.StatusConflict
 			r.ErrorMessage = "Post is already owned by someone else."
 			r.ID = p.ID
 			res = append(res, r)
 			continue
 		}
 
 		// Post was successfully claimed
 		r.Code = http.StatusOK
 		r.Post = fullPost
 		if coll != nil {
 			r.Post.Collection = &CollectionObj{Collection: *coll}
 		}
 
 		rowsAffected, _ := qRes.RowsAffected()
 		if rowsAffected == 0 {
 			// This was already claimed, but return 200
 			r.Code = http.StatusOK
 		}
 		res = append(res, r)
 	}
 
 	return &res, nil
 }
 
 func (db *datastore) UpdatePostPinState(pinned bool, postID string, collID, ownerID, pos int64) error {
 	if pos <= 0 || pos > 20 {
 		pos = db.GetLastPinnedPostPos(collID) + 1
 		if pos == -1 {
 			pos = 1
 		}
 	}
 	var err error
 	if pinned {
 		_, err = db.Exec("UPDATE posts SET pinned_position = ? WHERE id = ?", pos, postID)
 	} else {
 		_, err = db.Exec("UPDATE posts SET pinned_position = NULL WHERE id = ?", postID)
 	}
 	if err != nil {
 		log.Error("Unable to update pinned post: %v", err)
 		return err
 	}
 	return nil
 }
 
 func (db *datastore) GetLastPinnedPostPos(collID int64) int64 {
 	var lastPos sql.NullInt64
 	err := db.QueryRow("SELECT MAX(pinned_position) FROM posts WHERE collection_id = ? AND pinned_position IS NOT NULL", collID).Scan(&lastPos)
 	switch {
 	case err == sql.ErrNoRows:
 		return -1
 	case err != nil:
 		log.Error("Failed selecting from posts: %v", err)
 		return -1
 	}
 	if !lastPos.Valid {
 		return -1
 	}
 	return lastPos.Int64
 }
 
 func (db *datastore) GetPinnedPosts(coll *CollectionObj) (*[]PublicPost, error) {
 	rows, err := db.Query("SELECT id, slug, title, LEFT(content, 80), pinned_position FROM posts WHERE collection_id = ? AND pinned_position IS NOT NULL ORDER BY pinned_position ASC", coll.ID)
 	if err != nil {
 		log.Error("Failed selecting pinned posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve pinned posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := &Post{}
 		err = rows.Scan(&p.ID, &p.Slug, &p.Title, &p.Content, &p.PinnedPosition)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 
 		pp := p.processPost()
 		pp.Collection = coll
 		posts = append(posts, pp)
 	}
 	return &posts, nil
 }
 
 func (db *datastore) GetCollections(u *User) (*[]Collection, error) {
 	rows, err := db.Query("SELECT id, alias, title, description, privacy, view_count FROM collections WHERE owner_id = ? ORDER BY id ASC", u.ID)
 	if err != nil {
 		log.Error("Failed selecting from collections: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user collections."}
 	}
 	defer rows.Close()
 
 	colls := []Collection{}
 	for rows.Next() {
 		c := Collection{}
 		err = rows.Scan(&c.ID, &c.Alias, &c.Title, &c.Description, &c.Visibility, &c.Views)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		c.URL = c.CanonicalURL()
 		c.Public = c.IsPublic()
 
 		colls = append(colls, c)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &colls, nil
 }
 
 func (db *datastore) GetPublishableCollections(u *User) (*[]Collection, error) {
 	c, err := db.GetCollections(u)
 	if err != nil {
 		return nil, err
 	}
 
 	if len(*c) == 0 {
 		return nil, impart.HTTPError{http.StatusInternalServerError, "You don't seem to have any blogs; they might've moved to another account. Try logging out and logging into your other account."}
 	}
 	return c, nil
 }
 
 func (db *datastore) GetMeStats(u *User) userMeStats {
 	s := userMeStats{}
 
 	// User counts
 	colls, _ := db.GetUserCollectionCount(u.ID)
 	s.TotalCollections = colls
 
 	var articles, collPosts uint64
 	err := db.QueryRow("SELECT COUNT(*) FROM posts WHERE owner_id = ? AND collection_id IS NULL", u.ID).Scan(&articles)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Couldn't get articles count for user %d: %v", u.ID, err)
 	}
 	s.TotalArticles = articles
 
 	err = db.QueryRow("SELECT COUNT(*) FROM posts WHERE owner_id = ? AND collection_id IS NOT NULL", u.ID).Scan(&collPosts)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Couldn't get coll posts count for user %d: %v", u.ID, err)
 	}
 	s.CollectionPosts = collPosts
 
 	return s
 }
 
 func (db *datastore) GetTopPosts(u *User, alias string) (*[]PublicPost, error) {
 	params := []interface{}{u.ID}
 	where := ""
 	if alias != "" {
 		where = " AND alias = ?"
 		params = append(params, alias)
 	}
 	rows, err := db.Query("SELECT p.id, p.slug, p.view_count, p.title, c.alias, c.title, c.description, c.view_count FROM posts p LEFT JOIN collections c ON p.collection_id = c.id WHERE p.owner_id = ?"+where+" ORDER BY p.view_count DESC, created DESC LIMIT 25", params...)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user top posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	var gotErr bool
 	for rows.Next() {
 		p := Post{}
 		c := Collection{}
 		var alias, title, description sql.NullString
 		var views sql.NullInt64
 		err = rows.Scan(&p.ID, &p.Slug, &p.ViewCount, &p.Title, &alias, &title, &description, &views)
 		if err != nil {
 			log.Error("Failed scanning User.getPosts() row: %v", err)
 			gotErr = true
 			break
 		}
 		p.extractData()
 		pubPost := p.processPost()
 
 		if alias.Valid && alias.String != "" {
 			c.Alias = alias.String
 			c.Title = title.String
 			c.Description = description.String
 			c.Views = views.Int64
 			pubPost.Collection = &CollectionObj{Collection: c}
 		}
 
 		posts = append(posts, pubPost)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	if gotErr && len(posts) == 0 {
 		// There were a lot of errors
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Unable to get data."}
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetAnonymousPosts(u *User) (*[]PublicPost, error) {
 	rows, err := db.Query("SELECT id, view_count, title, created, updated, content FROM posts WHERE owner_id = ? AND collection_id IS NULL ORDER BY created DESC", u.ID)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user anonymous posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	for rows.Next() {
 		p := Post{}
 		err = rows.Scan(&p.ID, &p.ViewCount, &p.Title, &p.Created, &p.Updated, &p.Content)
 		if err != nil {
 			log.Error("Failed scanning row: %v", err)
 			break
 		}
 		p.extractData()
 
 		posts = append(posts, p.processPost())
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	return &posts, nil
 }
 
 func (db *datastore) GetUserPosts(u *User) (*[]PublicPost, error) {
 	rows, err := db.Query("SELECT p.id, p.slug, p.view_count, p.title, p.created, p.updated, p.content, p.text_appearance, p.language, p.rtl, c.alias, c.title, c.description, c.view_count FROM posts p LEFT JOIN collections c ON collection_id = c.id WHERE p.owner_id = ? ORDER BY created ASC", u.ID)
 	if err != nil {
 		log.Error("Failed selecting from posts: %v", err)
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve user posts."}
 	}
 	defer rows.Close()
 
 	posts := []PublicPost{}
 	var gotErr bool
 	for rows.Next() {
 		p := Post{}
 		c := Collection{}
 		var alias, title, description sql.NullString
 		var views sql.NullInt64
 		err = rows.Scan(&p.ID, &p.Slug, &p.ViewCount, &p.Title, &p.Created, &p.Updated, &p.Content, &p.Font, &p.Language, &p.RTL, &alias, &title, &description, &views)
 		if err != nil {
 			log.Error("Failed scanning User.getPosts() row: %v", err)
 			gotErr = true
 			break
 		}
 		p.extractData()
 		pubPost := p.processPost()
 
 		if alias.Valid && alias.String != "" {
 			c.Alias = alias.String
 			c.Title = title.String
 			c.Description = description.String
 			c.Views = views.Int64
 			pubPost.Collection = &CollectionObj{Collection: c}
 		}
 
 		posts = append(posts, pubPost)
 	}
 	err = rows.Err()
 	if err != nil {
 		log.Error("Error after Next() on rows: %v", err)
 	}
 
 	if gotErr && len(posts) == 0 {
 		// There were a lot of errors
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Unable to get data."}
 	}
 
 	return &posts, nil
 }
 
 // ChangeSettings takes a User and applies the changes in the given
 // userSettings, MODIFYING THE USER with successful changes.
 func (db *datastore) ChangeSettings(app *app, u *User, s *userSettings) error {
 	var errPass error
 	q := query.NewUpdate()
 
 	// Update email if given
 	if s.Email != "" {
 		encEmail, err := data.Encrypt(app.keys.emailKey, s.Email)
 		if err != nil {
 			log.Error("Couldn't encrypt email %s: %s\n", s.Email, err)
 			return impart.HTTPError{http.StatusInternalServerError, "Unable to encrypt email address."}
 		}
 		q.SetBytes(encEmail, "email")
 
 		// Update the email if something goes awry updating the password
 		defer func() {
 			if errPass != nil {
 				db.UpdateEncryptedUserEmail(u.ID, encEmail)
 			}
 		}()
 		u.Email = zero.StringFrom(s.Email)
 	}
 
 	// Update username if given
 	var newUsername string
 	if s.Username != "" {
 		var ie *impart.HTTPError
 		newUsername, ie = getValidUsername(app, s.Username, u.Username)
 		if ie != nil {
 			// Username is invalid
 			return *ie
 		}
 		if !author.IsValidUsername(app.cfg, newUsername) {
 			// Ensure the username is syntactically correct.
 			return impart.HTTPError{http.StatusPreconditionFailed, "Username isn't valid."}
 		}
 
 		t, err := db.Begin()
 		if err != nil {
 			log.Error("Couldn't start username change transaction: %v", err)
 			return err
 		}
 
 		_, err = t.Exec("UPDATE users SET username = ? WHERE id = ?", newUsername, u.ID)
 		if err != nil {
 			t.Rollback()
 			if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 				if mysqlErr.Number == mySQLErrDuplicateKey {
 					return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 				}
 			}
 			log.Error("Unable to update users table: %v", err)
 			return ErrInternalGeneral
 		}
 
 		_, err = t.Exec("UPDATE collections SET alias = ? WHERE alias = ? AND owner_id = ?", newUsername, u.Username, u.ID)
 		if err != nil {
 			t.Rollback()
 			if mysqlErr, ok := err.(*mysql.MySQLError); ok {
 				if mysqlErr.Number == mySQLErrDuplicateKey {
 					return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 				}
 			}
 			log.Error("Unable to update collection: %v", err)
 			return ErrInternalGeneral
 		}
 
 		// Keep track of name changes for redirection
 		db.RemoveCollectionRedirect(t, newUsername)
 		_, err = t.Exec("UPDATE collectionredirects SET new_alias = ? WHERE new_alias = ?", newUsername, u.Username)
 		if err != nil {
 			log.Error("Unable to update collectionredirects: %v", err)
 		}
 		_, err = t.Exec("INSERT INTO collectionredirects (prev_alias, new_alias) VALUES (?, ?)", u.Username, newUsername)
 		if err != nil {
 			log.Error("Unable to add new collectionredirect: %v", err)
 		}
 
 		err = t.Commit()
 		if err != nil {
 			t.Rollback()
 			log.Error("Rolling back after Commit(): %v\n", err)
 			return err
 		}
 
 		u.Username = newUsername
 	}
 
 	// Update passphrase if given
 	if s.NewPass != "" {
 		// Check if user has already set a password
 		var err error
 		u.HasPass, err = db.IsUserPassSet(u.ID)
 		if err != nil {
 			errPass = impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data."}
 			return errPass
 		}
 
 		if u.HasPass {
 			// Check if currently-set password is correct
 			hashedPass := u.HashedPass
 			if len(hashedPass) == 0 {
 				authUser, err := db.GetUserForAuthByID(u.ID)
 				if err != nil {
 					errPass = err
 					return errPass
 				}
 				hashedPass = authUser.HashedPass
 			}
 			if !auth.Authenticated(hashedPass, []byte(s.OldPass)) {
 				errPass = impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 				return errPass
 			}
 		}
 		hashedPass, err := auth.HashPass([]byte(s.NewPass))
 		if err != nil {
 			errPass = impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 			return errPass
 		}
 		q.SetBytes(hashedPass, "password")
 	}
 
 	// WHERE values
 	q.Append(u.ID)
 
 	if q.Updates == "" {
 		if s.Username == "" {
 			return ErrPostNoUpdatableVals
 		}
 
 		// Nothing to update except username. That was successful, so return now.
 		return nil
 	}
 
 	res, err := db.Exec("UPDATE users SET "+q.Updates+" WHERE id = ?", q.Params...)
 	if err != nil {
 		log.Error("Unable to update collection: %v", err)
 		return err
 	}
 
 	rowsAffected, _ := res.RowsAffected()
 	if rowsAffected == 0 {
 		// Show the correct error message if nothing was updated
 		var dummy int
 		err := db.QueryRow("SELECT 1 FROM users WHERE id = ?", u.ID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return ErrUnauthorizedGeneral
 		case err != nil:
 			log.Error("Failed selecting from users: %v", err)
 		}
 		return nil
 	}
 
 	if s.NewPass != "" && !u.HasPass {
 		u.HasPass = true
 	}
 
 	return nil
 }
 
 func (db *datastore) ChangePassphrase(userID int64, sudo bool, curPass string, hashedPass []byte) error {
 	var dbPass []byte
 	err := db.QueryRow("SELECT password FROM users WHERE id = ?", userID).Scan(&dbPass)
 	switch {
 	case err == sql.ErrNoRows:
 		return ErrUserNotFound
 	case err != nil:
 		log.Error("Couldn't SELECT user password for change: %v", err)
 		return err
 	}
 
 	if !sudo && !auth.Authenticated(dbPass, []byte(curPass)) {
 		return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 	}
 
 	_, err = db.Exec("UPDATE users SET password = ? WHERE id = ?", hashedPass, userID)
 	if err != nil {
 		log.Error("Could not update passphrase: %v", err)
 		return err
 	}
 
 	return nil
 }
 
 func (db *datastore) RemoveCollectionRedirect(t *sql.Tx, alias string) error {
 	_, err := t.Exec("DELETE FROM collectionredirects WHERE prev_alias = ?", alias)
 	if err != nil {
 		log.Error("Unable to delete from collectionredirects: %v", err)
 		return err
 	}
 	return nil
 }
 
 func (db *datastore) GetCollectionRedirect(alias string) (new string) {
 	row := db.QueryRow("SELECT new_alias FROM collectionredirects WHERE prev_alias = ?", alias)
 	err := row.Scan(&new)
 	if err != nil && err != sql.ErrNoRows {
 		log.Error("Failed selecting from collectionredirects: %v", err)
 	}
 	return
 }
 
 func (db *datastore) DeleteCollection(alias string, userID int64) error {
 	c := &Collection{Alias: alias}
 	var username string
 
 	row := db.QueryRow("SELECT username FROM users WHERE id = ?", userID)
 	err := row.Scan(&username)
 	if err != nil {
 		return err
 	}
 
 	// Ensure user isn't deleting their main blog
 	if alias == username {
 		return impart.HTTPError{http.StatusForbidden, "You cannot currently delete your primary blog."}
 	}
 
 	row = db.QueryRow("SELECT id FROM collections WHERE alias = ? AND owner_id = ?", alias, userID)
 	err = row.Scan(&c.ID)
 	switch {
 	case err == sql.ErrNoRows:
 		return impart.HTTPError{http.StatusNotFound, "Collection doesn't exist or you're not allowed to delete it."}
 	case err != nil:
 		log.Error("Failed selecting from collections: %v", err)
 		return ErrInternalGeneral
 	}
 
 	t, err := db.Begin()
 	if err != nil {
 		return err
 	}
 
 	// Float all collection's posts
 	_, err = t.Exec("UPDATE posts SET collection_id = NULL WHERE collection_id = ? AND owner_id = ?", c.ID, userID)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	// Remove redirects to or from this collection
 	_, err = t.Exec("DELETE FROM collectionredirects WHERE prev_alias = ? OR new_alias = ?", alias, alias)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	// Remove any optional collection password
 	_, err = t.Exec("DELETE FROM collectionpasswords WHERE collection_id = ?", c.ID)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	// Finally, delete collection itself
 	_, err = t.Exec("DELETE FROM collections WHERE id = ?", c.ID)
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	err = t.Commit()
 	if err != nil {
 		t.Rollback()
 		return err
 	}
 
 	return nil
 }
 
 func (db *datastore) IsCollectionAttributeOn(id int64, attr string) bool {
 	var v string
 	err := db.QueryRow("SELECT value FROM collectionattributes WHERE collection_id = ? AND attribute = ?", id, attr).Scan(&v)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Couldn't SELECT value in isCollectionAttributeOn for attribute '%s': %v", attr, err)
 		return false
 	}
 	return v == "1"
 }
 
 func (db *datastore) CollectionHasAttribute(id int64, attr string) bool {
 	var dummy string
 	err := db.QueryRow("SELECT value FROM collectionattributes WHERE collection_id = ? AND attribute = ?", id, attr).Scan(&dummy)
 	switch {
 	case err == sql.ErrNoRows:
 		return false
 	case err != nil:
 		log.Error("Couldn't SELECT value in collectionHasAttribute for attribute '%s': %v", attr, err)
 		return false
 	}
 	return true
 }
 
 func (db *datastore) DeleteAccount(userID int64) (l *string, err error) {
 	debug := ""
 	l = &debug
 
 	t, err := db.Begin()
 	if err != nil {
 		stringLogln(l, "Unable to begin: %v", err)
 		return
 	}
 
 	// Get all collections
 	rows, err := db.Query("SELECT id, alias FROM collections WHERE owner_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to get collections: %v", err)
 		return
 	}
 	defer rows.Close()
 	colls := []Collection{}
 	var c Collection
 	for rows.Next() {
 		err = rows.Scan(&c.ID, &c.Alias)
 		if err != nil {
 			t.Rollback()
 			stringLogln(l, "Unable to scan collection cols: %v", err)
 			return
 		}
 		colls = append(colls, c)
 	}
 
 	var res sql.Result
 	for _, c := range colls {
 		// TODO: user deleteCollection() func
 		// Delete tokens
 		res, err = t.Exec("DELETE FROM collectionattributes WHERE collection_id = ?", c.ID)
 		if err != nil {
 			t.Rollback()
 			stringLogln(l, "Unable to delete attributes on %s: %v", c.Alias, err)
 			return
 		}
 		rs, _ := res.RowsAffected()
 		stringLogln(l, "Deleted %d for %s from collectionattributes", rs, c.Alias)
 
 		// Remove any optional collection password
 		res, err = t.Exec("DELETE FROM collectionpasswords WHERE collection_id = ?", c.ID)
 		if err != nil {
 			t.Rollback()
 			stringLogln(l, "Unable to delete passwords on %s: %v", c.Alias, err)
 			return
 		}
 		rs, _ = res.RowsAffected()
 		stringLogln(l, "Deleted %d for %s from collectionpasswords", rs, c.Alias)
 
 		// Remove redirects to this collection
 		res, err = t.Exec("DELETE FROM collectionredirects WHERE new_alias = ?", c.Alias)
 		if err != nil {
 			t.Rollback()
 			stringLogln(l, "Unable to delete redirects on %s: %v", c.Alias, err)
 			return
 		}
 		rs, _ = res.RowsAffected()
 		stringLogln(l, "Deleted %d for %s from collectionredirects", rs, c.Alias)
 	}
 
 	// Delete collections
 	res, err = t.Exec("DELETE FROM collections WHERE owner_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to delete collections: %v", err)
 		return
 	}
 	rs, _ := res.RowsAffected()
 	stringLogln(l, "Deleted %d from collections", rs)
 
 	// Delete tokens
 	res, err = t.Exec("DELETE FROM accesstokens WHERE user_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to delete access tokens: %v", err)
 		return
 	}
 	rs, _ = res.RowsAffected()
 	stringLogln(l, "Deleted %d from accesstokens", rs)
 
 	// Delete posts
 	res, err = t.Exec("DELETE FROM posts WHERE owner_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to delete posts: %v", err)
 		return
 	}
 	rs, _ = res.RowsAffected()
 	stringLogln(l, "Deleted %d from posts", rs)
 
 	res, err = t.Exec("DELETE FROM userattributes WHERE user_id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to delete attributes: %v", err)
 		return
 	}
 	rs, _ = res.RowsAffected()
 	stringLogln(l, "Deleted %d from userattributes", rs)
 
 	res, err = t.Exec("DELETE FROM users WHERE id = ?", userID)
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to delete user: %v", err)
 		return
 	}
 	rs, _ = res.RowsAffected()
 	stringLogln(l, "Deleted %d from users", rs)
 
 	err = t.Commit()
 	if err != nil {
 		t.Rollback()
 		stringLogln(l, "Unable to commit: %v", err)
 		return
 	}
 
 	return
 }
 
 func (db *datastore) GetAPActorKeys(collectionID int64) ([]byte, []byte) {
 	var pub, priv []byte
 	err := db.QueryRow("SELECT public_key, private_key FROM collectionkeys WHERE collection_id = ?", collectionID).Scan(&pub, &priv)
 	switch {
 	case err == sql.ErrNoRows:
 		// Generate keys
 		pub, priv = activitypub.GenerateKeys()
 		_, err = db.Exec("INSERT INTO collectionkeys (collection_id, public_key, private_key) VALUES (?, ?, ?)", collectionID, pub, priv)
 		if err != nil {
 			log.Error("Unable to INSERT new activitypub keypair: %v", err)
 			return nil, nil
 		}
 	case err != nil:
 		log.Error("Couldn't SELECT collectionkeys: %v", err)
 		return nil, nil
 	}
 
 	return pub, priv
 }
 
 func (db *datastore) GetDynamicContent(id string) (string, *time.Time, error) {
 	var c string
 	var u *time.Time
 	err := db.QueryRow("SELECT content, updated FROM appcontent WHERE id = ?", id).Scan(&c, &u)
 	switch {
 	case err == sql.ErrNoRows:
 		return "", nil, nil
 	case err != nil:
 		log.Error("Couldn't SELECT FROM appcontent for id '%s': %v", id, err)
 		return "", nil, err
 	}
 	return c, u, nil
 }
 
 func (db *datastore) UpdateDynamicContent(id, content string) error {
 	_, err := db.Exec("INSERT INTO appcontent (id, content, updated) VALUES (?, ?, NOW()) ON DUPLICATE KEY UPDATE content = ?, updated = NOW()", id, content, content)
 	if err != nil {
 		log.Error("Unable to INSERT appcontent for '%s': %v", id, err)
 	}
 	return err
 }
 
 func stringLogln(log *string, s string, v ...interface{}) {
 	*log += fmt.Sprintf(s+"\n", v...)
 }
 
 func handleFailedPostInsert(err error) error {
 	log.Error("Couldn't insert into posts: %v", err)
 	return err
 }
diff --git a/templates/collection-post.tmpl b/templates/collection-post.tmpl
index 6f34863..b3e04cc 100644
--- a/templates/collection-post.tmpl
+++ b/templates/collection-post.tmpl
@@ -1,134 +1,147 @@
 {{define "post"}}<!DOCTYPE HTML>
 <html {{if .Language.Valid}}lang="{{.Language.String}}"{{end}} dir="{{.Direction}}">
 	<head prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article#">
 		<meta charset="utf-8">
 
 		<title>{{.PlainDisplayTitle}} &mdash; {{.Collection.DisplayTitle}}</title>
 		
 		<link rel="stylesheet" type="text/css" href="/css/write.css" />
 		<link rel="shortcut icon" href="/favicon.ico" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<link rel="canonical" href="{{.CanonicalURL}}" />
 		<meta name="generator" content="Write Freely">
 		<meta name="title" content="{{.PlainDisplayTitle}} &mdash; {{if .Collection.Title}}{{.Collection.Title}}{{else}}{{.Collection.Alias}}{{end}}">
 		<meta name="description" content="{{.Summary}}">
 		{{if gt .Views 1}}<meta name="twitter:label1" value="Views">
 		<meta name="twitter:data1" value="{{largeNumFmt .Views}}">{{end}}
 		<meta name="author" content="{{.Collection.Title}}" />
 		<meta itemprop="description" content="{{.Summary}}">
 		<meta itemprop="datePublished" content="{{.CreatedDate}}" />
 		<meta name="twitter:card" content="summary">
 		<meta name="twitter:description" content="{{.Summary}}">
 		<meta name="twitter:title" content="{{.PlainDisplayTitle}} &mdash; {{if .Collection.Title}}{{.Collection.Title}}{{else}}{{.Collection.Alias}}{{end}}">
 		{{if gt (len .Images) 0}}<meta name="twitter:image" content="{{index .Images 0}}">{{else}}<meta name="twitter:image" content="{{.Collection.AvatarURL}}">{{end}}
 		<meta property="og:title" content="{{.PlainDisplayTitle}}" />
 		<meta property="og:description" content="{{.Summary}}" />
 		<meta property="og:site_name" content="{{.Collection.DisplayTitle}}" />
 		<meta property="og:type" content="article" />
 		<meta property="og:url" content="{{.CanonicalURL}}" />
 		<meta property="og:updated_time" content="{{.Created8601}}" />
 		{{range .Images}}<meta property="og:image" content="{{.}}" />{{else}}<meta property="og:image" content="{{.Collection.AvatarURL}}">{{end}}
 		<meta property="article:published_time" content="{{.Created8601}}">
 		{{if .Collection.StyleSheet}}<style type="text/css">{{.Collection.StyleSheetDisplay}}</style>{{end}}
 		{{if .Collection.RenderMathJax}}
 		<script type="text/x-mathjax-config">
 		  MathJax.Hub.Config({
 			extensions: ["tex2jax.js"],
 			jax: ["input/TeX", "output/HTML-CSS"],
 			tex2jax: {
 			  inlineMath: [ ['$','$'], ["\\(","\\)"] ],
 			  displayMath: [ ['$$','$$'], ["\\[","\\]"] ],
 			  processEscapes: true
 			},
 			"HTML-CSS": { fonts: ["TeX"] }
 		  });
 		</script>
 		<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js?config=TeX-MML-AM_CHTML" async></script>{{end}}
 
+
+		{{if .Collection.CodeHighlight}}
+		<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/styles/atom-one-light.min.css" />
+		<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/highlight.min.js"></script>
+		<script>
+		  addEventListener('load', function () {
+		    var x = document.querySelectorAll("code[class^='language-']");
+		    for (i=0; i<x.length; i++) {
+		      hljs.highlightBlock(x[i]);
+		    }});
+		</script>
+		{{end}}
+
 	</head>
 	<body id="post">
 		
 		<div id="overlay"></div>
 
 		<header>
 		<h1 dir="{{.Direction}}" id="blog-title"><a rel="author" href="{{if .IsTopLevel}}/{{else}}/{{.Collection.Alias}}/{{end}}" class="h-card p-author">{{.Collection.DisplayTitle}}</a></h1>
 			<nav>
 				{{if .PinnedPosts}}
 				{{range .PinnedPosts}}<a class="pinned{{if eq .Slug.String $.Slug.String}} selected{{end}}" href="{{if not $.SingleUser}}/{{$.Collection.Alias}}/{{.Slug.String}}{{else}}{{.CanonicalURL}}{{end}}">{{.PlainDisplayTitle}}</a>{{end}}
 				{{end}}
 				{{ if .IsOwner }}<span class="views" dir="ltr"><strong>{{largeNumFmt .Views}}</strong> {{pluralize "view" "views" .Views}}</span>
 				<a class="xtra-feature" href="/{{if not .SingleUser}}{{.Collection.Alias}}/{{end}}{{.Slug.String}}/edit" dir="{{.Direction}}">Edit</a>
 				{{if .IsPinned}}<a class="xtra-feature unpin" href="/{{.Collection.Alias}}/{{.Slug.String}}/unpin" dir="{{.Direction}}" onclick="unpinPost(event, '{{.ID}}')">Unpin</a>{{end}}
 				{{ end }}
 			</nav>
 		</header>
 		
 		<article id="post-body" class="{{.Font}} h-entry">{{if .IsScheduled}}<p class="badge">Scheduled</p>{{end}}{{if .Title.String}}<h2 id="title" class="p-name">{{.FormattedDisplayTitle}}</h2>{{end}}<div class="e-content">{{.HTMLContent}}</div></article>
 
 		{{ if .Collection.ShowFooterBranding }}
 		<footer dir="ltr"><hr><nav><p style="font-size: 0.9em">{{localhtml "published with write.as" .Language.String}}</p></nav></footer>
 		{{ end }}
 	</body>
 	
 	{{if .Collection.CanShowScript}}
 		{{range .Collection.ExternalScripts}}<script type="text/javascript" src="{{.}}" async></script>{{end}}
 		{{if .Collection.Script}}<script type="text/javascript">{{.Collection.ScriptDisplay}}</script>{{end}}
 	{{end}}
 	<script type="text/javascript">
 
 var pinning = false;
 function unpinPost(e, postID) {
 	e.preventDefault();
 	if (pinning) {
 		return;
 	}
 	pinning = true;
 
 	var $header = document.getElementsByTagName('header')[0];
 	var callback = function() {
 		// Hide current page
 		var $pinnedNavLink = $header.getElementsByTagName('nav')[0].querySelector('.pinned.selected');
 		$pinnedNavLink.style.display = 'none';
 	};
 
 	var $pinBtn = $header.getElementsByClassName('unpin')[0];
 	$pinBtn.innerHTML = '...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/collections/{{.Collection.Alias}}/unpin";
 	var params = [ { "id": postID } ];
 	http.open("POST", url, true);
 	http.setRequestHeader("Content-type", "application/json");
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			pinning = false;
 			if (http.status == 200) {
 				callback();
 				$pinBtn.style.display = 'none';
 				$pinBtn.innerHTML = 'Pin';
 			} else if (http.status == 409) {
 				$pinBtn.innerHTML = 'Unpin';
 			} else {
 				$pinBtn.innerHTML = 'Unpin';
 				alert("Failed to unpin." + (http.status>=500?" Please try again.":""));
 			}
 		}
 	}
 	http.send(JSON.stringify(params));
 };
 
 	try { // Fonts
 	  WebFontConfig = {
 		custom: { families: [ 'Lora:400,700:latin', 'Open+Sans:400,700:latin' ], urls: [ '/css/fonts.css' ] }
 	  };
 	  (function() {
 		var wf = document.createElement('script');
 		wf.src = '/js/webfont.js';
 		wf.type = 'text/javascript';
 		wf.async = 'true';
 		var s = document.getElementsByTagName('script')[0];
 		s.parentNode.insertBefore(wf, s);
 	  })();
 	} catch (e) { /* ¯\_(ツ)_/¯ */ }
 	</script>
 </html>{{end}}
diff --git a/templates/collection-tags.tmpl b/templates/collection-tags.tmpl
index 021febc..4c2a126 100644
--- a/templates/collection-tags.tmpl
+++ b/templates/collection-tags.tmpl
@@ -1,200 +1,213 @@
 {{define "collection-tags"}}<!DOCTYPE HTML>
 <html>
 	<head prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article#">
 		<meta charset="utf-8">
 
 		<title>{{.Tag}} &mdash; {{.Collection.DisplayTitle}}</title>
 		
 		<link rel="stylesheet" type="text/css" href="{{if .IsCustomDomain}}https://files.writeas.org{{end}}/css/write.css" />
 		<link rel="shortcut icon" href="{{ if .Collection.ShowFooterBranding }}{{if .IsCustomDomain}}https://files.writeas.org{{end}}/favicon.ico{{ else }}/none.ico{{ end }}" />
 		{{if not .Collection.IsPrivate}}<link rel="alternate" type="application/rss+xml" title="{{.Tag}} posts on {{.DisplayTitle}}" href="{{.CanonicalURL}}tag:{{.Tag}}/feed/" />{{end}}
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<link rel="canonical" href="{{.CanonicalURL}}tag:{{.Tag | tolower}}" />
 		<meta name="generator" content="Write.as">
 		<meta name="title" content="{{.Tag}} &mdash; {{.Collection.DisplayTitle}}">
 		<meta name="description" content="{{.Tag}} posts on {{.Collection.DisplayTitle}}">
 		<meta name="application-name" content="Write.as">
 		<meta name="application-url" content="https://write.as">
 		{{if gt .Views 1}}<meta name="twitter:label1" value="Views">
 		<meta name="twitter:data1" value="{{largeNumFmt .Views}}">{{end}}
 		<meta itemprop="name" content="{{.Collection.DisplayTitle}}">
 		<meta itemprop="description" content="{{.Tag}} posts on {{.Collection.DisplayTitle}}">
 		<meta name="twitter:card" content="summary">
 		<meta name="twitter:site" content="@writeas__">
 		<meta name="twitter:description" content="{{.Tag}} posts on {{.Collection.DisplayTitle}}">
 		<meta name="twitter:title" content="{{.Tag}} &mdash; {{.Collection.DisplayTitle}}">
 		<meta name="twitter:image" content="{{.Collection.AvatarURL}}">
 		<meta property="og:title" content="{{.Tag}} &mdash; {{.Collection.DisplayTitle}}" />
 		<meta property="og:site_name" content="{{.DisplayTitle}}" />
 		<meta property="og:type" content="article" />
 		<meta property="og:url" content="{{.CanonicalURL}}tag:{{.Tag}}" />
 		<meta property="og:image" content="{{.Collection.AvatarURL}}">
 		{{if .Collection.StyleSheet}}<style type="text/css">{{.Collection.StyleSheetDisplay}}</style>{{end}}
 		{{if .Collection.RenderMathJax}}
 		<script type="text/x-mathjax-config">
 		  MathJax.Hub.Config({
 			extensions: ["tex2jax.js"],
 			jax: ["input/TeX", "output/HTML-CSS"],
 			tex2jax: {
 			  inlineMath: [ ['$','$'], ["\\(","\\)"] ],
 			  displayMath: [ ['$$','$$'], ["\\[","\\]"] ],
 			  processEscapes: true
 			},
 			"HTML-CSS": { fonts: ["TeX"] }
 		  });
 		</script>
 		<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js?config=TeX-MML-AM_CHTML" async></script>{{end}}
 
+		{{if .CodeHighlight}}
+		<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/styles/atom-one-light.min.css" />
+		<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/highlight.min.js"></script>
+		<script>
+		  addEventListener('load', function () {
+		    var x = document.querySelectorAll("code[class^='language-']");
+		    for (i=0; i<x.length; i++) {
+		      hljs.highlightBlock(x[i]);
+		    }});
+		</script>
+		{{end}}
+
+
 	</head>
 	<body id="subpage">
 		
 		<div id="overlay"></div>
 
 		<header>
 		<h1 dir="{{.Direction}}" id="blog-title"><a href="{{if .IsTopLevel}}/{{else}}/{{.Collection.Alias}}/{{end}}" class="h-card p-author">{{.Collection.DisplayTitle}}</a></h1>
 			<nav>
 				{{if .PinnedPosts}}
 				{{range .PinnedPosts}}<a class="pinned" href="{{if not $.SingleUser}}/{{$.Collection.Alias}}/{{.Slug.String}}{{else}}{{.CanonicalURL}}{{end}}">{{.DisplayTitle}}</a>{{end}}
 				{{end}}
 			</nav>
 		</header>
 		
 		{{if .Posts}}<section id="wrapper" itemscope itemtype="http://schema.org/Blog">{{else}}<div id="wrapper">{{end}}
 			<h1>{{.Tag}}</h1>
 			{{template "posts" .}}
 		{{if .Posts}}</section>{{else}}</div>{{end}}
 
 		{{ if .Collection.ShowFooterBranding }}
 		<footer dir="ltr">
 			<hr>
 			<nav>
 				<p style="font-size: 0.9em"><a class="home pubd" href="/">{{.SiteName}}</a> &middot; powered by <a style="margin-left:0" href="https://writefreely.org">write freely</a></p>
 			</nav>
 		</footer>
 		{{ end }}
 	</body>
 	
 	{{if .CanShowScript}}
 		{{range .ExternalScripts}}<script type="text/javascript" src="{{.}}" async></script>{{end}}
 		{{if .Collection.Script}}<script type="text/javascript">{{.ScriptDisplay}}</script>{{end}}
 	{{end}}
 	{{if .IsOwner}}
 	<script src="/js/h.js"></script>
 	<script src="/js/postactions.js"></script>
 	{{end}}
 	<script type="text/javascript">
 {{if .IsOwner}}
 var deleting = false;
 function delPost(e, id, owned) {
 	e.preventDefault();
 	if (deleting) {
 		return;
 	}
 
 	// TODO: UNDO!
 	if (window.confirm('Are you sure you want to delete this post?')) {
 		// AJAX
 		deletePost(id, "", function() {
 			// Remove post from list
 			var $postEl = document.getElementById('post-' + id);
 			$postEl.parentNode.removeChild($postEl);
 			// TODO: add next post from this collection at the bottom
 		});
 	}
 }
 
 var deletePost = function(postID, token, callback) {
 	deleting = true;
 
 	var $delBtn = document.getElementById('post-' + postID).getElementsByClassName('delete action')[0];
 	$delBtn.innerHTML = '...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/posts/" + postID;
 	http.open("DELETE", url, true);
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			deleting = false;
 			if (http.status == 204) {
 				callback();
 			} else if (http.status == 409) {
 				$delBtn.innerHTML = 'delete';
 				alert("Post is synced to another account. Delete the post from that account instead.");
 				// TODO: show "remove" button instead of "delete" now
 				// Persist that state.
 				// Have it remove the post locally only.
 			} else {
 				$delBtn.innerHTML = 'delete';
 				alert("Failed to delete." + (http.status>=500?" Please try again.":""));
 			}
 		}
 	}
 	http.send();
 };
 
 var pinning = false;
 function pinPost(e, postID, slug, title) {
 	e.preventDefault();
 	if (pinning) {
 		return;
 	}
 	pinning = true;
 
 	var callback = function() {
 		// Visibly remove post from collection
 		var $postEl = document.getElementById('post-' + postID);
 		$postEl.parentNode.removeChild($postEl);
 		var $header = document.getElementsByTagName('header')[0];
 		var $pinnedNavs = $header.getElementsByTagName('nav');
 		// Add link to nav
 		var link = '<a class="pinned" href="/{{.Alias}}/'+slug+'">'+title+'</a>';
 		if ($pinnedNavs.length == 0) {
 			$header.insertAdjacentHTML("beforeend", '<nav>'+link+'</nav>');
 		} else {
 			$pinnedNavs[0].insertAdjacentHTML("beforeend", link);
 		}
 	};
 
 	var $pinBtn = document.getElementById('post-' + postID).getElementsByClassName('pin action')[0];
 	$pinBtn.innerHTML = '...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/collections/{{.Alias}}/pin";
 	var params = [ { "id": postID } ];
 	http.open("POST", url, true);
 	http.setRequestHeader("Content-type", "application/json");
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			pinning = false;
 			if (http.status == 200) {
 				callback();
 			} else if (http.status == 409) {
 				$pinBtn.innerHTML = 'pin';
 				alert("Post is synced to another account. Delete the post from that account instead.");
 				// TODO: show "remove" button instead of "delete" now
 				// Persist that state.
 				// Have it remove the post locally only.
 			} else {
 				$pinBtn.innerHTML = 'pin';
 				alert("Failed to pin." + (http.status>=500?" Please try again.":""));
 			}
 		}
 	}
 	http.send(JSON.stringify(params));
 };
 {{end}}
 	try { // Fonts
 	  WebFontConfig = {
 		custom: { families: [ 'Lora:400,700:latin', 'Open+Sans:400,700:latin' ], urls: [ '{{if .IsCustomDomain}}https://files.writeas.org{{end}}/css/fonts.css' ] }
 	  };
 	  (function() {
 		var wf = document.createElement('script');
 		wf.src = '{{if .IsCustomDomain}}https://files.writeas.org{{end}}/js/webfont.js';
 		wf.type = 'text/javascript';
 		wf.async = 'true';
 		var s = document.getElementsByTagName('script')[0];
 		s.parentNode.insertBefore(wf, s);
 	  })();
 	} catch (e) { /* ¯\_(ツ)_/¯ */ }
 	</script>
 </html>{{end}}
diff --git a/templates/collection.tmpl b/templates/collection.tmpl
index ef2401d..a3fe8f6 100644
--- a/templates/collection.tmpl
+++ b/templates/collection.tmpl
@@ -1,235 +1,247 @@
 {{define "collection"}}<!DOCTYPE HTML>
 <html {{if .Language}}lang="{{.Language}}"{{end}} dir="{{.Direction}}">
 	<head>
 		<meta charset="utf-8">
 
 		<title>{{.DisplayTitle}}{{if not .SingleUser}} &mdash; {{.SiteName}}{{end}}</title>
 		
 		<link rel="stylesheet" type="text/css" href="/css/write.css" />
 		<link rel="shortcut icon" href="/favicon.ico" />
 		<link rel="canonical" href="{{.CanonicalURL}}">
 		{{if gt .CurrentPage 1}}<link rel="prev" href="{{.PrevPageURL .Prefix .CurrentPage .IsTopLevel}}">{{end}}
 		{{if lt .CurrentPage .TotalPages}}<link rel="next" href="{{.NextPageURL .Prefix .CurrentPage .IsTopLevel}}">{{end}}
 		{{if not .IsPrivate}}<link rel="alternate" type="application/rss+xml" title="{{.DisplayTitle}} &raquo; Feed" href="{{.CanonicalURL}}feed/" />{{end}}
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 
 		<meta name="generator" content="Write Freely">
 		<meta name="description" content="{{.Description}}">
 		<meta itemprop="name" content="{{.DisplayTitle}}">
 		<meta itemprop="description" content="{{.Description}}">
 		<meta name="twitter:card" content="summary">
 		<meta name="twitter:title" content="{{.DisplayTitle}}">
 		<meta name="twitter:image" content="{{.AvatarURL}}">
 		<meta name="twitter:description" content="{{.Description}}">
 		<meta property="og:title" content="{{.DisplayTitle}}" />
 		<meta property="og:site_name" content="{{.DisplayTitle}}" />
 		<meta property="og:type" content="article" />
 		<meta property="og:url" content="{{.CanonicalURL}}" />
 		<meta property="og:description" content="{{.Description}}" />
 		<meta property="og:image" content="{{.AvatarURL}}">
 		{{if .StyleSheet}}<style type="text/css">{{.StyleSheetDisplay}}</style>{{end}}
 		{{if .RenderMathJax}}
 		<script type="text/x-mathjax-config">
 		  MathJax.Hub.Config({
 			extensions: ["tex2jax.js"],
 			jax: ["input/TeX", "output/HTML-CSS"],
 			tex2jax: {
 			  inlineMath: [ ['$','$'], ["\\(","\\)"] ],
 			  displayMath: [ ['$$','$$'], ["\\[","\\]"] ],
 			  processEscapes: true
 			},
 			"HTML-CSS": { fonts: ["TeX"] }
 		  });
 		</script>
 		<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js?config=TeX-MML-AM_CHTML" async></script>{{end}}
 
+
+		{{if .CodeHighlight}}
+		<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/styles/atom-one-light.min.css" />
+		<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/highlight.min.js"></script>
+		<script>
+		  addEventListener('load', function () {
+		    var x = document.querySelectorAll("code[class^='language-']");
+		    for (i=0; i<x.length; i++) {
+		      hljs.highlightBlock(x[i]);
+		    }});
+		</script>
+		{{end}}
 	</head>
 	<body id="collection" itemscope itemtype="http://schema.org/WebPage">
 		{{if or .IsOwner .SingleUser}}<nav id="manage"><ul>
 			<li><a onclick="void(0)">&#9776; Menu</a>
 				<ul>
 					{{ if .IsOwner }}
 					{{if .SingleUser}}
 					<li><a href="/me/new">New Post</a></li>
 					{{else}}
 					<li><a href="/#{{.Alias}}" class="write">{{.SiteName}}</a></li>
 					{{end}}
 					<li><a href="/me/c/{{.Alias}}">Customize</a></li>
 					<li><a href="/me/c/{{.Alias}}/stats">Stats</a></li>
 					<li class="separator"><hr /></li>
 					{{if not .SingleUser}}<li><a href="/me/c/"><img class="ic-18dp" src="/img/ic_blogs_dark@2x.png" /> View Blogs</a></li>{{end}}
 					<li><a href="/me/posts/"><img class="ic-18dp" src="/img/ic_list_dark@2x.png" /> View Drafts</a></li>
 					{{ else }}
 					<li><a href="/login">Log in</a></li>
 					{{ end }}
 				</ul>
 			</li>
 		</ul></nav>{{end}}
 		
 		<header>
 		<h1 dir="{{.Direction}}" id="blog-title">{{if .Posts}}{{else}}<span class="writeas-prefix"><a href="/">write.as</a></span> {{end}}<a href="/{{if .IsTopLevel}}{{else}}{{.Prefix}}{{.Alias}}/{{end}}" class="h-card p-author u-url" rel="me author">{{.DisplayTitle}}</a></h1>
 		{{if .Description}}<p class="description p-note">{{.Description}}</p>{{end}}
 		{{/*if not .Public/*}}
 			<!--p class="meta-note"><span>Private collection</span>. Only you can see this page.</p-->
 		{{/*end*/}}
 		{{if .PinnedPosts}}<nav>
 			{{range .PinnedPosts}}<a class="pinned" href="{{if not $.SingleUser}}/{{$.Alias}}/{{.Slug.String}}{{else}}{{.CanonicalURL}}{{end}}">{{.PlainDisplayTitle}}</a>{{end}}</nav>
 		{{end}}
 		</header>
 		
 		{{if .Posts}}<section id="wrapper" itemscope itemtype="http://schema.org/Blog">{{else}}<div id="wrapper">{{end}}
 
 			{{if .IsWelcome}}
 			<div id="welcome">
 				<h2>Welcome, <strong>{{.Username}}</strong>!</h2>
 				<p>This is your new blog.</p>
 				<p><a class="simple-cta" href="/#{{.Alias}}">Start writing</a>, or <a class="simple-cta" href="/me/c/{{.Alias}}">customize</a> your blog.</p>
 				<p>Check out our <a class="simple-cta" href="https://guides.write.as/writing/?pk_campaign=welcome">writing guide</a> to see what else you can do, and <a class="simple-cta" href="/contact">get in touch</a> anytime with questions or feedback.</p>
 			</div>
 			{{end}}
 
 			{{template "posts" .}}
 
 		{{if gt .TotalPages 1}}<nav id="paging" class="content-container clearfix">
 			{{if or (and .Format.Ascending (lt .CurrentPage .TotalPages)) (isRTL .Direction)}}
 				{{if gt .CurrentPage 1}}<a href="{{.PrevPageURL .Prefix .CurrentPage .IsTopLevel}}">&#8672; {{if and .Format.Ascending (lt .CurrentPage .TotalPages)}}Previous{{else}}Newer{{end}}</a>{{end}}
 				{{if lt .CurrentPage .TotalPages}}<a style="float:right;" href="{{.NextPageURL .Prefix .CurrentPage .IsTopLevel}}">{{if and .Format.Ascending (lt .CurrentPage .TotalPages)}}Next{{else}}Older{{end}} &#8674;</a>{{end}}
 			{{else}}
 				{{if lt .CurrentPage .TotalPages}}<a href="{{.NextPageURL .Prefix .CurrentPage .IsTopLevel}}">&#8672; Older</a>{{end}}
 				{{if gt .CurrentPage 1}}<a style="float:right;" href="{{.PrevPageURL .Prefix .CurrentPage .IsTopLevel}}">Newer &#8674;</a>{{end}}
 			{{end}}
 		</nav>{{end}}
 
 		{{if .Posts}}</section>{{else}}</div>{{end}}
 
 		{{if .ShowFooterBranding }}
 		<footer>
 			<hr />
 			<nav dir="ltr">
 				{{if not .SingleUser}}<a class="home pubd" href="/">{{.SiteName}}</a> &middot; {{end}}powered by <a style="margin-left:0" href="https://writefreely.org">write freely</a>
 			</nav>
 		</footer>
 		{{ end }}
 	</body>
-	
+
 	{{if .CanShowScript}}
 		{{range .ExternalScripts}}<script type="text/javascript" src="{{.}}" async></script>{{end}}
 		{{if .Script}}<script type="text/javascript">{{.ScriptDisplay}}</script>{{end}}
 	{{end}}
 	<script src="/js/h.js"></script>
 	<script src="/js/postactions.js"></script>
 	<script type="text/javascript">
 var deleting = false;
 function delPost(e, id, owned) {
 	e.preventDefault();
 	if (deleting) {
 		return;
 	}
 
 	// TODO: UNDO!
 	if (window.confirm('Are you sure you want to delete this post?')) {
 		// AJAX
 		deletePost(id, "", function() {
 			// Remove post from list
 			var $postEl = document.getElementById('post-' + id);
 			$postEl.parentNode.removeChild($postEl);
 			// TODO: add next post from this collection at the bottom
 		});
 	}
 }
 
 var deletePost = function(postID, token, callback) {
 	deleting = true;
 
 	var $delBtn = document.getElementById('post-' + postID).getElementsByClassName('delete action')[0];
 	$delBtn.innerHTML = '...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/posts/" + postID;
 	http.open("DELETE", url, true);
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			deleting = false;
 			if (http.status == 204) {
 				callback();
 			} else if (http.status == 409) {
 				$delBtn.innerHTML = 'delete';
 				alert("Post is synced to another account. Delete the post from that account instead.");
 				// TODO: show "remove" button instead of "delete" now
 				// Persist that state.
 				// Have it remove the post locally only.
 			} else {
 				$delBtn.innerHTML = 'delete';
 				alert("Failed to delete." + (http.status>=500?" Please try again.":""));
 			}
 		}
 	}
 	http.send();
 };
 
 var pinning = false;
 function pinPost(e, postID, slug, title) {
 	e.preventDefault();
 	if (pinning) {
 		return;
 	}
 	pinning = true;
 
 	var callback = function() {
 		// Visibly remove post from collection
 		var $postEl = document.getElementById('post-' + postID);
 		$postEl.parentNode.removeChild($postEl);
 		var $header = document.getElementsByTagName('header')[0];
 		var $pinnedNavs = $header.getElementsByTagName('nav');
 		// Add link to nav
 		var link = '<a class="pinned" href="/{{.Alias}}/'+slug+'">'+title+'</a>';
 		if ($pinnedNavs.length == 0) {
 			$header.insertAdjacentHTML("beforeend", '<nav>'+link+'</nav>');
 		} else {
 			$pinnedNavs[0].insertAdjacentHTML("beforeend", link);
 		}
 	};
 
 	var $pinBtn = document.getElementById('post-' + postID).getElementsByClassName('pin action')[0];
 	$pinBtn.innerHTML = '...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/collections/{{.Alias}}/pin";
 	var params = [ { "id": postID } ];
 	http.open("POST", url, true);
 	http.setRequestHeader("Content-type", "application/json");
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			pinning = false;
 			if (http.status == 200) {
 				callback();
 			} else if (http.status == 409) {
 				$pinBtn.innerHTML = 'pin';
 				alert("Post is synced to another account. Delete the post from that account instead.");
 				// TODO: show "remove" button instead of "delete" now
 				// Persist that state.
 				// Have it remove the post locally only.
 			} else {
 				$pinBtn.innerHTML = 'pin';
 				alert("Failed to pin." + (http.status>=500?" Please try again.":""));
 			}
 		}
 	}
 	http.send(JSON.stringify(params));
 };
 
 	try {
 	  WebFontConfig = {
 		custom: { families: [ 'Lora:400,700:latin', 'Open+Sans:400,700:latin' ], urls: [ '/css/fonts.css' ] }
 	  };
 	  (function() {
 		var wf = document.createElement('script');
 		wf.src = '/js/webfont.js';
 		wf.type = 'text/javascript';
 		wf.async = 'true';
 		var s = document.getElementsByTagName('script')[0];
 		s.parentNode.insertBefore(wf, s);
 	  })();
 	} catch (e) {}
 	</script>
 </html>{{end}}
diff --git a/templates/post.tmpl b/templates/post.tmpl
index 22fa294..4380c66 100644
--- a/templates/post.tmpl
+++ b/templates/post.tmpl
@@ -1,97 +1,113 @@
 {{define "post"}}<!DOCTYPE HTML>
 <html {{if .Language}}lang="{{.Language}}"{{end}} dir="{{.Direction}}">
 	<head prefix="og: http://ogp.me/ns#">
 		<meta charset="utf-8">
 
 		<title>{{if .Title}}{{.Title}}{{else}}{{.GenTitle}}{{end}} &mdash; {{.SiteName}}</title>
 		
 		{{if .IsCode}}
 		<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/8.4/styles/mono-blue.min.css">
 		{{end}}
 		<link rel="stylesheet" type="text/css" href="/css/write.css" />
 		<link rel="shortcut icon" href="/favicon.ico" />
 		<link rel="canonical" href="{{.Host}}/{{.ID}}" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 
 		<meta name="generator" content="{{.SiteName}}">
 		<meta name="title" content="{{if .Title}}{{.Title}}{{else}}{{.GenTitle}}{{end}}">
 		<meta name="description" content="{{.Description}}">
 		<meta itemprop="name" content="{{.SiteName}}">
 		<meta itemprop="description" content="{{.Description}}">
 		<meta name="twitter:card" content="summary">
 		<meta name="twitter:title" content="{{if .Title}}{{.Title}}{{else}}{{.GenTitle}}{{end}}">
 		<meta name="twitter:description" content="{{.Description}}">
 		{{if gt .Views 1}}<meta name="twitter:label1" value="Views">
 		<meta name="twitter:data1" value="{{largeNumFmt .Views}}">{{end}}
 		<meta name="twitter:image" content="https://write.as/img/w-sq-light.png">
 		<meta property="og:title" content="{{if .Title}}{{.Title}}{{else}}{{.GenTitle}}{{end}}" />
 		<meta property="og:site_name" content="{{.SiteName}}" />
 		<meta property="og:type" content="article" />
 		<meta property="og:url" content="https://write.as/{{.ID}}" />
 		<meta property="og:description" content="{{.Description}}" />
 		<meta property="og:image" content="https://write.as/img/w-sq-light.png">
 		{{if .Author}}<meta property="article:author" content="https://{{.Author}}" />{{end}}
 
+
+		<!-- Collection not known during single User draft? this test feels wrong -->
+		{{if not .SingleUser }}
+		{{if .Collection.CodeHighlight}}
+		  <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/styles/atom-one-light.min.css" />
+		  <script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.13.1/highlight.min.js"></script>
+		  <script>
+		    addEventListener('load', function () {
+		      var x = document.querySelectorAll("code[class^='language-']");
+		      for (i=0; i<x.length; i++) {
+		        hljs.highlightBlock(x[i]);
+		      }});
+		  </script>
+		  {{end}}
+		{{end}}
+
 	</head>
 	<body id="post">
 
 		<header>
 			<h1 dir="{{.Direction}}"><a href="/">{{.SiteName}}</a></h1>
 			<nav>
 				<span class="views{{if not .IsOwner}} owner-visible{{end}}" dir="ltr"><strong>{{largeNumFmt .Views}}</strong> {{pluralize "view" "views" .Views}}</span>
 				{{if .IsCode}}<a href="/{{.ID}}.txt" rel="noindex" dir="{{.Direction}}">View raw</a>{{end}}
 				{{ if .Username }}
 				{{if .IsOwner}}
 				<a href="/{{if .SingleUser}}d/{{end}}{{.ID}}/edit" dir="{{.Direction}}">Edit</a>
 				{{end}}
 				<a class="xtra-feature dash-nav" href="/me/posts/" dir="{{.Direction}}">Drafts</a>
 				{{ end }}
 			</nav>
 		</header>
 		
 		<article class="{{.Font}} h-entry">{{if .Title}}<h2 id="title" class="p-name">{{.Title}}</h2>{{end}}{{ if .IsPlainText }}<p id="post-body" class="e-content">{{.Content}}</p>{{ else }}<div id="post-body" class="e-content">{{.HTMLContent}}</div>{{ end }}</article>
 
 		<footer dir="ltr"><hr><nav><p style="font-size: 0.9em">{{localhtml "published with write.as" .Language}}</p></nav></footer>
 	</body>
 	
 	{{if .IsCode}}
 	<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/8.4/highlight.min.js"></script>
 	<script>
 	hljs.highlightBlock(document.getElementById('post-body'));
 	</script>
 	{{else}}
 	<script src="/js/h.js"></script>
 	{{if .IsPlainText}}<script src="/js/twitter-text.min.js"></script>{{end}}
 	{{end}}
 	<script type="text/javascript">
 	try {
 	  WebFontConfig = {
 		custom: { families: [ 'Lora:400,700:latin'{{if eq .Font "sans"}}, 'Open+Sans:400,700:latin'{{end}} ], urls: [ '/css/fonts.css' ] }
 	  };
 	  (function() {
 		var wf = document.createElement('script');
 		wf.src = '/js/webfont.js';
 		wf.type = 'text/javascript';
 		wf.async = 'true';
 		var s = document.getElementsByTagName('script')[0];
 		s.parentNode.insertBefore(wf, s);
 	  })();
 	} catch (e) { /* ¯\_(ツ)_/¯ */ }
 
 	var posts = localStorage.getItem('posts');
 	if (posts != null) {
 		posts = JSON.parse(posts);
 		var $nav = document.getElementsByTagName('nav')[0];
 		for (var i=0; i<posts.length; i++) {
 			if (posts[i].id == "{{.ID}}") {
 				$nav.innerHTML = $nav.innerHTML + '<a class="xtra-feature" href="/edit/{{.ID}}" dir="{{.Direction}}">Edit</a>';
 				var $ownerVis = document.querySelectorAll('.owner-visible');
 				for (var i=0; i<$ownerVis.length; i++) {
 					$ownerVis[i].classList.remove('owner-visible');
 				}
 				break;
 			}
 		}
 	}
 	</script>
 </html>{{end}}
diff --git a/templates/user/collection.tmpl b/templates/user/collection.tmpl
index 21a05a9..703755b 100644
--- a/templates/user/collection.tmpl
+++ b/templates/user/collection.tmpl
@@ -1,229 +1,234 @@
 {{define "upgrade"}}
 <p><a href="/me/plan?to=/me/c/{{.Alias}}">Upgrade</a> for <span>$40 / year</span> to edit.</p>
 {{end}}
 
 {{define "collection"}}
 {{template "header" .}}
 
 <div class="content-container snug">
 	<div id="overlay"></div>
 
 	<h2>Customize {{.DisplayTitle}} <a href="{{if .SingleUser}}/{{else}}/{{.Alias}}/{{end}}">view blog</a></h2>
 
 	{{if .Flashes}}<ul class="errors">
 		{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
 	</ul>{{end}}
 
 <form name="customize-form" action="/api/collections/{{.Alias}}" method="post" onsubmit="return disableSubmit()">
 <div id="collection-options">
 	<div style="text-align:center">
 		<h1><input type="text" name="title" id="title" value="{{.DisplayTitle}}" placeholder="Title" /></h1>
 		<p><input type="text" name="description" id="description" value="{{.Description}}" placeholder="Description" /></p>
 	</div>
 
 	<div class="option">
 		<h2><a name="preferred-url"></a>URL</h2>
 		<div class="section">
 			{{if eq .Alias .Username}}<p style="font-size: 0.8em">This blog uses your username in its URL{{if .Federation}} and fediverse handle{{end}}. You can change it in your <a href="/me/settings">Account Settings</a>.</p>{{end}}
 			<ul style="list-style:none">
 				<li>
 					{{.FriendlyHost}}/<strong>{{.Alias}}</strong>/
 				</li>
 				<li>
 					<strong id="normal-handle-env" class="fedi-handle" {{if not .Federation}}style="display:none"{{end}}>@<span id="fedi-handle">{{.Alias}}</span>@<span id="fedi-domain">{{.FriendlyHost}}</span></strong>
 				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Publicity</h2>
 		<div class="section">
 			<ul style="list-style:none">
 				<li>
 					<label><input type="radio" name="visibility" id="visibility-unlisted" value="0" {{if .IsUnlisted}}checked="checked"{{end}} />
 						Unlisted
 					</label>
 					<p>This blog is visible to anyone with its link.</p>
 				</li>
 				<li>
 				<label class="option-text"><input type="radio" name="visibility" id="visibility-private" value="2" {{if .IsPrivate}}checked="checked"{{end}} />
 						Private
 					</label>
 					<p>Only you may read this blog (while you're logged in).</p>
 				</li>
 				<li>
 					<label class="option-text"><input type="radio" name="visibility" id="visibility-protected" value="4" {{if .IsProtected}}checked="checked"{{end}} />
 						Password-protected: <input type="password" class="low-profile" name="password" id="collection-pass" autocomplete="new-password" placeholder="{{if .IsProtected}}xxxxxxxxxxxxxxxx{{else}}a memorable password{{end}}" />
 					</label>
 					<p>A password is required to read this blog.</p>
 				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Display Format</h2>
 		<div class="section">
 			<p class="explain">Customize how your posts display on your page.
 			</p>
 			<ul style="list-style:none">
 				<li>
 					<label><input type="radio" name="format" id="format-blog" value="blog" {{if or (not .Format) (eq .Format "blog")}}checked="checked"{{end}} />
 						Blog
 					</label>
 					<p>Dates are shown. Latest posts listed first.</p>
 				</li>
 				<li>
 					<label class="option-text"><input type="radio" name="format" id="format-novel" value="novel" {{if eq .Format "novel"}}checked="checked"{{end}} />
 						Novel
 					</label>
 					<p>No dates shown. Oldest posts first.</p>
 				</li>
 				<li>
 					<label class="option-text"><input type="radio" name="format" id="format-notebook" value="notebook" {{if eq .Format "notebook"}}checked="checked"{{end}} />
 						Notebook
 					</label>
 					<p>No dates shown. Latest posts first.</p>
 				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Text Rendering</h2>
 		<div class="section">
 			<p class="explain">Customize how plain text renders on your blog.</p>
 			<ul style="list-style:none">
 				<li>
 					<label class="option-text disabled"><input type="checkbox" name="markdown" checked="checked" disabled />
 						Markdown
 					</label>
 				</li>
 				<li>
 					<label><input type="checkbox" name="mathjax" {{if .RenderMathJax}}checked="checked"{{end}} />
 						MathJax
 					</label>
 				</li>
+				<li>
+				  <label><input type="checkbox" name="highlight" {{if .CodeHighlight}}checked="checked"{{end}} />
+				  Syntax highlight source-code
+				  </label>
+				</li>
 			</ul>
 		</div>
 	</div>
 
 	<div class="option">
 		<h2>Custom CSS</h2>
 		<div class="section">
 			<textarea id="css-editor" class="section codable" name="style_sheet">{{.StyleSheet}}</textarea>
 			<p class="explain">See our guide on <a href="https://guides.write.as/customizing/#custom-css">customization</a>.</p>
 		</div>
 	</div>
 
 	<div class="option" style="text-align: center; margin-top: 4em;">
 		<input type="submit" id="save-changes" value="Save changes" />
 		<p><a href="{{if .SingleUser}}/{{else}}/{{.Alias}}/{{end}}">View Blog</a></p>
 		{{if ne .Alias .Username}}<p><a class="danger" href="#modal-delete" onclick="promptDelete();">Delete Blog...</a></p>{{end}}
 	</div>
 </div>
 </form>
 </div>
 
 		<div id="modal-delete" class="modal">
 			<h2>Are you sure you want to delete this blog?</h2>
 			<div class="body short">
 				<p style="text-align:left">This will permanently erase <strong>{{.DisplayTitle}}</strong> ({{.FriendlyHost}}/{{.Alias}}) from the internet. Any posts on this blog will be saved and made into drafts (found on your <a href="/me/posts/">Drafts</a> page).</p>
 				<p>If you're sure you want to delete this blog, enter its name in the box below and press <strong>Delete</strong>.</p>
 
 				<ul id="delete-errors" class="errors"></ul>
 
 				<input id="confirm-text" placeholder="{{.Alias}}" type="text" class="boxy" style="margin-top: 0.5em;" />
 				<div style="text-align:right; margin-top: 1em;">
 					<a id="cancel-delete" style="margin-right:2em" href="#">Cancel</a>
 					<button id="btn-delete" class="danger" onclick="deleteBlog(); return false;">Delete</button>
 				</div>
 			</div>
 		</div>
 
 <script src="/js/h.js"></script>
 <script src="/js/ace.js" type="text/javascript" charset="utf-8"></script>
 <script>
 // Begin shared modal code
 function showModal(id) {
 	document.getElementById('overlay').style.display = 'block';
 	document.getElementById('modal-'+id).style.display = 'block';
 }
 
 var closeModals = function(e) {
 	e.preventDefault();
 	document.getElementById('overlay').style.display = 'none';
 	var modals = document.querySelectorAll('.modal');
 	for (var i=0; i<modals.length; i++) {
 		modals[i].style.display = 'none'; 
 	}
 };
 H.getEl('overlay').on('click', closeModals);
 H.getEl('cancel-delete').on('click', closeModals);
 // end
 var deleteBlog = function(e) {
 	if (document.getElementById('confirm-text').value != '{{.Alias}}') {
 		document.getElementById('delete-errors').innerHTML = '<li class="urgent">Enter <strong>{{.Alias}}</strong> in the box below.</li>';
 		return;
 	}
 	// Clear errors
 	document.getElementById('delete-errors').innerHTML = '';
 	document.getElementById('btn-delete').innerHTML = 'Deleting...';
 
 	var http = new XMLHttpRequest();
 	var url = "/api/collections/{{.Alias}}?web=1";
 	http.open("DELETE", url, true);
 	http.setRequestHeader("Content-type", "application/json");
 	http.onreadystatechange = function() {
 		if (http.readyState == 4) {
 			if (http.status == 204) {
 				window.location = '/me/c/';
 			} else {
 				var data = JSON.parse(http.responseText);
 				document.getElementById('delete-errors').innerHTML = '<li class="urgent">'+data.error_msg+'</li>';
 				document.getElementById('btn-delete').innerHTML = 'Delete';
 			}
 		}
 	};
 	http.send(null);
 };
 
 function createHidden(theForm, key, value) {
     var input = document.createElement('input');
     input.type = 'hidden';
     input.name = key;
     input.value = value;
     theForm.appendChild(input);
 }
 function disableSubmit() {
 	var $form = document.forms['customize-form'];
 	createHidden($form, 'style_sheet', cssEditor.getSession().getValue());
 	var $btn = document.getElementById("save-changes");
 	$btn.value = "Saving changes...";
 	$btn.disabled = true;
 	return true;
 }
 function promptDelete() {
 	showModal("delete");
 }
 
 var $fediDomain = document.getElementById('fedi-domain');
 var $fediCustomDomain = document.getElementById('fedi-custom-domain');
 var $customDomain = document.getElementById('domain-alias');
 var $customHandleEnv = document.getElementById('custom-handle-env');
 var $normalHandleEnv = document.getElementById('normal-handle-env');
 
 var opt = {
 	showLineNumbers: false,
 	showPrintMargin: 0,
 };
 var theme = "ace/theme/chrome";
 var cssEditor = ace.edit("css-editor");
 cssEditor.setTheme(theme);
 cssEditor.session.setMode("ace/mode/css");
 cssEditor.setOptions(opt);
 </script>
 
 {{template "footer" .}}
 {{end}}