diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index d52f32b..683d5c4 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -1,61 +1,61 @@
-name: Build container image, publish as Github-package
+name: Build container image, publish as GitHub-package
 
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support
 # documentation.
 
 on:
   push:
     branches: [ main, develop ]
     # Publish semver tags as releases.
     tags:
       - 'v*.*.*'
 
 env:
   # Use docker.io for Docker Hub if empty
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Extract metadata (tags, labels) for Docker
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
         uses: docker/metadata-action@v4.6.0
         with:
           images: |
             ghcr.io/${{ github.repository }}
           flavor: latest=true
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker images
         uses: docker/build-push-action@v5.0.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/account.go b/account.go
index b68d586..2d8d548 100644
--- a/account.go
+++ b/account.go
@@ -1,1257 +1,1257 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"regexp"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/gorilla/csrf"
 	"github.com/gorilla/mux"
 	"github.com/gorilla/sessions"
 	"github.com/guregu/null/zero"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/author"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/page"
 )
 
 type (
 	userSettings struct {
 		Username string `schema:"username" json:"username"`
 		Email    string `schema:"email" json:"email"`
 		NewPass  string `schema:"new-pass" json:"new_pass"`
 		OldPass  string `schema:"current-pass" json:"current_pass"`
 		IsLogOut bool   `schema:"logout" json:"logout"`
 	}
 
 	UserPage struct {
 		page.StaticPage
 
 		PageTitle string
 		Separator template.HTML
 		IsAdmin   bool
 		CanInvite bool
 		CollAlias string
 	}
 )
 
 func NewUserPage(app *App, r *http.Request, u *User, title string, flashes []string) *UserPage {
 	up := &UserPage{
 		StaticPage: pageForReq(app, r),
 		PageTitle:  title,
 	}
 	up.Username = u.Username
 	up.Flashes = flashes
 	up.Path = r.URL.Path
 	up.IsAdmin = u.IsAdmin()
 	up.CanInvite = canUserInvite(app.cfg, up.IsAdmin)
 	return up
 }
 
 func canUserInvite(cfg *config.Config, isAdmin bool) bool {
 	return cfg.App.UserInvites != "" &&
 		(isAdmin || cfg.App.UserInvites != "admin")
 }
 
 func (up *UserPage) SetMessaging(u *User) {
 	// up.NeedsAuth = app.db.DoesUserNeedAuth(u.ID)
 }
 
 const (
 	loginAttemptExpiration = 3 * time.Second
 )
 
 var actuallyUsernameReg = regexp.MustCompile("username is actually ([a-z0-9\\-]+)\\. Please try that, instead")
 
 func apiSignup(app *App, w http.ResponseWriter, r *http.Request) error {
 	_, err := signup(app, w, r)
 	return err
 }
 
 func signup(app *App, w http.ResponseWriter, r *http.Request) (*AuthUser, error) {
 	if app.cfg.App.DisablePasswordAuth {
 		err := ErrDisabledPasswordAuth
 		return nil, err
 	}
 
 	reqJSON := IsJSON(r)
 
 	// Get params
 	var ur userRegistration
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&ur)
 		if err != nil {
 			log.Error("Couldn't parse signup JSON request: %v\n", err)
 			return nil, ErrBadJSON
 		}
 	} else {
 		// Check if user is already logged in
 		u := getUserSession(app, r)
 		if u != nil {
 			return &AuthUser{User: u}, nil
 		}
 
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse signup form request: %v\n", err)
 			return nil, ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&ur, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode signup form request: %v\n", err)
 			return nil, ErrBadFormData
 		}
 	}
 
 	return signupWithRegistration(app, ur, w, r)
 }
 
 func signupWithRegistration(app *App, signup userRegistration, w http.ResponseWriter, r *http.Request) (*AuthUser, error) {
 	reqJSON := IsJSON(r)
 
 	// Validate required params (alias)
 	if signup.Alias == "" {
 		return nil, impart.HTTPError{http.StatusBadRequest, "A username is required."}
 	}
 	if signup.Pass == "" {
 		return nil, impart.HTTPError{http.StatusBadRequest, "A password is required."}
 	}
 	var desiredUsername string
 	if signup.Normalize {
 		// With this option we simply conform the username to what we expect
 		// without complaining. Since they might've done something funny, like
 		// enter: write.as/Way Out There, we'll use their raw input for the new
 		// collection name and sanitize for the slug / username.
 		desiredUsername = signup.Alias
 		signup.Alias = getSlug(signup.Alias, "")
 	}
 	if !author.IsValidUsername(app.cfg, signup.Alias) {
 		// Ensure the username is syntactically correct.
 		return nil, impart.HTTPError{http.StatusPreconditionFailed, "Username is reserved or isn't valid. It must be at least 3 characters long, and can only include letters, numbers, and hyphens."}
 	}
 
 	// Handle empty optional params
 	hashedPass, err := auth.HashPass([]byte(signup.Pass))
 	if err != nil {
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Create struct to insert
 	u := &User{
 		Username:   signup.Alias,
 		HashedPass: hashedPass,
 		HasPass:    true,
 		Email:      prepareUserEmail(signup.Email, app.keys.EmailKey),
 		Created:    time.Now().Truncate(time.Second).UTC(),
 	}
 
 	// Create actual user
 	if err := app.db.CreateUser(app.cfg, u, desiredUsername, signup.Description); err != nil {
 		return nil, err
 	}
 
 	// Log invite if needed
 	if signup.InviteCode != "" {
 		err = app.db.CreateInvitedUser(signup.InviteCode, u.ID)
 		if err != nil {
 			return nil, err
 		}
 	}
 
 	// Add back unencrypted data for response
 	if signup.Email != "" {
 		u.Email.String = signup.Email
 	}
 
 	resUser := &AuthUser{
 		User: u,
 	}
 	title := signup.Alias
 	if signup.Normalize {
 		title = desiredUsername
 	}
 	resUser.Collections = &[]Collection{
 		{
 			Alias:       signup.Alias,
 			Title:       title,
 			Description: signup.Description,
 		},
 	}
 
 	var coll *Collection
 	if signup.Monetization != "" {
 		if coll == nil {
 			coll, err = app.db.GetCollection(signup.Alias)
 			if err != nil {
 				log.Error("Unable to get new collection '%s' for monetization on signup: %v", signup.Alias, err)
 				return nil, err
 			}
 		}
 		err = app.db.SetCollectionAttribute(coll.ID, "monetization_pointer", signup.Monetization)
 		if err != nil {
 			log.Error("Unable to add monetization on signup: %v", err)
 			return nil, err
 		}
 		coll.Monetization = signup.Monetization
 	}
 
 	var token string
 	if reqJSON && !signup.Web {
 		token, err = app.db.GetAccessToken(u.ID)
 		if err != nil {
 			return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
 		}
 		resUser.AccessToken = token
 	} else {
 		session, err := app.sessionStore.Get(r, cookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
 			log.Error("Session: %v; ignoring", err)
 		}
 		session.Values[cookieUserVal] = resUser.User.Cookie()
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Couldn't save session: %v", err)
 			return nil, err
 		}
 	}
 	if reqJSON {
 		return resUser, impart.WriteSuccess(w, resUser, http.StatusCreated)
 	}
 
 	return resUser, nil
 }
 
 func viewLogout(app *App, w http.ResponseWriter, r *http.Request) error {
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		return ErrInternalCookieSession
 	}
 
 	// Ensure user has an email or password set before they go, so they don't
 	// lose access to their account.
 	val := session.Values[cookieUserVal]
 	var u = &User{}
 	var ok bool
 	if u, ok = val.(*User); !ok {
 		log.Error("Error casting user object on logout. Vals: %+v Resetting cookie.", session.Values)
 
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Couldn't save session on logout: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
 		}
 
 		return impart.HTTPError{http.StatusFound, "/"}
 	}
 
 	u, err = app.db.GetUserByID(u.ID)
 	if err != nil && err != ErrUserNotFound {
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to fetch user information."}
 	}
 
 	session.Options.MaxAge = -1
 
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't save session on logout: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
 	}
 
 	return impart.HTTPError{http.StatusFound, "/"}
 }
 
 func handleAPILogout(app *App, w http.ResponseWriter, r *http.Request) error {
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		return ErrNoAccessToken
 	}
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return ErrNoAccessToken
 	}
 	err := app.db.DeleteToken(t)
 	if err != nil {
 		return err
 	}
 	return impart.HTTPError{Status: http.StatusNoContent}
 }
 
 func viewLogin(app *App, w http.ResponseWriter, r *http.Request) error {
 	var earlyError string
 	oneTimeToken := r.FormValue("with")
 	if oneTimeToken != "" {
 		log.Info("Calling login with one-time token.")
 		err := login(app, w, r)
 		if err != nil {
 			log.Info("Received error: %v", err)
 			earlyError = fmt.Sprintf("%s", err)
 		}
 	}
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// Ignore this
 		log.Error("Unable to get session; ignoring: %v", err)
 	}
 
 	p := &struct {
 		page.StaticPage
 		*OAuthButtons
 		To            string
 		Message       template.HTML
 		Flashes       []template.HTML
 		LoginUsername string
 	}{
 		StaticPage:    pageForReq(app, r),
 		OAuthButtons:  NewOAuthButtons(app.Config()),
 		To:            r.FormValue("to"),
 		Message:       template.HTML(""),
 		Flashes:       []template.HTML{},
 		LoginUsername: getTempInfo(app, "login-user", r, w),
 	}
 
 	if earlyError != "" {
 		p.Flashes = append(p.Flashes, template.HTML(earlyError))
 	}
 
 	// Display any error messages
 	flashes, _ := getSessionFlashes(app, w, r, session)
 	for _, flash := range flashes {
 		p.Flashes = append(p.Flashes, template.HTML(flash))
 	}
 	err = pages["login.tmpl"].ExecuteTemplate(w, "base", p)
 	if err != nil {
 		log.Error("Unable to render login: %v", err)
 		return err
 	}
 	return nil
 }
 
 func webLogin(app *App, w http.ResponseWriter, r *http.Request) error {
 	err := login(app, w, r)
 	if err != nil {
 		username := r.FormValue("alias")
 		// Login request was unsuccessful; save the error in the session and redirect them
 		if err, ok := err.(impart.HTTPError); ok {
 			session, _ := app.sessionStore.Get(r, cookieName)
 			if session != nil {
 				session.AddFlash(err.Message)
 				session.Save(r, w)
 			}
 
 			if m := actuallyUsernameReg.FindStringSubmatch(err.Message); len(m) > 0 {
 				// Retain fixed username recommendation for the login form
 				username = m[1]
 			}
 		}
 
 		// Pass along certain information
 		saveTempInfo(app, "login-user", username, r, w)
 
 		// Retain post-login URL if one was given
 		redirectTo := "/login"
 		postLoginRedirect := r.FormValue("to")
 		if postLoginRedirect != "" {
 			redirectTo += "?to=" + postLoginRedirect
 		}
 
 		log.Error("Unable to login: %v", err)
 		return impart.HTTPError{http.StatusTemporaryRedirect, redirectTo}
 	}
 
 	return nil
 }
 
 var loginAttemptUsers = sync.Map{}
 
 func login(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	oneTimeToken := r.FormValue("with")
 	verbose := r.FormValue("all") == "true" || r.FormValue("verbose") == "1" || r.FormValue("verbose") == "true" || (reqJSON && oneTimeToken != "")
 
 	redirectTo := r.FormValue("to")
 	if redirectTo == "" {
 		if app.cfg.App.SingleUser {
 			redirectTo = "/me/new"
 		} else {
 			redirectTo = "/"
 		}
 	}
 
 	var u *User
 	var err error
 	var signin userCredentials
 
 	if app.cfg.App.DisablePasswordAuth {
 		err := ErrDisabledPasswordAuth
 		return err
 	}
 
 	// Log in with one-time token if one is given
 	if oneTimeToken != "" {
 		log.Info("Login: Logging user in via token.")
 		userID := app.db.GetUserID(oneTimeToken)
 		if userID == -1 {
 			log.Error("Login: Got user -1 from token")
 			err := ErrBadAccessToken
 			err.Message = "Expired or invalid login code."
 			return err
 		}
 		log.Info("Login: Found user %d.", userID)
 
 		u, err = app.db.GetUserByID(userID)
 		if err != nil {
 			log.Error("Unable to fetch user on one-time token login: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "There was an error retrieving the user you want."}
 		}
 		log.Info("Login: Got user via token")
 	} else {
 		// Get params
 		if reqJSON {
 			decoder := json.NewDecoder(r.Body)
 			err := decoder.Decode(&signin)
 			if err != nil {
 				log.Error("Couldn't parse signin JSON request: %v\n", err)
 				return ErrBadJSON
 			}
 		} else {
 			err := r.ParseForm()
 			if err != nil {
 				log.Error("Couldn't parse signin form request: %v\n", err)
 				return ErrBadFormData
 			}
 
 			err = app.formDecoder.Decode(&signin, r.PostForm)
 			if err != nil {
 				log.Error("Couldn't decode signin form request: %v\n", err)
 				return ErrBadFormData
 			}
 		}
 
 		log.Info("Login: Attempting login for '%s'", signin.Alias)
 
 		// Validate required params (all)
 		if signin.Alias == "" {
 			msg := "Parameter `alias` required."
 			if signin.Web {
 				msg = "A username is required."
 			}
 			return impart.HTTPError{http.StatusBadRequest, msg}
 		}
 		if !signin.EmailLogin && signin.Pass == "" {
 			msg := "Parameter `pass` required."
 			if signin.Web {
 				msg = "A password is required."
 			}
 			return impart.HTTPError{http.StatusBadRequest, msg}
 		}
 
 		// Prevent excessive login attempts on the same account
 		// Skip this check in dev environment
 		if !app.cfg.Server.Dev {
 			now := time.Now()
 			attemptExp, att := loginAttemptUsers.LoadOrStore(signin.Alias, now.Add(loginAttemptExpiration))
 			if att {
 				if attemptExpTime, ok := attemptExp.(time.Time); ok {
 					if attemptExpTime.After(now) {
 						// This user attempted previously, and the period hasn't expired yet
 						return impart.HTTPError{http.StatusTooManyRequests, "You're doing that too much."}
 					} else {
 						// This user attempted previously, but the time expired; free up space
 						loginAttemptUsers.Delete(signin.Alias)
 					}
 				} else {
 					log.Error("Unable to cast expiration to time")
 				}
 			}
 		}
 
 		// Retrieve password
 		u, err = app.db.GetUserForAuth(signin.Alias)
 		if err != nil {
 			log.Info("Unable to getUserForAuth on %s: %v", signin.Alias, err)
 			if strings.IndexAny(signin.Alias, "@") > 0 {
 				log.Info("Suggesting: %s", ErrUserNotFoundEmail.Message)
 				return ErrUserNotFoundEmail
 			}
 			return err
 		}
 		// Authenticate
 		if u.Email.String == "" {
 			// User has no email set, so check if they haven't added a password, either,
 			// so we can return a more helpful error message.
 			if hasPass, _ := app.db.IsUserPassSet(u.ID); !hasPass {
-				log.Info("Tried logging in to %s, but no password or email.", signin.Alias)
+				log.Info("Tried logging into %s, but no password or email.", signin.Alias)
 				return impart.HTTPError{http.StatusPreconditionFailed, "This user never added a password or email address. Please contact us for help."}
 			}
 		}
 		if len(u.HashedPass) == 0 {
 			return impart.HTTPError{http.StatusUnauthorized, "This user never set a password. Perhaps try logging in via OAuth?"}
 		}
 		if !auth.Authenticated(u.HashedPass, []byte(signin.Pass)) {
 			return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 		}
 	}
 
 	if reqJSON && !signin.Web {
 		var token string
 		if r.Header.Get("User-Agent") == "" {
 			// Get last created token when User-Agent is empty
 			token = app.db.FetchLastAccessToken(u.ID)
 			if token == "" {
 				token, err = app.db.GetAccessToken(u.ID)
 			}
 		} else {
 			token, err = app.db.GetAccessToken(u.ID)
 		}
 		if err != nil {
 			log.Error("Login: Unable to create access token: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
 		}
 		resUser := getVerboseAuthUser(app, token, u, verbose)
 		return impart.WriteSuccess(w, resUser, http.StatusOK)
 	}
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// The cookie should still save, even if there's an error.
 		log.Error("Login: Session: %v; ignoring", err)
 	}
 
 	// Remove unwanted data
 	session.Values[cookieUserVal] = u.Cookie()
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Login: Couldn't save session: %v", err)
 		// TODO: return error
 	}
 
 	// Send success
 	if reqJSON {
 		return impart.WriteSuccess(w, &AuthUser{User: u}, http.StatusOK)
 	}
 	log.Info("Login: Redirecting to %s", redirectTo)
 	w.Header().Set("Location", redirectTo)
 	w.WriteHeader(http.StatusFound)
 	return nil
 }
 
 func getVerboseAuthUser(app *App, token string, u *User, verbose bool) *AuthUser {
 	resUser := &AuthUser{
 		AccessToken: token,
 		User:        u,
 	}
 
 	// Fetch verbose user data if requested
 	if verbose {
 		posts, err := app.db.GetUserPosts(u)
 		if err != nil {
 			log.Error("Login: Unable to get user posts: %v", err)
 		}
 		colls, err := app.db.GetCollections(u, app.cfg.App.Host)
 		if err != nil {
 			log.Error("Login: Unable to get user collections: %v", err)
 		}
 		passIsSet, err := app.db.IsUserPassSet(u.ID)
 		if err != nil {
-			// TODO: correct error meesage
+			// TODO: correct error message
 			log.Error("Login: Unable to get user collections: %v", err)
 		}
 
 		resUser.Posts = posts
 		resUser.Collections = colls
 		resUser.User.HasPass = passIsSet
 	}
 	return resUser
 }
 
 func viewExportOptions(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	// Fetch extra user data
 	p := NewUserPage(app, r, u, "Export", nil)
 
 	showUserPage(w, "export", p)
 	return nil
 }
 
 func viewExportPosts(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	var filename string
 	var u = &User{}
 	reqJSON := IsJSON(r)
 	if reqJSON {
 		// Use given Authorization header
 		accessToken := r.Header.Get("Authorization")
 		if accessToken == "" {
 			return nil, filename, ErrNoAccessToken
 		}
 
 		userID := app.db.GetUserID(accessToken)
 		if userID == -1 {
 			return nil, filename, ErrBadAccessToken
 		}
 
 		var err error
 		u, err = app.db.GetUserByID(userID)
 		if err != nil {
 			return nil, filename, impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve requested user."}
 		}
 	} else {
 		// Use user cookie
 		session, err := app.sessionStore.Get(r, cookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			log.Error("Session: %v; ignoring", err)
 		}
 
 		val := session.Values[cookieUserVal]
 		var ok bool
 		if u, ok = val.(*User); !ok {
 			return nil, filename, ErrNotLoggedIn
 		}
 	}
 
 	filename = u.Username + "-posts-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	// Fetch data we're exporting
 	var err error
 	var data []byte
 	posts, err := app.db.GetUserPosts(u)
 	if err != nil {
 		return data, filename, err
 	}
 
 	// Export as CSV
 	if strings.HasSuffix(r.URL.Path, ".csv") {
 		data = exportPostsCSV(app.cfg.App.Host, u, posts)
 		return data, filename, err
 	}
 	if strings.HasSuffix(r.URL.Path, ".zip") {
 		data = exportPostsZip(u, posts)
 		return data, filename, err
 	}
 
 	if r.FormValue("pretty") == "1" {
 		data, err = json.MarshalIndent(posts, "", "\t")
 	} else {
 		data, err = json.Marshal(posts)
 	}
 	return data, filename, err
 }
 
 func viewExportFull(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	var err error
 	filename := ""
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, filename, ErrNotLoggedIn
 	}
 	filename = u.Username + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	exportUser := compileFullExport(app, u)
 
 	var data []byte
 	if r.FormValue("pretty") == "1" {
 		data, err = json.MarshalIndent(exportUser, "", "\t")
 	} else {
 		data, err = json.Marshal(exportUser)
 	}
 	return data, filename, err
 }
 
 func viewMeAPI(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	uObj := struct {
 		ID       int64  `json:"id,omitempty"`
 		Username string `json:"username,omitempty"`
 	}{}
 	var err error
 
 	if reqJSON {
 		_, uObj.Username, err = app.db.GetUserDataFromToken(r.Header.Get("Authorization"))
 		if err != nil {
 			return err
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return impart.WriteSuccess(w, uObj, http.StatusOK)
 		}
 		uObj.Username = u.Username
 	}
 
 	return impart.WriteSuccess(w, uObj, http.StatusOK)
 }
 
 func viewMyPostsAPI(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return ErrBadRequestedType
 	}
 
 	isAnonPosts := r.FormValue("anonymous") == "1"
 	if isAnonPosts {
 		pageStr := r.FormValue("page")
 		pg, err := strconv.Atoi(pageStr)
 		if err != nil {
 			log.Error("Error parsing page parameter '%s': %s", pageStr, err)
 			pg = 1
 		}
 
 		p, err := app.db.GetAnonymousPosts(u, pg)
 		if err != nil {
 			return err
 		}
 		return impart.WriteSuccess(w, p, http.StatusOK)
 	}
 
 	var err error
 	p := GetPostsCache(u.ID)
 	if p == nil {
 		userPostsCache.Lock()
 		if userPostsCache.users[u.ID].ready == nil {
 			userPostsCache.users[u.ID] = postsCacheItem{ready: make(chan struct{})}
 			userPostsCache.Unlock()
 
 			p, err = app.db.GetUserPosts(u)
 			if err != nil {
 				return err
 			}
 
 			CachePosts(u.ID, p)
 		} else {
 			userPostsCache.Unlock()
 
 			<-userPostsCache.users[u.ID].ready
 			p = GetPostsCache(u.ID)
 		}
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func viewMyCollectionsAPI(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return ErrBadRequestedType
 	}
 
 	p, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func viewArticles(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p, err := app.db.GetAnonymousPosts(u, 1)
 	if err != nil {
 		log.Error("unable to fetch anon posts: %v", err)
 	}
 	// nil-out AnonymousPosts slice for easy detection in the template
 	if p != nil && len(*p) == 0 {
 		p = nil
 	}
 
 	f, err := getSessionFlashes(app, w, r, nil)
 	if err != nil {
 		log.Error("unable to fetch flashes: %v", err)
 	}
 
 	c, err := app.db.GetPublishableCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view articles: %v", err)
 	}
 	d := struct {
 		*UserPage
 		AnonymousPosts *[]PublicPost
 		Collections    *[]Collection
 		Silenced       bool
 	}{
 		UserPage:       NewUserPage(app, r, u, u.Username+"'s Posts", f),
 		AnonymousPosts: p,
 		Collections:    c,
 		Silenced:       silenced,
 	}
 	d.UserPage.SetMessaging(u)
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	w.Header().Set("Expires", "Thu, 04 Oct 1990 20:00:00 GMT")
 	showUserPage(w, "articles", d)
 
 	return nil
 }
 
 func viewCollections(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	c, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 		return fmt.Errorf("No collections")
 	}
 
 	f, _ := getSessionFlashes(app, w, r, nil)
 
 	uc, _ := app.db.GetUserCollectionCount(u.ID)
 	// TODO: handle any errors
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view collections: %v", err)
 		return fmt.Errorf("view collections: %v", err)
 	}
 	d := struct {
 		*UserPage
 		Collections *[]Collection
 
 		UsedCollections, TotalCollections int
 
 		NewBlogsDisabled bool
 		Silenced         bool
 	}{
 		UserPage:         NewUserPage(app, r, u, u.Username+"'s Blogs", f),
 		Collections:      c,
 		UsedCollections:  int(uc),
 		NewBlogsDisabled: !app.cfg.App.CanCreateBlogs(uc),
 		Silenced:         silenced,
 	}
 	d.UserPage.SetMessaging(u)
 	showUserPage(w, "collections", d)
 
 	return nil
 }
 
 func viewEditCollection(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	c, err := app.db.GetCollection(vars["collection"])
 	if err != nil {
 		return err
 	}
 	if c.OwnerID != u.ID {
 		return ErrCollectionNotFound
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view edit collection %v", err)
 		return fmt.Errorf("view edit collection: %v", err)
 	}
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	obj := struct {
 		*UserPage
 		*Collection
 		Silenced bool
 	}{
 		UserPage:   NewUserPage(app, r, u, "Edit "+c.DisplayTitle(), flashes),
 		Collection: c,
 		Silenced:   silenced,
 	}
 	obj.UserPage.CollAlias = c.Alias
 
 	showUserPage(w, "collection", obj)
 	return nil
 }
 
 func updateSettings(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 
 	var s userSettings
 	var u *User
 	var sess *sessions.Session
 	var err error
 	if reqJSON {
 		accessToken := r.Header.Get("Authorization")
 		if accessToken == "" {
 			return ErrNoAccessToken
 		}
 
 		u, err = app.db.GetAPIUser(accessToken)
 		if err != nil {
 			return ErrBadAccessToken
 		}
 
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&s)
 		if err != nil {
 			log.Error("Couldn't parse settings JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 
 		// Prevent all username updates
 		// TODO: support changing username via JSON API request
 		s.Username = ""
 	} else {
 		u, sess = getUserAndSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse settings form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&s, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode settings form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	// Do update
 	postUpdateReturn := r.FormValue("return")
 	redirectTo := "/me/settings"
 	if s.IsLogOut {
 		redirectTo += "?logout=1"
 	} else if postUpdateReturn != "" {
 		redirectTo = postUpdateReturn
 	}
 
 	// Only do updates on values we need
 	if s.Username != "" && s.Username == u.Username {
 		// Username hasn't actually changed; blank it out
 		s.Username = ""
 	}
 	err = app.db.ChangeSettings(app, u, &s)
 	if err != nil {
 		if reqJSON {
 			return err
 		}
 
 		if err, ok := err.(impart.HTTPError); ok {
 			addSessionFlash(app, w, r, err.Message, nil)
 		}
 	} else {
 		// Successful update.
 		if reqJSON {
 			return impart.WriteSuccess(w, u, http.StatusOK)
 		}
 
 		if s.IsLogOut {
 			redirectTo = "/me/logout"
 		} else {
 			sess.Values[cookieUserVal] = u.Cookie()
 			addSessionFlash(app, w, r, "Account updated.", nil)
 		}
 	}
 
 	w.Header().Set("Location", redirectTo)
 	w.WriteHeader(http.StatusFound)
 	return nil
 }
 
 func updatePassphrase(app *App, w http.ResponseWriter, r *http.Request) error {
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		return ErrNoAccessToken
 	}
 
 	curPass := r.FormValue("current")
 	newPass := r.FormValue("new")
 	// Ensure a new password is given (always required)
 	if newPass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Provide a new password."}
 	}
 
 	userID, sudo := app.db.GetUserIDPrivilege(accessToken)
 	if userID == -1 {
 		return ErrBadAccessToken
 	}
 
 	// Ensure a current password is given if the access token doesn't have sudo
 	// privileges.
 	if !sudo && curPass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Provide current password."}
 	}
 
 	// Hash the new password
 	hashedPass, err := auth.HashPass([]byte(newPass))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Do update
 	err = app.db.ChangePassphrase(userID, sudo, curPass, hashedPass)
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, struct{}{}, http.StatusOK)
 }
 
 func viewStats(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	var c *Collection
 	var err error
 	vars := mux.Vars(r)
 	alias := vars["collection"]
 	if alias != "" {
 		c, err = app.db.GetCollection(alias)
 		if err != nil {
 			return err
 		}
 		if c.OwnerID != u.ID {
 			return ErrCollectionNotFound
 		}
 		c.hostName = app.cfg.App.Host
 	}
 
 	topPosts, err := app.db.GetTopPosts(u, alias, c.hostName)
 	if err != nil {
 		log.Error("Unable to get top posts: %v", err)
 		return err
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	titleStats := ""
 	if c != nil {
 		titleStats = c.DisplayTitle() + " "
 	}
 
 	silenced, err := app.db.IsUserSilenced(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("view stats: %v", err)
 		return err
 	}
 	obj := struct {
 		*UserPage
 		VisitsBlog  string
 		Collection  *Collection
 		TopPosts    *[]PublicPost
 		APFollowers int
 		Silenced    bool
 	}{
 		UserPage:   NewUserPage(app, r, u, titleStats+"Stats", flashes),
 		VisitsBlog: alias,
 		Collection: c,
 		TopPosts:   topPosts,
 		Silenced:   silenced,
 	}
 	obj.UserPage.CollAlias = c.Alias
 	if app.cfg.App.Federation {
 		folls, err := app.db.GetAPFollowers(c)
 		if err != nil {
 			return err
 		}
 		obj.APFollowers = len(*folls)
 	}
 
 	showUserPage(w, "stats", obj)
 	return nil
 }
 
 func viewSettings(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	fullUser, err := app.db.GetUserByID(u.ID)
 	if err != nil {
 		if err == ErrUserNotFound {
 			return err
 		}
 		log.Error("Unable to get user for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 
 	passIsSet, err := app.db.IsUserPassSet(u.ID)
 	if err != nil {
 		log.Error("Unable to get isUserPassSet for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 
 	enableOauthSlack := app.Config().SlackOauth.ClientID != ""
 	enableOauthWriteAs := app.Config().WriteAsOauth.ClientID != ""
 	enableOauthGitLab := app.Config().GitlabOauth.ClientID != ""
 	enableOauthGeneric := app.Config().GenericOauth.ClientID != ""
 	enableOauthGitea := app.Config().GiteaOauth.ClientID != ""
 
 	oauthAccounts, err := app.db.GetOauthAccounts(r.Context(), u.ID)
 	if err != nil {
 		log.Error("Unable to get oauth accounts for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 	for idx, oauthAccount := range oauthAccounts {
 		switch oauthAccount.Provider {
 		case "slack":
 			enableOauthSlack = false
 		case "write.as":
 			enableOauthWriteAs = false
 		case "gitlab":
 			enableOauthGitLab = false
 		case "generic":
 			oauthAccounts[idx].DisplayName = app.Config().GenericOauth.DisplayName
 			oauthAccounts[idx].AllowDisconnect = app.Config().GenericOauth.AllowDisconnect
 			enableOauthGeneric = false
 		case "gitea":
 			enableOauthGitea = false
 		}
 	}
 
 	displayOauthSection := enableOauthSlack || enableOauthWriteAs || enableOauthGitLab || enableOauthGeneric || enableOauthGitea || len(oauthAccounts) > 0
 
 	obj := struct {
 		*UserPage
 		Email                   string
 		HasPass                 bool
 		IsLogOut                bool
 		Silenced                bool
 		CSRFField               template.HTML
 		OauthSection            bool
 		OauthAccounts           []oauthAccountInfo
 		OauthSlack              bool
 		OauthWriteAs            bool
 		OauthGitLab             bool
 		GitLabDisplayName       string
 		OauthGeneric            bool
 		OauthGenericDisplayName string
 		OauthGitea              bool
 		GiteaDisplayName        string
 	}{
 		UserPage:                NewUserPage(app, r, u, "Account Settings", flashes),
 		Email:                   fullUser.EmailClear(app.keys),
 		HasPass:                 passIsSet,
 		IsLogOut:                r.FormValue("logout") == "1",
 		Silenced:                fullUser.IsSilenced(),
 		CSRFField:               csrf.TemplateField(r),
 		OauthSection:            displayOauthSection,
 		OauthAccounts:           oauthAccounts,
 		OauthSlack:              enableOauthSlack,
 		OauthWriteAs:            enableOauthWriteAs,
 		OauthGitLab:             enableOauthGitLab,
 		GitLabDisplayName:       config.OrDefaultString(app.Config().GitlabOauth.DisplayName, gitlabDisplayName),
 		OauthGeneric:            enableOauthGeneric,
 		OauthGenericDisplayName: config.OrDefaultString(app.Config().GenericOauth.DisplayName, genericOauthDisplayName),
 		OauthGitea:              enableOauthGitea,
 		GiteaDisplayName:        config.OrDefaultString(app.Config().GiteaOauth.DisplayName, giteaDisplayName),
 	}
 
 	showUserPage(w, "settings", obj)
 	return nil
 }
 
 func saveTempInfo(app *App, key, val string, r *http.Request, w http.ResponseWriter) error {
 	session, err := app.sessionStore.Get(r, "t")
 	if err != nil {
 		return ErrInternalCookieSession
 	}
 
 	session.Values[key] = val
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't saveTempInfo for key-val (%s:%s): %v", key, val, err)
 	}
 	return err
 }
 
 func getTempInfo(app *App, key string, r *http.Request, w http.ResponseWriter) string {
 	session, err := app.sessionStore.Get(r, "t")
 	if err != nil {
 		return ""
 	}
 
 	// Get the information
 	var s = ""
 	var ok bool
 	if s, ok = session.Values[key].(string); !ok {
 		return ""
 	}
 
 	// Delete cookie
 	session.Options.MaxAge = -1
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't erase temp data for key %s: %v", key, err)
 	}
 
 	// Return value
 	return s
 }
 
 func handleUserDelete(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	if !app.cfg.App.OpenDeletion {
 		return impart.HTTPError{http.StatusForbidden, "Open account deletion is disabled on this instance."}
 	}
 
 	confirmUsername := r.PostFormValue("confirm-username")
 	if u.Username != confirmUsername {
 		return impart.HTTPError{http.StatusBadRequest, "Confirmation username must match your username exactly."}
 	}
 
 	// Check for account deletion safeguards in place
 	if u.IsAdmin() {
 		return impart.HTTPError{http.StatusForbidden, "Cannot delete admin."}
 	}
 
 	err := app.db.DeleteAccount(u.ID)
 	if err != nil {
 		log.Error("user delete account: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not delete account: %v", err)}
 	}
 
 	// FIXME: This doesn't ever appear to the user, as (I believe) the value is erased when the session cookie is reset
 	_ = addSessionFlash(app, w, r, "Thanks for writing with us! You account was deleted successfully.", nil)
 	return impart.HTTPError{http.StatusFound, "/me/logout"}
 }
 
 func removeOauth(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	provider := r.FormValue("provider")
 	clientID := r.FormValue("client_id")
 	remoteUserID := r.FormValue("remote_user_id")
 
 	err := app.db.RemoveOauth(r.Context(), u.ID, provider, clientID, remoteUserID)
 	if err != nil {
 		return impart.HTTPError{Status: http.StatusInternalServerError, Message: err.Error()}
 	}
 
 	return impart.HTTPError{Status: http.StatusFound, Message: "/me/settings"}
 }
 
 func prepareUserEmail(input string, emailKey []byte) zero.String {
 	email := zero.NewString("", input != "")
 	if len(input) > 0 {
 		encEmail, err := data.Encrypt(emailKey, input)
 		if err != nil {
 			log.Error("Unable to encrypt email: %s\n", err)
 		} else {
 			email.String = string(encEmail)
 
 		}
 	}
 	return email
 }
diff --git a/handle.go b/handle.go
index e0600bb..7537b61 100644
--- a/handle.go
+++ b/handle.go
@@ -1,1013 +1,1013 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"fmt"
 	"html/template"
 	"net/http"
 	"net/url"
 	"runtime/debug"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gorilla/sessions"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/go-gopher"
 	"github.com/writefreely/writefreely/config"
 	"github.com/writefreely/writefreely/page"
 )
 
 // UserLevel represents the required user level for accessing an endpoint
 type UserLevel int
 
 const (
 	UserLevelNoneType         UserLevel = iota // user or not -- ignored
 	UserLevelOptionalType                      // user or not -- object fetched if user
 	UserLevelNoneRequiredType                  // non-user (required)
 	UserLevelUserType                          // user (required)
 )
 
 func UserLevelNone(cfg *config.Config) UserLevel {
 	return UserLevelNoneType
 }
 
 func UserLevelOptional(cfg *config.Config) UserLevel {
 	return UserLevelOptionalType
 }
 
 func UserLevelNoneRequired(cfg *config.Config) UserLevel {
 	return UserLevelNoneRequiredType
 }
 
 func UserLevelUser(cfg *config.Config) UserLevel {
 	return UserLevelUserType
 }
 
 // UserLevelReader returns the permission level required for any route where
 // users can read published content.
 func UserLevelReader(cfg *config.Config) UserLevel {
 	if cfg.App.Private {
 		return UserLevelUserType
 	}
 	return UserLevelOptionalType
 }
 
 type (
 	handlerFunc          func(app *App, w http.ResponseWriter, r *http.Request) error
 	gopherFunc           func(app *App, w gopher.ResponseWriter, r *gopher.Request) error
 	userHandlerFunc      func(app *App, u *User, w http.ResponseWriter, r *http.Request) error
 	userApperHandlerFunc func(apper Apper, u *User, w http.ResponseWriter, r *http.Request) error
 	dataHandlerFunc      func(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error)
 	authFunc             func(app *App, r *http.Request) (*User, error)
 	UserLevelFunc        func(cfg *config.Config) UserLevel
 )
 
 type Handler struct {
 	errors       *ErrorPages
 	sessionStore sessions.Store
 	app          Apper
 }
 
 // ErrorPages hold template HTML error pages for displaying errors to the user.
 // In each, there should be a defined template named "base".
 type ErrorPages struct {
 	NotFound            *template.Template
 	Gone                *template.Template
 	InternalServerError *template.Template
 	UnavailableError    *template.Template
 	Blank               *template.Template
 }
 
 // NewHandler returns a new Handler instance, using the given StaticPage data,
 // and saving alias to the application's CookieStore.
 func NewHandler(apper Apper) *Handler {
 	h := &Handler{
 		errors: &ErrorPages{
 			NotFound:            template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>404</title></head><body><p>Not found.</p></body></html>{{end}}")),
 			Gone:                template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>410</title></head><body><p>Gone.</p></body></html>{{end}}")),
 			InternalServerError: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>500</title></head><body><p>Internal server error.</p></body></html>{{end}}")),
 			UnavailableError:    template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>503</title></head><body><p>Service is temporarily unavailable.</p></body></html>{{end}}")),
 			Blank:               template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>{{.Title}}</title></head><body><p>{{.Content}}</p></body></html>{{end}}")),
 		},
 		sessionStore: apper.App().SessionStore(),
 		app:          apper,
 	}
 
 	return h
 }
 
 // NewWFHandler returns a new Handler instance, using WriteFreely template files.
 // You MUST call writefreely.InitTemplates() before this.
 func NewWFHandler(apper Apper) *Handler {
 	h := NewHandler(apper)
 	h.SetErrorPages(&ErrorPages{
 		NotFound:            pages["404-general.tmpl"],
 		Gone:                pages["410.tmpl"],
 		InternalServerError: pages["500.tmpl"],
 		UnavailableError:    pages["503.tmpl"],
 		Blank:               pages["blank.tmpl"],
 	})
 	return h
 }
 
 // SetErrorPages sets the given set of ErrorPages as templates for any errors
 // that come up.
 func (h *Handler) SetErrorPages(e *ErrorPages) {
 	h.errors = e
 }
 
 // User handles requests made in the web application by the authenticated user.
 // This provides user-friendly HTML pages and actions that work in the browser.
 func (h *Handler) User(f userHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil {
 				err := ErrNotLoggedIn
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app.App(), u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if impErr, ok := err.(impart.HTTPError); ok {
 				status = impErr.Status
 				if impErr == ErrUserNotFound {
 					log.Info("Logged-in user not found. Logging out.")
 					sendRedirect(w, http.StatusFound, "/me/logout?to="+h.app.App().cfg.App.LandingPath())
 					// Reset err so handleHTTPError does nothing
 					err = nil
 				}
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 // Admin handles requests on /admin routes
 func (h *Handler) Admin(f userHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil || !u.IsAdmin() {
 				err := impart.HTTPError{http.StatusNotFound, ""}
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app.App(), u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 // AdminApper handles requests on /admin routes that require an Apper.
 func (h *Handler) AdminApper(f userApperHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil || !u.IsAdmin() {
 				err := impart.HTTPError{http.StatusNotFound, ""}
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app, u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 func apiAuth(app *App, r *http.Request) (*User, error) {
 	// Authorize user from Authorization header
 	t := r.Header.Get("Authorization")
 	if t == "" {
 		return nil, ErrNoAccessToken
 	}
 	u := &User{ID: app.db.GetUserID(t)}
 	if u.ID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return u, nil
 }
 
-// optionaAPIAuth is used for endpoints that accept authenticated requests via
+// optionalAPIAuth is used for endpoints that accept authenticated requests via
 // Authorization header or cookie, unlike apiAuth. It returns a different err
 // in the case where no Authorization header is present.
 func optionalAPIAuth(app *App, r *http.Request) (*User, error) {
 	// Authorize user from Authorization header
 	t := r.Header.Get("Authorization")
 	if t == "" {
 		return nil, ErrNotLoggedIn
 	}
 	u := &User{ID: app.db.GetUserID(t)}
 	if u.ID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return u, nil
 }
 
 func webAuth(app *App, r *http.Request) (*User, error) {
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, ErrNotLoggedIn
 	}
 	return u, nil
 }
 
 // UserAPI handles requests made in the API by the authenticated user.
 // This provides user-friendly HTML pages and actions that work in the browser.
 func (h *Handler) UserAPI(f userHandlerFunc) http.HandlerFunc {
 	return h.UserAll(false, f, apiAuth)
 }
 
 // UserWebAPI handles endpoints that accept a user authorized either via the web (cookies) or an Authorization header.
 func (h *Handler) UserWebAPI(f userHandlerFunc) http.HandlerFunc {
 	return h.UserAll(false, f, func(app *App, r *http.Request) (*User, error) {
 		// Authorize user via cookies
 		u := getUserSession(app, r)
 		if u != nil {
 			return u, nil
 		}
 
 		// Fall back to access token, since user isn't logged in via web
 		var err error
 		u, err = apiAuth(app, r)
 		if err != nil {
 			return nil, err
 		}
 
 		return u, nil
 	})
 }
 
 func (h *Handler) UserAll(web bool, f userHandlerFunc, a authFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		handleFunc := func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u, err := a(h.app.App(), r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 				return err
 			}
 
 			err = f(h.app.App(), u, w, r)
 			if err == nil {
 				status = 200
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = 500
 			}
 
 			return err
 		}
 
 		if web {
 			h.handleHTTPError(w, r, handleFunc())
 		} else {
 			h.handleError(w, r, handleFunc())
 		}
 	}
 }
 
 func (h *Handler) RedirectOnErr(f handlerFunc, loc string) handlerFunc {
 	return func(app *App, w http.ResponseWriter, r *http.Request) error {
 		err := f(app, w, r)
 		if err != nil {
 			if ie, ok := err.(impart.HTTPError); ok {
 				// Override default redirect with returned error's, if it's a
 				// redirect error.
 				if ie.Status == http.StatusFound {
 					return ie
 				}
 			}
 			return impart.HTTPError{http.StatusFound, loc}
 		}
 		return nil
 	}
 }
 
 func (h *Handler) Page(n string) http.HandlerFunc {
 	return h.Web(func(app *App, w http.ResponseWriter, r *http.Request) error {
 		t, ok := pages[n]
 		if !ok {
 			return impart.HTTPError{http.StatusNotFound, "Page not found."}
 		}
 
 		sp := pageForReq(app, r)
 
 		err := t.ExecuteTemplate(w, "base", sp)
 		if err != nil {
 			log.Error("Unable to render page: %v", err)
 		}
 		return err
 	}, UserLevelOptional)
 }
 
 func (h *Handler) WebErrors(f handlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// TODO: factor out this logic shared with Web()
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					u := getUserSession(h.app.App(), r)
 					username := "None"
 					if u != nil {
 						username = u.Username
 					}
 					log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			var session *sessions.Session
 			var err error
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err = h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			// TODO: pass User object to function
 			err = f(h.app.App(), w, r)
 			if err == nil {
 				status = 200
 			} else if httpErr, ok := err.(impart.HTTPError); ok {
 				status = httpErr.Status
 				if status < 300 || status > 399 {
 					addSessionFlash(h.app.App(), w, r, httpErr.Message, session)
 					return impart.HTTPError{http.StatusFound, r.Referer()}
 				}
 			} else {
 				e := fmt.Sprintf("[Web handler] 500: %v", err)
 				if !strings.HasSuffix(e, "write: broken pipe") {
 					log.Error(e)
 				} else {
 					log.Error(e)
 				}
 				log.Info("Web handler internal error render")
 				h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 				status = 500
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) CollectionPostOrStatic(w http.ResponseWriter, r *http.Request) {
 	if strings.Contains(r.URL.Path, ".") && !isRaw(r) {
 		start := time.Now()
 		status := 200
 		defer func() {
 			log.Info(h.app.ReqLog(r, status, time.Since(start)))
 		}()
 
 		// Serve static file
 		h.app.App().shttp.ServeHTTP(w, r)
 		return
 	}
 
 	h.Web(viewCollectionPost, UserLevelReader)(w, r)
 }
 
 // Web handles requests made in the web application. This provides user-
 // friendly HTML pages and actions that work in the browser.
 func (h *Handler) Web(f handlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					u := getUserSession(h.app.App(), r)
 					username := "None"
 					if u != nil {
 						username = u.Username
 					}
 					log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
 					log.Info("Web deferred internal error render")
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err := h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			// TODO: pass User object to function
 			err := f(h.app.App(), w, r)
 			if err == nil {
 				status = 200
 			} else if httpErr, ok := err.(impart.HTTPError); ok {
 				status = httpErr.Status
 			} else {
 				e := fmt.Sprintf("[Web handler] 500: %v", err)
 				log.Error(e)
 				log.Info("Web internal error render")
 				h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 				status = 500
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) All(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			// TODO: do any needed authentication
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) PlainTextAPI(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleTextError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					status = http.StatusInternalServerError
 					w.WriteHeader(status)
 					fmt.Fprintf(w, "Something didn't work quite right. The robots have alerted the humans.")
 				}
 
 				log.Info(fmt.Sprintf("\"%s %s\" %d %s \"%s\" \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent(), r.Host))
 			}()
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = http.StatusInternalServerError
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) OAuth(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleOAuthError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) AllReader(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleError(w, r, func() error {
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			// Allow any origin, as public endpoints are handled in here
 			w.Header().Set("Access-Control-Allow-Origin", "*")
 
 			if h.app.App().cfg.App.Private {
 				// This instance is private, so ensure it's being accessed by a valid user
 				// Check if authenticated with an access token
 				_, apiErr := optionalAPIAuth(h.app.App(), r)
 				if apiErr != nil {
 					if err, ok := apiErr.(impart.HTTPError); ok {
 						status = err.Status
 					} else {
 						status = 500
 					}
 
 					if apiErr == ErrNotLoggedIn {
 						// Fall back to web auth since there was no access token given
 						_, err := webAuth(h.app.App(), r)
 						if err != nil {
 							if err, ok := apiErr.(impart.HTTPError); ok {
 								status = err.Status
 							} else {
 								status = 500
 							}
 							return err
 						}
 					} else {
 						return apiErr
 					}
 				}
 			}
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) Download(f dataHandlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			data, filename, err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 				return err
 			}
 
 			ext := ".json"
 			ct := "application/json"
 			if strings.HasSuffix(r.URL.Path, ".csv") {
 				ext = ".csv"
 				ct = "text/csv"
 			} else if strings.HasSuffix(r.URL.Path, ".zip") {
 				ext = ".zip"
 				ct = "application/zip"
 			}
 			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s%s", filename, ext))
 			w.Header().Set("Content-Type", ct)
 			w.Header().Set("Content-Length", strconv.Itoa(len(data)))
 			fmt.Fprint(w, string(data))
 
 			status = 200
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) Redirect(url string, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			start := time.Now()
 
 			var status int
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err := h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			status = sendRedirect(w, http.StatusFound, url)
 
 			log.Info(h.app.ReqLog(r, status, time.Since(start)))
 
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) handleHTTPError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		} else if err.Status == http.StatusUnauthorized {
 			q := ""
 			if r.URL.RawQuery != "" {
 				q = url.QueryEscape("?" + r.URL.RawQuery)
 			}
 			sendRedirect(w, http.StatusFound, "/login?to="+r.URL.Path+q)
 			return
 		} else if err.Status == http.StatusGone {
 			w.WriteHeader(err.Status)
 			p := &struct {
 				page.StaticPage
 				Content *template.HTML
 			}{
 				StaticPage: pageForReq(h.app.App(), r),
 			}
 			if err.Message != "" {
 				co := template.HTML(err.Message)
 				p.Content = &co
 			}
 			h.errors.Gone.ExecuteTemplate(w, "base", p)
 			return
 		} else if err.Status == http.StatusNotFound {
 			w.WriteHeader(err.Status)
 			if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
 				// This is a fediverse request; simply return the header
 				return
 			}
 			h.errors.NotFound.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusInternalServerError {
 			w.WriteHeader(err.Status)
 			log.Info("handleHTTPErorr internal error render")
 			h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusServiceUnavailable {
 			w.WriteHeader(err.Status)
 			h.errors.UnavailableError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusAccepted {
 			impart.WriteSuccess(w, "", err.Status)
 			return
 		} else {
 			p := &struct {
 				page.StaticPage
 				Title   string
 				Content template.HTML
 			}{
 				pageForReq(h.app.App(), r),
 				fmt.Sprintf("Uh oh (%d)", err.Status),
 				template.HTML(fmt.Sprintf("<p style=\"text-align: center\" class=\"introduction\">%s</p>", err.Message)),
 			}
 			h.errors.Blank.ExecuteTemplate(w, "base", p)
 			return
 		}
 		impart.WriteError(w, err)
 		return
 	}
 
 	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 }
 
 func (h *Handler) handleError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		//		if strings.Contains(r.Header.Get("Accept"), "text/html") {
 		impart.WriteError(w, err)
 		//		}
 		return
 	}
 
 	if IsJSON(r) {
 		impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 		return
 	}
 	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 }
 
 func (h *Handler) handleTextError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		w.WriteHeader(err.Status)
 		fmt.Fprintf(w, http.StatusText(err.Status))
 		return
 	}
 
 	w.WriteHeader(http.StatusInternalServerError)
 	fmt.Fprintf(w, "This is an unhelpful error message for a miscellaneous internal error.")
 }
 
 func (h *Handler) handleOAuthError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		impart.WriteOAuthError(w, err)
 		return
 	}
 
 	impart.WriteOAuthError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 	return
 }
 
 func correctPageFromLoginAttempt(r *http.Request) string {
 	to := r.FormValue("to")
 	if to == "" {
 		to = "/"
 	} else if !strings.HasPrefix(to, "/") {
 		to = "/" + to
 	}
 	return to
 }
 
 func (h *Handler) LogHandlerFunc(f http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("Handler.LogHandlerFunc\n\n%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				// TODO: log actual status code returned
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if h.app.App().cfg.App.Private {
 				// This instance is private, so ensure it's being accessed by a valid user
 				// Check if authenticated with an access token
 				_, apiErr := optionalAPIAuth(h.app.App(), r)
 				if apiErr != nil {
 					if err, ok := apiErr.(impart.HTTPError); ok {
 						status = err.Status
 					} else {
 						status = 500
 					}
 
 					if apiErr == ErrNotLoggedIn {
 						// Fall back to web auth since there was no access token given
 						_, err := webAuth(h.app.App(), r)
 						if err != nil {
 							if err, ok := apiErr.(impart.HTTPError); ok {
 								status = err.Status
 							} else {
 								status = 500
 							}
 							return err
 						}
 					} else {
 						return apiErr
 					}
 				}
 			}
 
 			f(w, r)
 
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) Gopher(f gopherFunc) gopher.HandlerFunc {
 	return func(w gopher.ResponseWriter, r *gopher.Request) {
 		defer func() {
 			if e := recover(); e != nil {
 				log.Error("%s: %s", e, debug.Stack())
 				w.WriteError("An internal error occurred")
 			}
 			log.Info("gopher: %s", r.Selector)
 		}()
 
 		err := f(h.app.App(), w, r)
 		if err != nil {
 			log.Error("failed: %s", err)
 			w.WriteError("the page failed for some reason (see logs)")
 		}
 	}
 }
 
 func sendRedirect(w http.ResponseWriter, code int, location string) int {
 	w.Header().Set("Location", location)
 	w.WriteHeader(code)
 	return code
 }
 
 func cacheControl(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Cache-Control", "public, max-age=604800, immutable")
 		next.ServeHTTP(w, r)
 	})
 }
diff --git a/keys.go b/keys.go
index 7674995..b5896f7 100644
--- a/keys.go
+++ b/keys.go
@@ -1,74 +1,74 @@
 /*
  * Copyright © 2018-2019, 2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/writefreely/key"
 	"os"
 	"path/filepath"
 )
 
 const (
 	keysDir = "keys"
 )
 
 var (
 	emailKeyPath      = filepath.Join(keysDir, "email.aes256")
 	cookieAuthKeyPath = filepath.Join(keysDir, "cookies_auth.aes256")
 	cookieKeyPath     = filepath.Join(keysDir, "cookies_enc.aes256")
 	csrfKeyPath       = filepath.Join(keysDir, "csrf.aes256")
 )
 
 // InitKeys loads encryption keys into memory via the given Apper interface
 func InitKeys(apper Apper) error {
 	log.Info("Loading encryption keys...")
 	err := apper.LoadKeys()
 	if err != nil {
 		return err
 	}
 	return nil
 }
 
 func initKeyPaths(app *App) {
 	emailKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, emailKeyPath)
 	cookieAuthKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, cookieAuthKeyPath)
 	cookieKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, cookieKeyPath)
 	csrfKeyPath = filepath.Join(app.cfg.Server.KeysParentDir, csrfKeyPath)
 }
 
 // generateKey generates a key at the given path used for the encryption of
 // certain user data. Because user data becomes unrecoverable without these
 // keys, this won't overwrite any existing key, and instead outputs a message.
 func generateKey(path string) error {
 	// Check if key file exists
 	if _, err := os.Stat(path); err == nil {
-		log.Info("%s already exists. rm the file if you understand the consquences.", path)
+		log.Info("%s already exists. rm the file if you understand the consequences.", path)
 		return nil
 	} else if !os.IsNotExist(err) {
 		log.Error("%s", err)
 		return err
 	}
 
 	log.Info("Generating %s.", path)
 	b, err := key.GenerateBytes(key.EncKeysBytes)
 	if err != nil {
 		log.Error("FAILED. %s. Run writefreely --gen-keys again.", err)
 		return err
 	}
 	err = os.WriteFile(path, b, 0600)
 	if err != nil {
 		log.Error("FAILED writing file: %s", err)
 		return err
 	}
 	log.Info("Success.")
 	return nil
 }
diff --git a/pages.go b/pages.go
index bf85526..6ebc3dc 100644
--- a/pages.go
+++ b/pages.go
@@ -1,198 +1,198 @@
 /*
  * Copyright © 2018-2019, 2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"github.com/writefreely/writefreely/config"
 	"time"
 )
 
 var defaultPageUpdatedTime = time.Date(2018, 11, 8, 12, 0, 0, 0, time.Local)
 
 func getAboutPage(app *App) (*instanceContent, error) {
 	c, err := app.db.GetDynamicContent("about")
 	if err != nil {
 		return nil, err
 	}
 	if c == nil {
 		c = &instanceContent{
 			ID:      "about",
 			Type:    "page",
 			Content: defaultAboutPage(app.cfg),
 		}
 	}
 	if !c.Title.Valid {
 		c.Title = defaultAboutTitle(app.cfg)
 	}
 	return c, nil
 }
 
 func defaultAboutTitle(cfg *config.Config) sql.NullString {
 	return sql.NullString{String: "About " + cfg.App.SiteName, Valid: true}
 }
 
 func getContactPage(app *App) (*instanceContent, error) {
 	c, err := app.db.GetDynamicContent("contact")
 	if err != nil {
 		return nil, err
 	}
 	if c == nil {
 		c = &instanceContent{
 			ID:      "contact",
 			Type:    "page",
 			Content: defaultContactPage(app),
 		}
 	}
 	if !c.Title.Valid {
 		c.Title = defaultContactTitle()
 	}
 	return c, nil
 }
 
 func defaultContactTitle() sql.NullString {
 	return sql.NullString{String: "Contact Us", Valid: true}
 }
 
 func getPrivacyPage(app *App) (*instanceContent, error) {
 	c, err := app.db.GetDynamicContent("privacy")
 	if err != nil {
 		return nil, err
 	}
 	if c == nil {
 		c = &instanceContent{
 			ID:      "privacy",
 			Type:    "page",
 			Content: defaultPrivacyPolicy(app.cfg),
 			Updated: defaultPageUpdatedTime,
 		}
 	}
 	if !c.Title.Valid {
 		c.Title = defaultPrivacyTitle()
 	}
 	return c, nil
 }
 
 func defaultPrivacyTitle() sql.NullString {
 	return sql.NullString{String: "Privacy Policy", Valid: true}
 }
 
 func defaultAboutPage(cfg *config.Config) string {
 	if cfg.App.Federation {
 		return `_` + cfg.App.SiteName + `_ is an interconnected place for you to write and publish, powered by [WriteFreely](https://writefreely.org) and ActivityPub.`
 	}
 	return `_` + cfg.App.SiteName + `_ is a place for you to write and publish, powered by [WriteFreely](https://writefreely.org).`
 }
 
 func defaultContactPage(app *App) string {
 	c, err := app.db.GetCollectionByID(1)
 	if err != nil {
 		return ""
 	}
 	return `_` + app.cfg.App.SiteName + `_ is administered by: [**` + c.Alias + `**](/` + c.Alias + `/).
 
 Contact them at this email address: _EMAIL GOES HERE_.
 
 You can also reach them here...`
 }
 
 func defaultPrivacyPolicy(cfg *config.Config) string {
 	return `[WriteFreely](https://writefreely.org), the software that powers this site, is built to enforce your right to privacy by default.
 
 It retains as little data about you as possible, not even requiring an email address to sign up. However, if you _do_ give us your email address, it is stored encrypted in our database. We salt and hash your account's password.
 
-We store log files, or data about what happens on our servers. We also use cookies to keep you logged in to your account.
+We store log files, or data about what happens on our servers. We also use cookies to keep you logged into your account.
 
 Beyond this, it's important that you trust whoever runs **` + cfg.App.SiteName + `**. Software can only do so much to protect you -- your level of privacy protections will ultimately fall on the humans that run this particular service.`
 }
 
 func getLandingBanner(app *App) (*instanceContent, error) {
 	c, err := app.db.GetDynamicContent("landing-banner")
 	if err != nil {
 		return nil, err
 	}
 	if c == nil {
 		c = &instanceContent{
 			ID:      "landing-banner",
 			Type:    "section",
 			Content: defaultLandingBanner(app.cfg),
 			Updated: defaultPageUpdatedTime,
 		}
 	}
 	return c, nil
 }
 
 func getLandingBody(app *App) (*instanceContent, error) {
 	c, err := app.db.GetDynamicContent("landing-body")
 	if err != nil {
 		return nil, err
 	}
 	if c == nil {
 		c = &instanceContent{
 			ID:      "landing-body",
 			Type:    "section",
 			Content: defaultLandingBody(app.cfg),
 			Updated: defaultPageUpdatedTime,
 		}
 	}
 	return c, nil
 }
 
 func defaultLandingBanner(cfg *config.Config) string {
 	if cfg.App.Federation {
 		return "# Start your blog in the fediverse"
 	}
 	return "# Start your blog"
 }
 
 func defaultLandingBody(cfg *config.Config) string {
 	if cfg.App.Federation {
 		return `## Join the Fediverse
 
 The fediverse is a large network of platforms that all speak a common language. Imagine if you could reply to Instagram posts from Twitter, or interact with your favorite Medium blogs from Facebook -- federated alternatives like [PixelFed](https://pixelfed.org), [Mastodon](https://joinmastodon.org), and WriteFreely enable you to do these types of things.
 
 <div style="text-align:center">
 	<iframe style="width: 560px; height: 315px; max-width: 100%;" sandbox="allow-same-origin allow-scripts" src="https://video.writeas.org/videos/embed/cc55e615-d204-417c-9575-7b57674cc6f3" frameborder="0" allowfullscreen></iframe>
 </div>
 
 ## Write More Socially
 
 WriteFreely can communicate with other federated platforms like Mastodon, so people can follow your blogs, bookmark their favorite posts, and boost them to their followers. Sign up above to create a blog and join the fediverse.`
 	}
 	return ""
 }
 
 func getReaderSection(app *App) (*instanceContent, error) {
 	c, err := app.db.GetDynamicContent("reader")
 	if err != nil {
 		return nil, err
 	}
 	if c == nil {
 		c = &instanceContent{
 			ID:      "reader",
 			Type:    "section",
 			Content: defaultReaderBanner(app.cfg),
 			Updated: defaultPageUpdatedTime,
 		}
 	}
 	if !c.Title.Valid {
 		c.Title = defaultReaderTitle(app.cfg)
 	}
 	return c, nil
 }
 
 func defaultReaderTitle(cfg *config.Config) sql.NullString {
 	return sql.NullString{String: "Reader", Valid: true}
 }
 
 func defaultReaderBanner(cfg *config.Config) string {
 	return "Read the latest posts from " + cfg.App.SiteName + "."
 }
diff --git a/pages/login.tmpl b/pages/login.tmpl
index f0a54eb..0fe29a1 100644
--- a/pages/login.tmpl
+++ b/pages/login.tmpl
@@ -1,36 +1,36 @@
 {{define "head"}}<title>Log in &mdash; {{.SiteName}}</title>
-<meta name="description" content="Log in to {{.SiteName}}.">
-<meta itemprop="description" content="Log in to {{.SiteName}}.">
+<meta name="description" content="Log into {{.SiteName}}.">
+<meta itemprop="description" content="Log into {{.SiteName}}.">
 <style>
 input{margin-bottom:0.5em;}
 </style>
 {{end}}
 {{define "content"}}
 <div class="tight content-container">
-	<h1>Log in to {{.SiteName}}</h1>
+	<h1>Log into {{.SiteName}}</h1>
 
 	{{if .Flashes}}<ul class="errors">
 		{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
 	</ul>{{end}}
 
 	{{template "oauth-buttons" .}}
 
 {{if not .DisablePasswordAuth}}
 	<form action="/auth/login" method="post" style="text-align: center;margin-top:1em;" onsubmit="disableSubmit()">
 		<input type="text" name="alias" placeholder="Username" value="{{.LoginUsername}}" {{if not .LoginUsername}}autofocus{{end}} /><br />
 		<input type="password" name="pass" placeholder="Password" {{if .LoginUsername}}autofocus{{end}} /><br />
 		{{if .To}}<input type="hidden" name="to" value="{{.To}}" />{{end}}
 		<input type="submit" id="btn-login" value="Login" />
 	</form>
 
 	{{if and (not .SingleUser) .OpenRegistration}}<p style="text-align:center;font-size:0.9em;margin:3em auto;max-width:26em;">{{if .Message}}{{.Message}}{{else}}<em>No account yet?</em> <a href="{{.SignupPath}}">Sign up</a> to start a blog.{{end}}</p>{{end}}
 
 	<script type="text/javascript">
 	function disableSubmit() {
 		var $btn = document.getElementById("btn-login");
 		$btn.value = "Logging in...";
 		$btn.disabled = true;
 	}
 	</script>
 	{{end}}
 {{end}}
diff --git a/posts.go b/posts.go
index 74bdb7c..c9ac6ec 100644
--- a/posts.go
+++ b/posts.go
@@ -1,1642 +1,1642 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strings"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/guregu/null"
 	"github.com/guregu/null/zero"
 	"github.com/kylemcc/twitter-text-go/extract"
 	"github.com/microcosm-cc/bluemonday"
 	stripmd "github.com/writeas/go-strip-markdown/v2"
 	"github.com/writeas/impart"
 	"github.com/writeas/monday"
 	"github.com/writeas/slug"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/bots"
 	"github.com/writeas/web-core/converter"
 	"github.com/writeas/web-core/i18n"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/tags"
 	"github.com/writefreely/writefreely/page"
 	"github.com/writefreely/writefreely/parse"
 )
 
 const (
 	// Post ID length bounds
 	minIDLen      = 10
 	maxIDLen      = 10
 	userPostIDLen = 10
 	postIDLen     = 10
 
 	postMetaDateFormat = "2006-01-02 15:04:05"
 
 	shortCodePaid = "<!--paid-->"
 )
 
 type (
 	AnonymousPost struct {
 		ID          string
 		Content     string
 		HTMLContent template.HTML
 		Font        string
 		Language    string
 		Direction   string
 		Title       string
 		GenTitle    string
 		Description string
 		Author      string
 		Views       int64
 		Images      []string
 		IsPlainText bool
 		IsCode      bool
 		IsLinkable  bool
 	}
 
 	AuthenticatedPost struct {
 		ID  string `json:"id" schema:"id"`
 		Web bool   `json:"web" schema:"web"`
 		*SubmittedPost
 	}
 
 	// SubmittedPost represents a post supplied by a client for publishing or
 	// updating. Since Title and Content can be updated to "", they are
 	// pointers that can be easily tested to detect changes.
 	SubmittedPost struct {
 		Slug     *string                  `json:"slug" schema:"slug"`
 		Title    *string                  `json:"title" schema:"title"`
 		Content  *string                  `json:"body" schema:"body"`
 		Font     string                   `json:"font" schema:"font"`
 		IsRTL    converter.NullJSONBool   `json:"rtl" schema:"rtl"`
 		Language converter.NullJSONString `json:"lang" schema:"lang"`
 		Created  *string                  `json:"created" schema:"created"`
 	}
 
 	// Post represents a post as found in the database.
 	Post struct {
 		ID             string        `db:"id" json:"id"`
 		Slug           null.String   `db:"slug" json:"slug,omitempty"`
 		Font           string        `db:"text_appearance" json:"appearance"`
 		Language       zero.String   `db:"language" json:"language"`
 		RTL            zero.Bool     `db:"rtl" json:"rtl"`
 		Privacy        int64         `db:"privacy" json:"-"`
 		OwnerID        null.Int      `db:"owner_id" json:"-"`
 		CollectionID   null.Int      `db:"collection_id" json:"-"`
 		PinnedPosition null.Int      `db:"pinned_position" json:"-"`
 		Created        time.Time     `db:"created" json:"created"`
 		Updated        time.Time     `db:"updated" json:"updated"`
 		ViewCount      int64         `db:"view_count" json:"-"`
 		Title          zero.String   `db:"title" json:"title"`
 		HTMLTitle      template.HTML `db:"title" json:"-"`
 		Content        string        `db:"content" json:"body"`
 		HTMLContent    template.HTML `db:"content" json:"-"`
 		HTMLExcerpt    template.HTML `db:"content" json:"-"`
 		Tags           []string      `json:"tags"`
 		Images         []string      `json:"images,omitempty"`
 		IsPaid         bool          `json:"paid"`
 
 		OwnerName string `json:"owner,omitempty"`
 	}
 
 	// PublicPost holds properties for a publicly returned post, i.e. a post in
 	// a context where the viewer may not be the owner. As such, sensitive
 	// metadata for the post is hidden and properties supporting the display of
 	// the post are added.
 	PublicPost struct {
 		*Post
 		IsSubdomain bool           `json:"-"`
 		IsTopLevel  bool           `json:"-"`
 		DisplayDate string         `json:"-"`
 		Views       int64          `json:"views"`
 		Owner       *PublicUser    `json:"-"`
 		IsOwner     bool           `json:"-"`
 		URL         string         `json:"url,omitempty"`
 		Collection  *CollectionObj `json:"collection,omitempty"`
 	}
 
 	CollectionPostPage struct {
 		*PublicPost
 		page.StaticPage
 		IsOwner        bool
 		IsPinned       bool
 		IsCustomDomain bool
 		Monetization   string
 		Verification   string
 		PinnedPosts    *[]PublicPost
 		IsFound        bool
 		IsAdmin        bool
 		CanInvite      bool
 		Silenced       bool
 
 		// Helper field for Chorus mode
 		CollAlias string
 	}
 
 	RawPost struct {
 		Id, Slug     string
 		Title        string
 		Content      string
 		Views        int64
 		Font         string
 		Created      time.Time
 		Updated      time.Time
 		IsRTL        sql.NullBool
 		Language     sql.NullString
 		OwnerID      int64
 		CollectionID sql.NullInt64
 
 		Found bool
 		Gone  bool
 	}
 
 	AnonymousAuthPost struct {
 		ID    string `json:"id"`
 		Token string `json:"token"`
 	}
 	ClaimPostRequest struct {
 		*AnonymousAuthPost
 		CollectionAlias  string `json:"collection"`
 		CreateCollection bool   `json:"create_collection"`
 
 		// Generated properties
 		Slug string `json:"-"`
 	}
 	ClaimPostResult struct {
 		ID           string      `json:"id,omitempty"`
 		Code         int         `json:"code,omitempty"`
 		ErrorMessage string      `json:"error_msg,omitempty"`
 		Post         *PublicPost `json:"post,omitempty"`
 	}
 )
 
 func (p *Post) Direction() string {
 	if p.RTL.Valid {
 		if p.RTL.Bool {
 			return "rtl"
 		}
 		return "ltr"
 	}
 	return "auto"
 }
 
 // DisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) DisplayTitle() string {
 	if p.Title.String != "" {
 		return p.Title.String
 	}
 	t := friendlyPostTitle(p.Content, p.ID)
 	return t
 }
 
 // PlainDisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) PlainDisplayTitle() string {
 	if t := stripmd.Strip(p.DisplayTitle()); t != "" {
 		return t
 	}
 	return p.ID
 }
 
 // FormattedDisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) FormattedDisplayTitle() template.HTML {
 	if p.HTMLTitle != "" {
 		return p.HTMLTitle
 	}
 	return template.HTML(p.DisplayTitle())
 }
 
 // Summary gives a shortened summary of the post based on the post's title,
 // especially for display in a longer list of posts. It extracts a summary for
 // posts in the Title\n\nBody format, returning nothing if the entire was short
 // enough that the extracted title == extracted summary.
 func (p Post) Summary() string {
 	if p.Content == "" {
 		return ""
 	}
 	p.Content = stripHTMLWithoutEscaping(p.Content)
 	// and Markdown
 	p.Content = stripmd.StripOptions(p.Content, stripmd.Options{SkipImages: true})
 
 	title := p.Title.String
 	var desc string
 	if title == "" {
 		// No title, so generate one
 		title = friendlyPostTitle(p.Content, p.ID)
 		desc = postDescription(p.Content, title, p.ID)
 		if desc == title {
 			return ""
 		}
 		return desc
 	}
 
 	return shortPostDescription(p.Content)
 }
 
 func (p Post) SummaryHTML() template.HTML {
 	return template.HTML(p.Summary())
 }
 
 // Excerpt shows any text that comes before a (more) tag.
 // TODO: use HTMLExcerpt in templates instead of this method
 func (p *Post) Excerpt() template.HTML {
 	return p.HTMLExcerpt
 }
 
 func (p *Post) CreatedDate() string {
 	return p.Created.Format("2006-01-02")
 }
 
 func (p *Post) Created8601() string {
 	return p.Created.Format("2006-01-02T15:04:05Z")
 }
 
 func (p *Post) IsScheduled() bool {
 	return p.Created.After(time.Now())
 }
 
 func (p *Post) HasTag(tag string) bool {
 	// Regexp looks for tag and has a non-capturing group at the end looking
 	// for the end of the word.
 	// Assisted by: https://stackoverflow.com/a/35192941/1549194
 	hasTag, _ := regexp.MatchString("#"+tag+`(?:[[:punct:]]|\s|\z)`, p.Content)
 	return hasTag
 }
 
 func (p *Post) HasTitleLink() bool {
 	if p.Title.String == "" {
 		return false
 	}
 	hasLink, _ := regexp.MatchString(`([^!]+|^)\[.+\]\(.+\)`, p.Title.String)
 	return hasLink
 }
 
 func (c CollectionPostPage) DisplayMonetization() string {
 	if c.Collection == nil {
 		log.Info("CollectionPostPage.DisplayMonetization: c.Collection is nil")
 		return ""
 	}
 	return displayMonetization(c.Monetization, c.Collection.Alias)
 }
 
 func handleViewPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	friendlyID := vars["post"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw() and viewCollectionPost()
 	isJSON := strings.HasSuffix(friendlyID, ".json")
 	isXML := strings.HasSuffix(friendlyID, ".xml")
 	isCSS := strings.HasSuffix(friendlyID, ".css")
 	isMarkdown := strings.HasSuffix(friendlyID, ".md")
 	isRaw := strings.HasSuffix(friendlyID, ".txt") || isJSON || isXML || isCSS || isMarkdown
 
 	// Display reserved page if that is requested resource
 	if t, ok := pages[r.URL.Path[1:]+".tmpl"]; ok {
 		return handleTemplatedPage(app, w, r, t)
 	} else if (strings.Contains(r.URL.Path, ".") && !isRaw && !isMarkdown) || r.URL.Path == "/robots.txt" || r.URL.Path == "/manifest.json" {
 		// Serve static file
 		app.shttp.ServeHTTP(w, r)
 		return nil
 	}
 
 	// Display collection if this is a collection
 	c, _ := app.db.GetCollection(friendlyID)
 	if c != nil {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", friendlyID)}
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	if friendlyID != strings.ToLower(friendlyID) {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s", strings.ToLower(friendlyID))}
 	}
 
 	ext := ""
 	if isRaw {
 		parts := strings.Split(friendlyID, ".")
 		friendlyID = parts[0]
 		if len(parts) > 1 {
 			ext = "." + parts[1]
 		}
 	}
 
 	var ownerID sql.NullInt64
 	var title string
 	var content string
 	var font string
 	var language []byte
 	var rtl []byte
 	var views int64
 	var post *AnonymousPost
 	var found bool
 	var gone bool
 
 	fixedID := slug.Make(friendlyID)
 	if fixedID != friendlyID {
 		return impart.HTTPError{http.StatusFound, fmt.Sprintf("/%s%s", fixedID, ext)}
 	}
 
 	err := app.db.QueryRow("SELECT owner_id, title, content, text_appearance, view_count, language, rtl FROM posts WHERE id = ?", friendlyID).Scan(&ownerID, &title, &content, &font, &views, &language, &rtl)
 	switch {
 	case err == sql.ErrNoRows:
 		found = false
 
 		// Output the error in the correct format
 		if isJSON {
 			content = "{\"error\": \"Post not found.\"}"
 		} else if isRaw {
 			content = "Post not found."
 		} else {
 			return ErrPostNotFound
 		}
 	case err != nil:
 		found = false
 
 		log.Error("Post loading err: %s\n", err)
 		return ErrInternalGeneral
 	default:
 		found = true
 
 		var d string
 		if len(rtl) == 0 {
 			d = "auto"
 		} else if rtl[0] == 49 {
 			// TODO: find a cleaner way to get this (possibly NULL) value
 			d = "rtl"
 		} else {
 			d = "ltr"
 		}
 		generatedTitle := friendlyPostTitle(content, friendlyID)
 		sanitizedContent := content
 		if font != "code" {
 			sanitizedContent = template.HTMLEscapeString(content)
 		}
 		var desc string
 		if title == "" {
 			desc = postDescription(content, title, friendlyID)
 		} else {
 			desc = shortPostDescription(content)
 		}
 		post = &AnonymousPost{
 			ID:          friendlyID,
 			Content:     sanitizedContent,
 			Title:       title,
 			GenTitle:    generatedTitle,
 			Description: desc,
 			Author:      "",
 			Font:        font,
 			IsPlainText: isRaw,
 			IsCode:      font == "code",
 			IsLinkable:  font != "code",
 			Views:       views,
 			Language:    string(language),
 			Direction:   d,
 		}
 		if !isRaw {
 			post.HTMLContent = template.HTML(applyMarkdown([]byte(content), "", app.cfg))
 			post.Images = extractImages(post.Content)
 		}
 	}
 
 	var silenced bool
 	if found {
 		silenced, err = app.db.IsUserSilenced(ownerID.Int64)
 		if err != nil {
 			log.Error("view post: %v", err)
 		}
 	}
 
 	// Check if post has been unpublished
 	if title == "" && content == "" {
 		gone = true
 
 		if isJSON {
 			content = "{\"error\": \"Post was unpublished.\"}"
 		} else if isCSS {
 			content = ""
 		} else if isRaw {
 			content = "Post was unpublished."
 		} else {
 			return ErrPostUnpublished
 		}
 	}
 
 	var u = &User{}
 	if isRaw {
 		contentType := "text/plain"
 		if isJSON {
 			contentType = "application/json"
 		} else if isCSS {
 			contentType = "text/css"
 		} else if isXML {
 			contentType = "application/xml"
 		} else if isMarkdown {
 			contentType = "text/markdown"
 		}
 		w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
 		if isMarkdown && post.Title != "" {
 			fmt.Fprintf(w, "%s\n", post.Title)
 			for i := 1; i <= len(post.Title); i++ {
 				fmt.Fprintf(w, "=")
 			}
 			fmt.Fprintf(w, "\n\n")
 		}
 		fmt.Fprint(w, content)
 
 		if !found {
 			return ErrPostNotFound
 		} else if gone {
 			return ErrPostUnpublished
 		}
 	} else {
 		var err error
 		page := struct {
 			*AnonymousPost
 			page.StaticPage
 			Username string
 			IsOwner  bool
 			SiteURL  string
 			Silenced bool
 		}{
 			AnonymousPost: post,
 			StaticPage:    pageForReq(app, r),
 			SiteURL:       app.cfg.App.Host,
 		}
 		if u = getUserSession(app, r); u != nil {
 			page.Username = u.Username
 			page.IsOwner = ownerID.Valid && ownerID.Int64 == u.ID
 		}
 
 		if !page.IsOwner && silenced {
 			return ErrPostNotFound
 		}
 		page.Silenced = silenced
 		err = templates["post"].ExecuteTemplate(w, "post", page)
 		if err != nil {
 			log.Error("Post template execute error: %v", err)
 		}
 	}
 
 	go func() {
 		if u != nil && ownerID.Valid && ownerID.Int64 == u.ID {
 			// Post is owned by someone; skip view increment since that person is viewing this post.
 			return
 		}
 		// Update stats for non-raw post views
 		if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
 			_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE id = ?", friendlyID)
 			if err != nil {
 				log.Error("Unable to update posts count: %v", err)
 			}
 		}
 	}()
 
 	return nil
 }
 
 // API v2 funcs
 // newPost creates a new post with or without an owning Collection.
 //
 // Endpoints:
 //   - /posts
 //   - /posts?collection={alias}
 //   - ? /collections/{alias}/posts
 func newPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 	if collAlias == "" {
 		collAlias = r.FormValue("collection")
 	}
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		// TODO: remove this
 		accessToken = r.FormValue("access_token")
 	}
 
 	// FIXME: determine web submission with Content-Type header
 	var u *User
 	var userID int64 = -1
 	var username string
 	if accessToken == "" {
 		u = getUserSession(app, r)
 		if u != nil {
 			userID = u.ID
 			username = u.Username
 		}
 	} else {
 		userID = app.db.GetUserID(accessToken)
 	}
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("new post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	if userID == -1 {
 		return ErrNotLoggedIn
 	}
 
 	if accessToken == "" && u == nil && collAlias != "" {
 		return impart.HTTPError{http.StatusBadRequest, "Parameter `access_token` required."}
 	}
 
 	// Get post data
 	var p *SubmittedPost
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&p)
 		if err != nil {
 			log.Error("Couldn't parse new post JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 		if p.Title == nil {
 			t := ""
 			p.Title = &t
 		}
 		if strings.TrimSpace(*(p.Title)) == "" && (p.Content == nil || strings.TrimSpace(*(p.Content)) == "") {
 			return ErrNoPublishableContent
 		}
 		if p.Content == nil {
 			c := ""
 			p.Content = &c
 		}
 
 	} else {
 		post := r.FormValue("body")
 		appearance := r.FormValue("font")
 		title := r.FormValue("title")
 		rtlValue := r.FormValue("rtl")
 		langValue := r.FormValue("lang")
 		if strings.TrimSpace(post) == "" {
 			return ErrNoPublishableContent
 		}
 
 		var isRTL, rtlValid bool
 		if rtlValue == "auto" && langValue != "" {
 			isRTL = i18n.LangIsRTL(langValue)
 			rtlValid = true
 		} else {
 			isRTL = rtlValue == "true"
 			rtlValid = rtlValue != "" && langValue != ""
 		}
 
 		// Create a new post
 		p = &SubmittedPost{
 			Title:    &title,
 			Content:  &post,
 			Font:     appearance,
 			IsRTL:    converter.NullJSONBool{sql.NullBool{Bool: isRTL, Valid: rtlValid}},
 			Language: converter.NullJSONString{sql.NullString{String: langValue, Valid: langValue != ""}},
 		}
 	}
 	if !p.isFontValid() {
 		p.Font = "norm"
 	}
 
 	var newPost *PublicPost = &PublicPost{}
 	var coll *Collection
 	if accessToken != "" {
 		newPost, err = app.db.CreateOwnedPost(p, accessToken, collAlias, app.cfg.App.Host)
 	} else {
 		//return ErrNotLoggedIn
 		// TODO: verify user is logged in
 		var collID int64
 		if collAlias != "" {
 			coll, err = app.db.GetCollection(collAlias)
 			if err != nil {
 				return err
 			}
 			coll.hostName = app.cfg.App.Host
 			if coll.OwnerID != u.ID {
 				return ErrForbiddenCollection
 			}
 			collID = coll.ID
 		}
 		// TODO: return PublicPost from createPost
 		newPost.Post, err = app.db.CreatePost(userID, collID, p)
 	}
 	if err != nil {
 		return err
 	}
 	if coll != nil {
 		coll.ForPublic()
 		newPost.Collection = &CollectionObj{Collection: *coll}
 	}
 
 	newPost.extractData()
 	newPost.OwnerName = username
 	newPost.URL = newPost.CanonicalURL(app.cfg.App.Host)
 
 	// Write success now
 	response := impart.WriteSuccess(w, newPost, http.StatusCreated)
 
 	if newPost.Collection != nil && !app.cfg.App.Private && app.cfg.App.Federation && !newPost.Created.After(time.Now()) {
 		go federatePost(app, newPost, newPost.Collection.ID, false)
 	}
 
 	return response
 }
 
 func existingPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	postID := vars["post"]
 
 	p := AuthenticatedPost{ID: postID}
 	var err error
 
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&p)
 		if err != nil {
 			log.Error("Couldn't parse post update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse post update form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		// Can't decode to a nil SubmittedPost property, so create instance now
 		p.SubmittedPost = &SubmittedPost{}
 		err = app.formDecoder.Decode(&p, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode post update form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	if p.Web {
 		p.IsRTL.Valid = true
 	}
 
 	if p.SubmittedPost == nil {
 		return ErrPostNoUpdatableVals
 	}
 
 	// Ensure an access token was given
 	accessToken := r.Header.Get("Authorization")
 	// Get user's cookie session if there's no token
 	var u *User
 	//var username string
 	if accessToken == "" {
 		u = getUserSession(app, r)
 		if u != nil {
 			//username = u.Username
 		}
 	}
 	if u == nil && accessToken == "" {
 		return ErrNoAccessToken
 	}
 
 	// Get user ID from current session or given access token, if one was given.
 	var userID int64
 	if u != nil {
 		userID = u.ID
 	} else if accessToken != "" {
 		userID, err = AuthenticateUser(app.db, accessToken)
 		if err != nil {
 			return err
 		}
 	}
 
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("existing post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	// Modify post struct
 	p.ID = postID
 
 	err = app.db.UpdateOwnedPost(&p, userID)
 	if err != nil {
 		if reqJSON {
 			return err
 		}
 
 		if err, ok := err.(impart.HTTPError); ok {
 			addSessionFlash(app, w, r, err.Message, nil)
 		} else {
 			addSessionFlash(app, w, r, err.Error(), nil)
 		}
 	}
 
 	var pRes *PublicPost
 	pRes, err = app.db.GetPost(p.ID, 0)
 	if reqJSON {
 		if err != nil {
 			return err
 		}
 		pRes.extractData()
 	}
 
 	if pRes.CollectionID.Valid {
 		coll, err := app.db.GetCollectionBy("id = ?", pRes.CollectionID.Int64)
 		if err == nil && !app.cfg.App.Private && app.cfg.App.Federation {
 			coll.hostName = app.cfg.App.Host
 			pRes.Collection = &CollectionObj{Collection: *coll}
 			go federatePost(app, pRes, pRes.Collection.ID, true)
 		}
 	}
 
 	// Write success now
 	if reqJSON {
 		return impart.WriteSuccess(w, pRes, http.StatusOK)
 	}
 
 	addSessionFlash(app, w, r, "Changes saved.", nil)
 	collectionAlias := vars["alias"]
 	redirect := "/" + postID + "/meta"
 	if collectionAlias != "" {
 		collPre := "/" + collectionAlias
 		if app.cfg.App.SingleUser {
 			collPre = ""
 		}
 		redirect = collPre + "/" + pRes.Slug.String + "/edit/meta"
 	} else {
 		if app.cfg.App.SingleUser {
 			redirect = "/d" + redirect
 		}
 	}
 	w.Header().Set("Location", redirect)
 	w.WriteHeader(http.StatusFound)
 
 	return nil
 }
 
 func deletePost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	friendlyID := vars["post"]
 	editToken := r.FormValue("token")
 
 	var ownerID int64
 	var u *User
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" && editToken == "" {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNoAccessToken
 		}
 	}
 
 	var res sql.Result
 	var t *sql.Tx
 	var err error
 	var collID sql.NullInt64
 	var coll *Collection
 	var pp *PublicPost
 	if editToken != "" {
 		// TODO: SELECT owner_id, as well, and return appropriate error if NULL instead of running two queries
 		var dummy int64
 		err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ?", friendlyID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return impart.HTTPError{http.StatusNotFound, "Post not found."}
 		}
 		err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ? AND owner_id IS NULL", friendlyID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			// Post already has an owner. This could provide a bad experience
 			// for the user, but it's more important to ensure data isn't lost
 			// unexpectedly. So prevent deletion via token.
 			return impart.HTTPError{http.StatusConflict, "This post belongs to some user (hopefully yours). Please log in and delete it from that user's account."}
 		}
 		res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND modify_token = ? AND owner_id IS NULL", friendlyID, editToken)
 	} else if accessToken != "" || u != nil {
 		// Caller provided some way to authenticate; assume caller expects the
 		// post to be deleted based on a specific post owner, thus we should
 		// return corresponding errors.
 		if accessToken != "" {
 			ownerID = app.db.GetUserID(accessToken)
 			if ownerID == -1 {
 				return ErrBadAccessToken
 			}
 		} else {
 			ownerID = u.ID
 		}
 
 		// TODO: don't make two queries
 		var realOwnerID sql.NullInt64
 		err = app.db.QueryRow("SELECT collection_id, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&collID, &realOwnerID)
 		if err != nil {
 			return err
 		}
 		if !collID.Valid {
 			// There's no collection; simply delete the post
 			res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
 		} else {
 			// Post belongs to a collection; do any additional clean up
 			coll, err = app.db.GetCollectionBy("id = ?", collID.Int64)
 			if err != nil {
 				log.Error("Unable to get collection: %v", err)
 				return err
 			}
 			if app.cfg.App.Federation {
 				// First fetch full post for federation
 				pp, err = app.db.GetOwnedPost(friendlyID, ownerID)
 				if err != nil {
 					log.Error("Unable to get owned post: %v", err)
 					return err
 				}
 				collObj := &CollectionObj{Collection: *coll}
 				pp.Collection = collObj
 			}
 
 			t, err = app.db.Begin()
 			if err != nil {
 				log.Error("No begin: %v", err)
 				return err
 			}
 			res, err = t.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
 		}
 	} else {
 		return impart.HTTPError{http.StatusBadRequest, "No authenticated user or post token given."}
 	}
 	if err != nil {
 		return err
 	}
 
 	affected, err := res.RowsAffected()
 	if err != nil {
 		if t != nil {
 			t.Rollback()
 			log.Error("Rows affected err! Rolling back")
 		}
 		return err
 	} else if affected == 0 {
 		if t != nil {
 			t.Rollback()
 			log.Error("No rows affected! Rolling back")
 		}
 		return impart.HTTPError{http.StatusForbidden, "Post not found, or you're not the owner."}
 	}
 	if t != nil {
 		t.Commit()
 	}
 	if coll != nil && !app.cfg.App.Private && app.cfg.App.Federation {
 		go deleteFederatedPost(app, pp, collID.Int64)
 	}
 
 	return impart.HTTPError{Status: http.StatusNoContent}
 }
 
 // addPost associates a post with the authenticated user.
 func addPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var ownerID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		ownerID = app.db.GetUserID(at)
 		if ownerID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		ownerID = u.ID
 	}
 
 	silenced, err := app.db.IsUserSilenced(ownerID)
 	if err != nil {
 		log.Error("add post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	// Parse claimed posts in format:
 	// [{"id": "...", "token": "..."}]
 	var claims *[]ClaimPostRequest
 	decoder := json.NewDecoder(r.Body)
 	err = decoder.Decode(&claims)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 
 	// Update all given posts
 	res, err := app.db.ClaimPosts(app.cfg, ownerID, collAlias, claims)
 	if err != nil {
 		return err
 	}
 
 	if !app.cfg.App.Private && app.cfg.App.Federation {
 		for _, pRes := range *res {
 			if pRes.Code != http.StatusOK {
 				continue
 			}
 			if !pRes.Post.Created.After(time.Now()) {
 				pRes.Post.Collection.hostName = app.cfg.App.Host
 				go federatePost(app, pRes.Post, pRes.Post.Collection.ID, false)
 			}
 		}
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 func dispersePost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var ownerID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		ownerID = app.db.GetUserID(at)
 		if ownerID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		ownerID = u.ID
 	}
 
 	// Parse posts in format:
 	// ["..."]
 	var postIDs []string
 	decoder := json.NewDecoder(r.Body)
 	err := decoder.Decode(&postIDs)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	// Update all given posts
 	res, err := app.db.DispersePosts(ownerID, postIDs)
 	if err != nil {
 		return err
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 type (
 	PinPostResult struct {
 		ID           string `json:"id,omitempty"`
 		Code         int    `json:"code,omitempty"`
 		ErrorMessage string `json:"error_msg,omitempty"`
 	}
 )
 
 // pinPost pins a post to a blog
 func pinPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var userID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		userID = app.db.GetUserID(at)
 		if userID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		userID = u.ID
 	}
 
 	silenced, err := app.db.IsUserSilenced(userID)
 	if err != nil {
 		log.Error("pin post: %v", err)
 	}
 	if silenced {
 		return ErrUserSilenced
 	}
 
 	// Parse request
 	var posts []struct {
 		ID       string `json:"id"`
 		Position int64  `json:"position"`
 	}
 	decoder := json.NewDecoder(r.Body)
 	err = decoder.Decode(&posts)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	// Validate data
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 
 	coll, err := app.db.GetCollection(collAlias)
 	if err != nil {
 		return err
 	}
 	if coll.OwnerID != userID {
 		return ErrForbiddenCollection
 	}
 
 	// Do (un)pinning
 	isPinning := r.URL.Path[strings.LastIndex(r.URL.Path, "/"):] == "/pin"
 	res := []PinPostResult{}
 	for _, p := range posts {
 		err = app.db.UpdatePostPinState(isPinning, p.ID, coll.ID, userID, p.Position)
 		ppr := PinPostResult{ID: p.ID}
 		if err != nil {
 			ppr.Code = http.StatusInternalServerError
-			// TODO: set error messsage
+			// TODO: set error message
 		} else {
 			ppr.Code = http.StatusOK
 		}
 		res = append(res, ppr)
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 func fetchPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var collID int64
 	var coll *Collection
 	var err error
 	vars := mux.Vars(r)
 	if collAlias := vars["alias"]; collAlias != "" {
 		// Fetch collection information, since an alias is provided
 		coll, err = app.db.GetCollection(collAlias)
 		if err != nil {
 			return err
 		}
 		collID = coll.ID
 	}
 
 	p, err := app.db.GetPost(vars["post"], collID)
 	if err != nil {
 		return err
 	}
 	if coll == nil && p.CollectionID.Valid {
 		// Collection post is getting fetched by post ID, not coll alias + post slug, so get coll info now.
 		coll, err = app.db.GetCollectionByID(p.CollectionID.Int64)
 		if err != nil {
 			return err
 		}
 	}
 	if coll != nil {
 		coll.hostName = app.cfg.App.Host
 		_, err = apiCheckCollectionPermissions(app, r, coll)
 		if err != nil {
 			return err
 		}
 	}
 
 	silenced, err := app.db.IsUserSilenced(p.OwnerID.Int64)
 	if err != nil {
 		log.Error("fetch post: %v", err)
 	}
 	if silenced {
 		return ErrPostNotFound
 	}
 
 	p.extractData()
 
 	if IsActivityPubRequest(r) {
 		if coll == nil {
 			// This is a draft post; 404 for now
 			// TODO: return ActivityObject
 			return impart.HTTPError{http.StatusNotFound, ""}
 		}
 
 		p.Collection = &CollectionObj{Collection: *coll}
 		po := p.ActivityObject(app)
 		po.Context = []interface{}{activitystreams.Namespace}
 		setCacheControl(w, apCacheTime)
 		return impart.RenderActivityJSON(w, po, http.StatusOK)
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func fetchPostProperty(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	p, err := app.db.GetPostProperty(vars["post"], 0, vars["property"])
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func (p *Post) processPost() PublicPost {
 	res := &PublicPost{Post: p, Views: 0}
 	res.Views = p.ViewCount
 	// TODO: move to own function
 	loc := monday.FuzzyLocale(p.Language.String)
 	res.DisplayDate = monday.Format(p.Created, monday.LongFormatsByLocale[loc], loc)
 
 	return *res
 }
 
 func (p *PublicPost) CanonicalURL(hostName string) string {
 	if p.Collection == nil || p.Collection.Alias == "" {
 		return hostName + "/" + p.ID + ".md"
 	}
 	return p.Collection.CanonicalURL() + p.Slug.String
 }
 
 func (p *PublicPost) ActivityObject(app *App) *activitystreams.Object {
 	cfg := app.cfg
 	var o *activitystreams.Object
 	if cfg.App.NotesOnly || strings.Index(p.Content, "\n\n") == -1 {
 		o = activitystreams.NewNoteObject()
 	} else {
 		o = activitystreams.NewArticleObject()
 	}
 	o.ID = p.Collection.FederatedAPIBase() + "api/posts/" + p.ID
 	o.Published = p.Created
 	o.URL = p.CanonicalURL(cfg.App.Host)
 	o.AttributedTo = p.Collection.FederatedAccount()
 	o.CC = []string{
 		p.Collection.FederatedAccount() + "/followers",
 	}
 	o.Name = p.DisplayTitle()
 	p.augmentContent()
 	if p.HTMLContent == template.HTML("") {
 		p.formatContent(cfg, false, false)
 		p.augmentReadingDestination()
 	}
 	o.Content = string(p.HTMLContent)
 	if p.Language.Valid {
 		o.ContentMap = map[string]string{
 			p.Language.String: string(p.HTMLContent),
 		}
 	}
 	if len(p.Tags) == 0 {
 		o.Tag = []activitystreams.Tag{}
 	} else {
 		var tagBaseURL string
 		if isSingleUser {
 			tagBaseURL = p.Collection.CanonicalURL() + "tag:"
 		} else {
 			if cfg.App.Chorus {
 				tagBaseURL = fmt.Sprintf("%s/read/t/", p.Collection.hostName)
 			} else {
 				tagBaseURL = fmt.Sprintf("%s/%s/tag:", p.Collection.hostName, p.Collection.Alias)
 			}
 		}
 		for _, t := range p.Tags {
 			o.Tag = append(o.Tag, activitystreams.Tag{
 				Type: activitystreams.TagHashtag,
 				HRef: tagBaseURL + t,
 				Name: "#" + t,
 			})
 		}
 	}
 	if len(p.Images) > 0 {
 		for _, i := range p.Images {
 			o.Attachment = append(o.Attachment, activitystreams.NewImageAttachment(i))
 		}
 	}
 	// Find mentioned users
 	mentionedUsers := make(map[string]string)
 
 	stripper := bluemonday.StrictPolicy()
 	content := stripper.Sanitize(p.Content)
 	mentions := mentionReg.FindAllString(content, -1)
 
 	for _, handle := range mentions {
 		actorIRI, err := app.db.GetProfilePageFromHandle(app, handle)
 		if err != nil {
 			log.Info("Couldn't find user '%s' locally or remotely", handle)
 			continue
 		}
 		mentionedUsers[handle] = actorIRI
 	}
 
 	for handle, iri := range mentionedUsers {
 		o.CC = append(o.CC, iri)
 		o.Tag = append(o.Tag, activitystreams.Tag{Type: "Mention", HRef: iri, Name: handle})
 	}
 	return o
 }
 
 // TODO: merge this into getSlugFromPost or phase it out
 func getSlug(title, lang string) string {
 	return getSlugFromPost("", title, lang)
 }
 
 func getSlugFromPost(title, body, lang string) string {
 	if title == "" {
 		// Remove Markdown, so e.g. link URLs and image alt text don't make it into the slug
 		body = strings.TrimSpace(stripmd.StripOptions(body, stripmd.Options{SkipImages: true}))
 		title = postTitle(body, body)
 	}
 	title = parse.PostLede(title, false)
 	// Truncate lede if needed
 	title, _ = parse.TruncToWord(title, 80)
 	var s string
 	if lang != "" && len(lang) == 2 {
 		s = slug.MakeLang(title, lang)
 	} else {
 		s = slug.Make(title)
 	}
 
 	// Transliteration may cause the slug to expand past the limit, so truncate again
 	s, _ = parse.TruncToWord(s, 80)
 	return strings.TrimFunc(s, func(r rune) bool {
 		// TruncToWord doesn't respect words in a slug, since spaces are replaced
 		// with hyphens. So remove any trailing hyphens.
 		return r == '-'
 	})
 }
 
 // isFontValid returns whether or not the submitted post's appearance is valid.
 func (p *SubmittedPost) isFontValid() bool {
 	validFonts := map[string]bool{
 		"norm": true,
 		"sans": true,
 		"mono": true,
 		"wrap": true,
 		"code": true,
 	}
 
 	_, valid := validFonts[p.Font]
 	return valid
 }
 
 func getRawPost(app *App, friendlyID string) *RawPost {
 	var content, font, title string
 	var isRTL sql.NullBool
 	var lang sql.NullString
 	var ownerID sql.NullInt64
 	var created, updated time.Time
 
 	err := app.db.QueryRow("SELECT title, content, text_appearance, language, rtl, created, updated, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&title, &content, &font, &lang, &isRTL, &created, &updated, &ownerID)
 	switch {
 	case err == sql.ErrNoRows:
 		return &RawPost{Content: "", Found: false, Gone: false}
 	case err != nil:
 		log.Error("Unable to fetch getRawPost: %s", err)
 		return &RawPost{Content: "", Found: true, Gone: false}
 	}
 
 	return &RawPost{
 		Title:    title,
 		Content:  content,
 		Font:     font,
 		Created:  created,
 		Updated:  updated,
 		IsRTL:    isRTL,
 		Language: lang,
 		OwnerID:  ownerID.Int64,
 		Found:    true,
 		Gone:     content == "" && title == "",
 	}
 
 }
 
 // TODO; return a Post!
 func getRawCollectionPost(app *App, slug, collAlias string) *RawPost {
 	var id, title, content, font string
 	var isRTL sql.NullBool
 	var lang sql.NullString
 	var created, updated time.Time
 	var ownerID null.Int
 	var views int64
 	var err error
 
 	if app.cfg.App.SingleUser {
 		err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, updated, owner_id FROM posts WHERE slug = ? AND collection_id = 1", slug).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &updated, &ownerID)
 	} else {
 		err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, updated, owner_id FROM posts WHERE slug = ? AND collection_id = (SELECT id FROM collections WHERE alias = ?)", slug, collAlias).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &updated, &ownerID)
 	}
 	switch {
 	case err == sql.ErrNoRows:
 		return &RawPost{Content: "", Found: false, Gone: false}
 	case err != nil:
 		log.Error("Unable to fetch getRawCollectionPost: %s", err)
 		return &RawPost{Content: "", Found: true, Gone: false}
 	}
 
 	return &RawPost{
 		Id:       id,
 		Slug:     slug,
 		Title:    title,
 		Content:  content,
 		Font:     font,
 		Created:  created,
 		Updated:  updated,
 		IsRTL:    isRTL,
 		Language: lang,
 		OwnerID:  ownerID.Int64,
 		Found:    true,
 		Gone:     content == "" && title == "",
 		Views:    views,
 	}
 }
 
 func isRaw(r *http.Request) bool {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw in viewCollectionPost() and handleViewPost()
 	isJSON := strings.HasSuffix(slug, ".json")
 	isXML := strings.HasSuffix(slug, ".xml")
 	isMarkdown := strings.HasSuffix(slug, ".md")
 	return strings.HasSuffix(slug, ".txt") || isJSON || isXML || isMarkdown
 }
 
 func viewCollectionPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw() and handleViewPost()
 	isJSON := strings.HasSuffix(slug, ".json")
 	isXML := strings.HasSuffix(slug, ".xml")
 	isMarkdown := strings.HasSuffix(slug, ".md")
 	isRaw := strings.HasSuffix(slug, ".txt") || isJSON || isXML || isMarkdown
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	// Check for hellbanned users
 	u, err := checkUserForCollection(app, cr, r, true)
 	if err != nil {
 		return err
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	if slug != strings.ToLower(slug) {
 		loc := fmt.Sprintf("/%s", strings.ToLower(slug))
 		if !app.cfg.App.SingleUser {
 			loc = "/" + cr.alias + loc
 		}
 		return impart.HTTPError{http.StatusMovedPermanently, loc}
 	}
 
 	// Display collection if this is a collection
 	var c *Collection
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(cr.alias)
 	}
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if err.Status == http.StatusNotFound {
 				// Redirect if necessary
 				newAlias := app.db.GetCollectionRedirect(cr.alias)
 				if newAlias != "" {
 					return impart.HTTPError{http.StatusFound, "/" + newAlias + "/" + slug}
 				}
 			}
 		}
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	silenced, err := app.db.IsUserSilenced(c.OwnerID)
 	if err != nil {
 		log.Error("view collection post: %v", err)
 	}
 
 	// Check collection permissions
 	if c.IsPrivate() && (u == nil || u.ID != c.OwnerID) {
 		return ErrPostNotFound
 	}
 	if c.IsProtected() && (u == nil || u.ID != c.OwnerID) {
 		if silenced {
 			return ErrPostNotFound
 		} else if !isAuthorizedForCollection(app, c.Alias, r) {
 			return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
 		}
 	}
 
 	cr.isCollOwner = u != nil && c.OwnerID == u.ID
 
 	if isRaw {
 		slug = strings.Split(slug, ".")[0]
 	}
 
 	// Fetch extra data about the Collection
 	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
 	coll := NewCollectionObj(c)
 	owner, err := app.db.GetUserByID(coll.OwnerID)
 	if err != nil {
 		// Log the error and just continue
 		log.Error("Error getting user for collection: %v", err)
 	} else {
 		coll.Owner = owner
 	}
 
 	postFound := true
 	p, err := app.db.GetPost(slug, coll.ID)
 	if err != nil {
 		if err == ErrCollectionPageNotFound {
 			postFound = false
 
 			if slug == "feed" {
 				// User tried to access blog feed without a trailing slash, and
 				// there's no post with a slug "feed"
 				return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "feed/"}
 			}
 
 			po := &Post{
 				Slug:     null.NewString(slug, true),
 				Font:     "norm",
 				Language: zero.NewString("en", true),
 				RTL:      zero.NewBool(false, true),
 				Content: `<p class="msg">This page is missing.</p>
 
 Are you sure it was ever here?`,
 			}
 			pp := po.processPost()
 			p = &pp
 		} else {
 			return err
 		}
 	}
 
 	// Check if the authenticated user is the post owner
 	p.IsOwner = u != nil && u.ID == p.OwnerID.Int64
 	p.Collection = coll
 	p.IsTopLevel = app.cfg.App.SingleUser
 
 	// Only allow a post owner or admin to view a post for silenced collections
 	if silenced && !p.IsOwner && (u == nil || !u.IsAdmin()) {
 		return ErrPostNotFound
 	}
 
 	// Check if post has been unpublished
 	if p.Content == "" && p.Title.String == "" {
 		return impart.HTTPError{http.StatusGone, "Post was unpublished."}
 	}
 
 	p.augmentContent()
 
 	// Serve collection post
 	if isRaw {
 		contentType := "text/plain"
 		if isJSON {
 			contentType = "application/json"
 		} else if isXML {
 			contentType = "application/xml"
 		} else if isMarkdown {
 			contentType = "text/markdown"
 		}
 		w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
 		if !postFound {
 			w.WriteHeader(http.StatusNotFound)
 			fmt.Fprintf(w, "Post not found.")
 			// TODO: return error instead, so status is correctly reflected in logs
 			return nil
 		}
 		if isMarkdown && p.Title.String != "" {
 			fmt.Fprintf(w, "# %s\n\n", p.Title.String)
 		}
 		fmt.Fprint(w, p.Content)
 	} else if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
 		if !postFound {
 			return ErrCollectionPageNotFound
 		}
 		p.extractData()
 		ap := p.ActivityObject(app)
 		ap.Context = []interface{}{activitystreams.Namespace}
 		setCacheControl(w, apCacheTime)
 		return impart.RenderActivityJSON(w, ap, http.StatusOK)
 	} else {
 		p.extractData()
 		p.Content = strings.Replace(p.Content, "<!--more-->", "", 1)
 		// TODO: move this to function
 		p.formatContent(app.cfg, cr.isCollOwner, true)
 		tp := CollectionPostPage{
 			PublicPost:     p,
 			StaticPage:     pageForReq(app, r),
 			IsOwner:        cr.isCollOwner,
 			IsCustomDomain: cr.isCustomDomain,
 			IsFound:        postFound,
 			Silenced:       silenced,
 			CollAlias:      c.Alias,
 		}
 		tp.IsAdmin = u != nil && u.IsAdmin()
 		tp.CanInvite = canUserInvite(app.cfg, tp.IsAdmin)
 		tp.PinnedPosts, _ = app.db.GetPinnedPosts(coll, p.IsOwner)
 		tp.IsPinned = len(*tp.PinnedPosts) > 0 && PostsContains(tp.PinnedPosts, p)
 		tp.Monetization = coll.Monetization
 		tp.Verification = coll.Verification
 
 		if !postFound {
 			w.WriteHeader(http.StatusNotFound)
 		}
 		postTmpl := "collection-post"
 		if app.cfg.App.Chorus {
 			postTmpl = "chorus-collection-post"
 		}
 		if err := templates[postTmpl].ExecuteTemplate(w, "post", tp); err != nil {
 			log.Error("Error in %s template: %v", postTmpl, err)
 		}
 	}
 
 	go func() {
 		if p.OwnerID.Valid {
 			// Post is owned by someone. Don't update stats if owner is viewing the post.
 			if u != nil && p.OwnerID.Int64 == u.ID {
 				return
 			}
 		}
 		// Update stats for non-raw post views
 		if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
 			_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE slug = ? AND collection_id = ?", slug, coll.ID)
 			if err != nil {
 				log.Error("Unable to update posts count: %v", err)
 			}
 		}
 	}()
 
 	return nil
 }
 
 // TODO: move this to utils after making it more generic
 func PostsContains(sl *[]PublicPost, s *PublicPost) bool {
 	for _, e := range *sl {
 		if e.ID == s.ID {
 			return true
 		}
 	}
 	return false
 }
 
 func (p *Post) extractData() {
 	p.Tags = tags.Extract(p.Content)
 	p.extractImages()
 }
 
 func (rp *RawPost) UserFacingCreated() string {
 	return rp.Created.Format(postMetaDateFormat)
 }
 
 func (rp *RawPost) Created8601() string {
 	return rp.Created.Format("2006-01-02T15:04:05Z")
 }
 
 func (rp *RawPost) Updated8601() string {
 	if rp.Updated.IsZero() {
 		return ""
 	}
 	return rp.Updated.Format("2006-01-02T15:04:05Z")
 }
 
 var imageURLRegex = regexp.MustCompile(`(?i)[^ ]+\.(gif|png|jpg|jpeg|image)$`)
 
 func (p *Post) extractImages() {
 	p.Images = extractImages(p.Content)
 }
 
 func extractImages(content string) []string {
 	matches := extract.ExtractUrls(content)
 	urls := map[string]bool{}
 	for i := range matches {
 		uRaw := matches[i].Text
 		// Parse the extracted text so we can examine the path
 		u, err := url.Parse(uRaw)
 		if err != nil {
 			continue
 		}
 		// Ensure the path looks like it leads to an image file
 		if !imageURLRegex.MatchString(u.Path) {
 			continue
 		}
 		urls[uRaw] = true
 	}
 
 	resURLs := make([]string, 0)
 	for k := range urls {
 		resURLs = append(resURLs, k)
 	}
 	return resURLs
 }
diff --git a/routes.go b/routes.go
index 106221d..c44dbbb 100644
--- a/routes.go
+++ b/routes.go
@@ -1,240 +1,240 @@
 /*
  * Copyright © 2018-2021 Musing Studio LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"net/http"
 	"net/url"
 	"path/filepath"
 	"strings"
 
 	"github.com/gorilla/csrf"
 	"github.com/gorilla/mux"
 	"github.com/writeas/go-webfinger"
 	"github.com/writeas/web-core/log"
 	"github.com/writefreely/go-nodeinfo"
 )
 
 // InitStaticRoutes adds routes for serving static files.
 // TODO: this should just be a func, not method
 func (app *App) InitStaticRoutes(r *mux.Router) {
 	// Handle static files
 	fs := http.FileServer(http.Dir(filepath.Join(app.cfg.Server.StaticParentDir, staticDir)))
 	fs = cacheControl(fs)
 	app.shttp = http.NewServeMux()
 	app.shttp.Handle("/", fs)
 	r.PathPrefix("/").Handler(fs)
 }
 
 // InitRoutes adds dynamic routes for the given mux.Router.
 func InitRoutes(apper Apper, r *mux.Router) *mux.Router {
 	// Create handler
 	handler := NewWFHandler(apper)
 
 	// Set up routes
 	hostSubroute := apper.App().cfg.App.Host[strings.Index(apper.App().cfg.App.Host, "://")+3:]
 	if apper.App().cfg.App.SingleUser {
 		hostSubroute = "{domain}"
 	} else {
 		if strings.HasPrefix(hostSubroute, "localhost") {
 			hostSubroute = "localhost"
 		}
 	}
 
 	if apper.App().cfg.App.SingleUser {
 		log.Info("Adding %s routes (single user)...", hostSubroute)
 	} else {
 		log.Info("Adding %s routes (multi-user)...", hostSubroute)
 	}
 
 	// Primary app routes
 	write := r.PathPrefix("/").Subrouter()
 
 	// Federation endpoint configurations
 	wf := webfinger.Default(wfResolver{apper.App().db, apper.App().cfg})
 	wf.NoTLSHandler = nil
 
 	// Federation endpoints
 	// host-meta
 	write.HandleFunc("/.well-known/host-meta", handler.Web(handleViewHostMeta, UserLevelReader))
 	// webfinger
 	write.HandleFunc(webfinger.WebFingerPath, handler.LogHandlerFunc(http.HandlerFunc(wf.Webfinger)))
 	// nodeinfo
 	niCfg := nodeInfoConfig(apper.App().db, apper.App().cfg)
 	ni := nodeinfo.NewService(*niCfg, nodeInfoResolver{apper.App().cfg, apper.App().db})
 	write.HandleFunc(nodeinfo.NodeInfoPath, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfoDiscover)))
 	write.HandleFunc(niCfg.InfoURL, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfo)))
 
 	// handle mentions
 	write.HandleFunc("/@/{handle}", handler.Web(handleViewMention, UserLevelReader))
 
 	configureSlackOauth(handler, write, apper.App())
 	configureWriteAsOauth(handler, write, apper.App())
 	configureGitlabOauth(handler, write, apper.App())
 	configureGenericOauth(handler, write, apper.App())
 	configureGiteaOauth(handler, write, apper.App())
 
-	// Set up dyamic page handlers
+	// Set up dynamic page handlers
 	// Handle auth
 	auth := write.PathPrefix("/api/auth/").Subrouter()
 	if apper.App().cfg.App.OpenRegistration {
 		auth.HandleFunc("/signup", handler.All(apiSignup)).Methods("POST")
 	}
 	auth.HandleFunc("/login", handler.All(login)).Methods("POST")
 	auth.HandleFunc("/read", handler.WebErrors(handleWebCollectionUnlock, UserLevelNone)).Methods("POST")
 	auth.HandleFunc("/me", handler.All(handleAPILogout)).Methods("DELETE")
 
 	// Handle logged in user sections
 	me := write.PathPrefix("/me").Subrouter()
 	me.HandleFunc("/", handler.Redirect("/me", UserLevelUser))
 	me.HandleFunc("/c", handler.Redirect("/me/c/", UserLevelUser)).Methods("GET")
 	me.HandleFunc("/c/", handler.User(viewCollections)).Methods("GET")
 	me.HandleFunc("/c/{collection}", handler.User(viewEditCollection)).Methods("GET")
 	me.HandleFunc("/c/{collection}/stats", handler.User(viewStats)).Methods("GET")
 	me.Path("/delete").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.User(handleUserDelete))).Methods("POST")
 	me.HandleFunc("/posts", handler.Redirect("/me/posts/", UserLevelUser)).Methods("GET")
 	me.HandleFunc("/posts/", handler.User(viewArticles)).Methods("GET")
 	me.HandleFunc("/posts/export.csv", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/posts/export.zip", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/posts/export.json", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/export", handler.User(viewExportOptions)).Methods("GET")
 	me.HandleFunc("/export.json", handler.Download(viewExportFull, UserLevelUser)).Methods("GET")
 	me.HandleFunc("/import", handler.User(viewImport)).Methods("GET")
 	me.Path("/settings").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.User(viewSettings))).Methods("GET")
 	me.HandleFunc("/invites", handler.User(handleViewUserInvites)).Methods("GET")
 	me.HandleFunc("/logout", handler.Web(viewLogout, UserLevelNone)).Methods("GET")
 
 	write.HandleFunc("/api/me", handler.All(viewMeAPI)).Methods("GET")
 	apiMe := write.PathPrefix("/api/me/").Subrouter()
 	apiMe.HandleFunc("/", handler.All(viewMeAPI)).Methods("GET")
 	apiMe.HandleFunc("/posts", handler.UserWebAPI(viewMyPostsAPI)).Methods("GET")
 	apiMe.HandleFunc("/collections", handler.UserAPI(viewMyCollectionsAPI)).Methods("GET")
 	apiMe.HandleFunc("/password", handler.All(updatePassphrase)).Methods("POST")
 	apiMe.HandleFunc("/self", handler.All(updateSettings)).Methods("POST")
 	apiMe.HandleFunc("/invites", handler.User(handleCreateUserInvite)).Methods("POST")
 	apiMe.HandleFunc("/import", handler.User(handleImport)).Methods("POST")
 	apiMe.HandleFunc("/oauth/remove", handler.User(removeOauth)).Methods("POST")
 
 	// Sign up validation
 	write.HandleFunc("/api/alias", handler.All(handleUsernameCheck)).Methods("POST")
 
 	write.HandleFunc("/api/markdown", handler.All(handleRenderMarkdown)).Methods("POST")
 
 	instanceURL, _ := url.Parse(apper.App().Config().App.Host)
 	host := instanceURL.Host
 
 	// Handle collections
 	write.HandleFunc("/api/collections", handler.All(newCollection)).Methods("POST")
 	apiColls := write.PathPrefix("/api/collections/").Subrouter()
 	apiColls.HandleFunc("/monetization-pointer", handler.PlainTextAPI(handleSPSPEndpoint)).Methods("GET")
 	apiColls.HandleFunc("/"+host, handler.AllReader(fetchCollection)).Methods("GET")
 	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.AllReader(fetchCollection)).Methods("GET")
 	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.All(existingCollection)).Methods("POST", "DELETE")
 	apiColls.HandleFunc("/{alias}/posts", handler.AllReader(fetchCollectionPosts)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/posts", handler.All(newPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/posts/{post}", handler.AllReader(fetchPost)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/posts/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/posts/{post}/splitcontent", handler.AllReader(handleGetSplitContent)).Methods("GET", "POST")
 	apiColls.HandleFunc("/{alias}/posts/{post}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/collect", handler.All(addPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/pin", handler.All(pinPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/unpin", handler.All(pinPost)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/inbox", handler.All(handleFetchCollectionInbox)).Methods("POST")
 	apiColls.HandleFunc("/{alias}/outbox", handler.AllReader(handleFetchCollectionOutbox)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/following", handler.AllReader(handleFetchCollectionFollowing)).Methods("GET")
 	apiColls.HandleFunc("/{alias}/followers", handler.AllReader(handleFetchCollectionFollowers)).Methods("GET")
 
 	// Handle posts
 	write.HandleFunc("/api/posts", handler.All(newPost)).Methods("POST")
 	posts := write.PathPrefix("/api/posts/").Subrouter()
 	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.AllReader(fetchPost)).Methods("GET")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST", "PUT")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(deletePost)).Methods("DELETE")
 	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
 	posts.HandleFunc("/claim", handler.All(addPost)).Methods("POST")
 	posts.HandleFunc("/disperse", handler.All(dispersePost)).Methods("POST")
 
 	write.HandleFunc("/auth/signup", handler.Web(handleWebSignup, UserLevelNoneRequired)).Methods("POST")
 	write.HandleFunc("/auth/login", handler.Web(webLogin, UserLevelNoneRequired)).Methods("POST")
 
 	write.HandleFunc("/admin", handler.Admin(handleViewAdminDash)).Methods("GET")
 	write.HandleFunc("/admin/monitor", handler.Admin(handleViewAdminMonitor)).Methods("GET")
 	write.HandleFunc("/admin/settings", handler.Admin(handleViewAdminSettings)).Methods("GET")
 	write.HandleFunc("/admin/users", handler.Admin(handleViewAdminUsers)).Methods("GET")
 	write.HandleFunc("/admin/user/{username}", handler.Admin(handleViewAdminUser)).Methods("GET")
 	write.HandleFunc("/admin/user/{username}/delete", handler.Admin(handleAdminDeleteUser)).Methods("POST")
 	write.HandleFunc("/admin/user/{username}/status", handler.Admin(handleAdminToggleUserStatus)).Methods("POST")
 	write.HandleFunc("/admin/user/{username}/passphrase", handler.Admin(handleAdminResetUserPass)).Methods("POST")
 	write.HandleFunc("/admin/pages", handler.Admin(handleViewAdminPages)).Methods("GET")
 	write.HandleFunc("/admin/page/{slug}", handler.Admin(handleViewAdminPage)).Methods("GET")
 	write.HandleFunc("/admin/update/config", handler.AdminApper(handleAdminUpdateConfig)).Methods("POST")
 	write.HandleFunc("/admin/update/{page}", handler.Admin(handleAdminUpdateSite)).Methods("POST")
 	write.HandleFunc("/admin/updates", handler.Admin(handleViewAdminUpdates)).Methods("GET")
 
 	// Handle special pages first
 	write.HandleFunc("/login", handler.Web(viewLogin, UserLevelNoneRequired))
 	write.HandleFunc("/signup", handler.Web(handleViewLanding, UserLevelNoneRequired))
 	write.HandleFunc("/invite/{code:[a-zA-Z0-9]+}", handler.Web(handleViewInvite, UserLevelOptional)).Methods("GET")
 	// TODO: show a reader-specific 404 page if the function is disabled
 	write.HandleFunc("/read", handler.Web(viewLocalTimeline, UserLevelReader))
 	RouteRead(handler, UserLevelReader, write.PathPrefix("/read").Subrouter())
 
 	draftEditPrefix := ""
 	if apper.App().cfg.App.SingleUser {
 		draftEditPrefix = "/d"
 		write.HandleFunc("/me/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
 	} else {
 		write.HandleFunc("/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
 	}
 
 	// All the existing stuff
 	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
 	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelUser)).Methods("GET")
 	// Collections
 	if apper.App().cfg.App.SingleUser {
 		RouteCollections(handler, write.PathPrefix("/").Subrouter())
 	} else {
 		write.HandleFunc("/{prefix:[@~$!\\-+]}{collection}", handler.Web(handleViewCollection, UserLevelReader))
 		write.HandleFunc("/{collection}/", handler.Web(handleViewCollection, UserLevelReader))
 		RouteCollections(handler, write.PathPrefix("/{prefix:[@~$!\\-+]?}{collection}").Subrouter())
 		// Posts
 	}
 	write.HandleFunc(draftEditPrefix+"/{post}", handler.Web(handleViewPost, UserLevelOptional))
 	write.HandleFunc("/", handler.Web(handleViewHome, UserLevelOptional))
 
 	return r
 }
 
 func RouteCollections(handler *Handler, r *mux.Router) {
 	r.HandleFunc("/logout", handler.Web(handleLogOutCollection, UserLevelOptional))
 	r.HandleFunc("/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelReader))
 	r.HandleFunc("/lang:{lang:[a-z]{2}}", handler.Web(handleViewCollectionLang, UserLevelOptional))
 	r.HandleFunc("/lang:{lang:[a-z]{2}}/page/{page:[0-9]+}", handler.Web(handleViewCollectionLang, UserLevelOptional))
 	r.HandleFunc("/tag:{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
 	r.HandleFunc("/tag:{tag}/page/{page:[0-9]+}", handler.Web(handleViewCollectionTag, UserLevelReader))
 	r.HandleFunc("/tag:{tag}/feed/", handler.Web(ViewFeed, UserLevelReader))
 	r.HandleFunc("/sitemap.xml", handler.AllReader(handleViewSitemap))
 	r.HandleFunc("/feed/", handler.AllReader(ViewFeed))
 	r.HandleFunc("/{slug}", handler.CollectionPostOrStatic)
 	r.HandleFunc("/{slug}/edit", handler.Web(handleViewPad, UserLevelUser))
 	r.HandleFunc("/{slug}/edit/meta", handler.Web(handleViewMeta, UserLevelUser))
 	r.HandleFunc("/{slug}/", handler.Web(handleCollectionPostRedirect, UserLevelReader)).Methods("GET")
 }
 
 func RouteRead(handler *Handler, readPerm UserLevelFunc, r *mux.Router) {
 	r.HandleFunc("/api/posts", handler.Web(viewLocalTimelineAPI, readPerm))
 	r.HandleFunc("/p/{page}", handler.Web(viewLocalTimeline, readPerm))
 	r.HandleFunc("/feed/", handler.Web(viewLocalTimelineFeed, readPerm))
 	r.HandleFunc("/t/{tag}", handler.Web(viewLocalTimeline, readPerm))
 	r.HandleFunc("/a/{post}", handler.Web(handlePostIDRedirect, readPerm))
 	r.HandleFunc("/{author}", handler.Web(viewLocalTimeline, readPerm))
 	r.HandleFunc("/", handler.Web(viewLocalTimeline, readPerm))
 }
diff --git a/scripts/upgrade-server.sh b/scripts/upgrade-server.sh
index b129943..f010c94 100755
--- a/scripts/upgrade-server.sh
+++ b/scripts/upgrade-server.sh
@@ -1,108 +1,108 @@
 #! /bin/bash
 ###############################################################################
 ##			writefreely update script			     ##
 ##								 	     ##
-##	WARNING: running this script will overwrite any modifed assets or    ##
+##	WARNING: running this script will overwrite any modified assets or   ##
 ##	template files. If you have any custom changes to these files you    ##
 ##	should back them up FIRST.					     ##
 ##									     ##
 ##	This must be run from the web application root directory	     ##
 ##	i.e. /var/www/writefreely, and operates under the assumption that you##
 ##	have not installed the binary `writefreely` in another location.     ##
 ###############################################################################
 #
 #	Copyright © 2019-2020 Musing Studio LLC.
 #
 #	This file is part of WriteFreely.
 #
 #	WriteFreely is free software: you can redistribute it and/or modify
 #	it under the terms of the GNU Affero General Public License, included
 #	in the LICENSE file in this source code package.
 #
 
 
 # only execute as root, or use sudo
 
 if [[ `id -u` -ne 0 ]]; then
 	echo "You must login as root, or execute this script with sudo"
 	exit 10
 fi
 
 # go ahead and check for the latest release on linux
 echo "Checking for updates..."
 
 url=`curl -s https://api.github.com/repos/writeas/writefreely/releases/latest | grep 'browser_' | grep 'linux' | grep 'amd64' | cut -d\" -f4`
 
 # check current version
 
 bin_output=`./writefreely -v`
 if [ -z "$bin_output" ]; then
 	exit 1
 fi
 
 current=${bin_output:12:5}
 echo "Current version is v$current"
 
 # grab latest version number
 IFS='/'
 read -ra parts <<< "$url"
 
 latest=${parts[-2]}
 echo "Latest release is $latest"
 
 
 IFS='.'
 read -ra cv <<< "$current"
 read -ra lv <<< "${latest#v}"
 
 IFS=' '
 tempdir=$(mktemp -d)
 
 
 if [[ ${lv[0]} -gt ${cv[0]} ]]; then
 	echo "New major version available."
 	echo "Downloading..."
 	`wget -P $tempdir -q --show-progress $url`
 elif [[ ${lv[0]} -eq ${cv[0]} ]] && [[ ${lv[1]} -gt ${cv[1]} ]]; then
 	echo "New minor version available."
 	echo "Downloading..."
 	`wget -P $tempdir -q --show-progress $url`
 elif [[ ${lv[2]} -gt ${cv[2]} ]]; then
 	echo "New patch version available."
 	echo "Downloading..."
 	`wget -P $tempdir -q --show-progress $url`
 else
 	echo "Up to date."
 	exit 0
 fi
 
 filename=${parts[-1]}
 
 # extract
 echo "Extracting files..."
 tar -zxf $tempdir/$filename -C $tempdir
 
 # stop service
 echo "Stopping writefreely systemd service..."
 if `systemctl start writefreely`; then
 	echo "Success, service stopped."
 else
 	echo "Upgrade failed to stop the systemd service, exiting early."
 	exit 1
 fi
 
 # copy files
 echo "Copying files..."
 cp -r $tempdir/writefreely/{pages,static,templates,writefreely} .
 
 # migrate db
 ./writefreely -migrate
 
 # restart service
 echo "Starting writefreely systemd service..."
 if `systemctl start writefreely`; then
 	echo "Success, version has been upgraded to $latest."
 else
 	echo "Upgrade complete, but failed to restart service."
 	exit 1
 fi
diff --git a/static/js/README.md b/static/js/README.md
index 7e387db..8497b66 100644
--- a/static/js/README.md
+++ b/static/js/README.md
@@ -1,29 +1,29 @@
 # static/js
 
-This directory is for Javascript.
+This directory is for JavaScript.
 
 ## Updating libraries
 
 Update instructions, for libraries that involve more than just downloading the latest version.
 
 ### highlightjs
 
 To update the highlightjs library, first download a plain package (no languages included) [from highlightjs.org](https://highlightjs.org/download/). The `highlight.pack.js` file in the archive should be moved into this `static/js/` directory and renamed to `highlight.min.js`.
 
 Then [download an archive](https://github.com/highlightjs/highlight.js/releases) of the latest version. Extract it to some directory, and replace **~/Downloads/highlight.js** below with the resulting directory.
 
 ```bash
 #!/bin/bash
 
 version=9.13.1
 
 cd $GOPATH/src/github.com/writefreely/writefreely/static/js/highlightjs
 for f in $(ls ~/Downloads/highlight.js/src/languages); do
 	# Use minified versions
 	f=$(echo $f | sed 's/\.js/.min.js/')
 	# Download the version
 	wget "https://cdnjs.cloudflare.com/ajax/libs/highlight.js/$version/languages/$f"
 done
 ```
 
 Commit the changes and you're done!
diff --git a/templates/bare.tmpl b/templates/bare.tmpl
index a5f9910..cd0fa8c 100644
--- a/templates/bare.tmpl
+++ b/templates/bare.tmpl
@@ -1,266 +1,266 @@
 {{define "pad"}}<!DOCTYPE HTML>
 <html>
 	<head>
 
 		<title>{{if .Editing}}Editing {{if .Post.Title}}{{.Post.Title}}{{else}}{{.Post.Id}}{{end}}{{else}}New Post{{end}} &mdash; {{.SiteName}}</title>
 		
 		<link rel="stylesheet" type="text/css" href="/css/write.css" />
 		{{if .CustomCSS}}<link rel="stylesheet" type="text/css" href="/local/custom.css" />{{end}}
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 
 		<meta name="google" value="notranslate">
 	</head>
 	<body id="pad" class="light">
 
 		<div id="overlay"></div>
 		
 		<textarea id="writer" placeholder="Write..." class="{{.Post.Font}}" autofocus>{{if .Post.Title}}# {{.Post.Title}}
 
 {{end}}{{.Post.Content}}</textarea>
 
 		<div class="alert success hidden" id="edited-elsewhere">This post has been updated elsewhere since you last published! <a href="#" id="erase-edit">Delete draft and reload</a>.</div>
 		
 		<header id="tools">
 			<div id="clip">
 				{{if not .SingleUser}}<h1>{{if .Chorus}}<a href="/" title="Home">{{else}}<a href="/me/c/" title="View blogs">{{end}}{{.SiteName}}</a></h1>{{end}}
 				<nav id="target" {{if .SingleUser}}style="margin-left:0"{{end}}><ul>
 						<li>{{if .Blogs}}<a href="{{$c := index .Blogs 0}}{{$c.CanonicalURL}}">My Posts</a>{{else}}<a>Draft</a>{{end}}</li>
 				</ul></nav>
 				<span id="wc" class="hidden if-room room-4">0 words</span>
 			</div>
-			<noscript style="margin-left: 2em;"><strong>NOTE</strong>: for now, you'll need Javascript enabled to post.</noscript>
+			<noscript style="margin-left: 2em;"><strong>NOTE</strong>: for now, you'll need JavaScript enabled to post.</noscript>
 			<div id="belt">
 				{{if .Editing}}<div class="tool hidden if-room"><a href="{{if .EditCollection}}{{.EditCollection.CanonicalURL}}{{.Post.Slug}}/edit/meta{{else}}/{{if .SingleUser}}d/{{end}}{{.Post.Id}}/meta{{end}}" title="Edit post metadata" id="edit-meta"><img class="ic-24dp" src="/img/ic_info_dark@2x.png" /></a></div>{{end}}
 				<div class="tool"><button title="Publish your writing" id="publish" style="font-weight: bold">Post</button></div>
 			</div>
 		</header>
 
 		<script src="/js/h.js"></script>
 		<script>
 		var $writer = H.getEl('writer');
 		var $btnPublish = H.getEl('publish');
 		var $btnEraseEdit = H.getEl('edited-elsewhere');
 		var $wc = H.getEl("wc");
 		var updateWordCount = function() {
 			var words = 0;
 			var val = $writer.el.value.trim();
 			if (val != '') {
 				words = $writer.el.value.trim().replace(/\s+/gi, ' ').split(' ').length;
 			}
 			$wc.el.innerText = words + " word" + (words != 1 ? "s" : "");
 		};
 		var setButtonStates = function() {
 			if (!canPublish) {
 				$btnPublish.el.className = 'disabled';
 				return;
 			}
 			if ($writer.el.value.length === 0 || (draftDoc != 'lastDoc' && $writer.el.value == origDoc)) {
 				$btnPublish.el.className = 'disabled';
 			} else {
 				$btnPublish.el.className = '';
 			}
 		};
 		{{if .Post.Id}}var draftDoc = 'draft{{.Post.Id}}';
 		var origDoc = '{{.Post.Content}}';{{else}}var draftDoc = 'lastDoc';{{end}}
 		var updatedStr = '{{.Post.Updated8601}}';
 		var updated = null;
 		if (updatedStr != '') {
 			updated = new Date(updatedStr);
 		}
 		var ok = H.load($writer, draftDoc, true, updated);
 		if (!ok) {
 			// Show "edited elsewhere" warning
 			$btnEraseEdit.el.classList.remove('hidden');
 		}
 		var defaultTimeSet = false;
 		updateWordCount();
 		
 		var typingTimer;
 		var doneTypingInterval = 200;
 
 		var posts;
 		{{if and .Post.Id (not .Post.Slug)}}
 		var token = null;
 		var curPostIdx;
 		posts = JSON.parse(H.get('posts', '[]'));
 		for (var i=0; i<posts.length; i++) {
 			if (posts[i].id == "{{.Post.Id}}") {
 				token = posts[i].token;
 				break;
 			}
 		}
 		var canPublish = token != null;
 		{{else}}var canPublish = true;{{end}}
 		var publishing = false;
 		var justPublished = false;
 
 		var publish = function(content, font) {
 			{{if and (and .Post.Id (not .Post.Slug)) (not .User)}}
 			if (!token) {
 				alert("You don't have permission to update this post.");
 				return;
 			}
 			{{end}}
 			publishing = true;
 			$btnPublish.el.textContent = 'Posting...';
 			$btnPublish.el.disabled = true;
 
 			var http = new XMLHttpRequest();
 			var post = H.getTitleStrict(content);
 
 			var params = {
 				body: post.content,
 				title: post.title,
 				font: font
 			};
 			{{ if .Post.Slug }}
 			var url = "/api/collections/{{.EditCollection.Alias}}/posts/{{.Post.Id}}";
 			{{ else if .Post.Id }}
 			var url = "/api/posts/{{.Post.Id}}";
 			if (typeof token === 'undefined' || !token) {
 				token = "";
 			}
 			params.token = token;
 			{{ else }}
 			var lang = navigator.languages ? navigator.languages[0] : (navigator.language || navigator.userLanguage);
 			lang = lang.substring(0, 2);
 			params.lang = lang;
 
 			var url = "/api/posts";
 			var postTarget = '{{if .Blogs}}{{$c := index .Blogs 0}}{{$c.Alias}}{{else}}anonymous{{end}}';
 			if (postTarget != 'anonymous') {
 				url = "/api/collections/" + postTarget + "/posts";
 			}
 			{{ end }}
 
 			http.open("POST", url, true);
 
 			// Send the proper header information along with the request
 			http.setRequestHeader("Content-type", "application/json");
 
 			http.onreadystatechange = function() {
 				if (http.readyState == 4) {
 					publishing = false;
 					if (http.status == 200 || http.status == 201) {
 						data = JSON.parse(http.responseText);
 						id = data.data.id;
 						nextURL = '{{if .SingleUser}}/d{{end}}/'+id;
 						localStorage.setItem('draft'+id+'-published', new Date().toISOString());
 
 						{{ if not .Post.Id }}
 							// Post created
 							if (postTarget != 'anonymous') {
 							  nextURL = {{if not .SingleUser}}'/'+postTarget+{{end}}'/'+data.data.slug;
 							}
 							editToken = data.data.token;
 
 							{{ if not .User }}if (postTarget == 'anonymous') {
 								// Save the data
 								var posts = JSON.parse(H.get('posts', '[]'));
 
 								{{if .Post.Id}}var newPost = H.createPost("{{.Post.Id}}", token, content);
 								for (var i=0; i<posts.length; i++) {
 									if (posts[i].id == "{{.Post.Id}}") {
 										posts[i].title = newPost.title;
 										posts[i].summary = newPost.summary;
 										break;
 									}
 								}
 								nextURL = "/pad/posts";{{else}}posts.push(H.createPost(id, editToken, content));{{end}}
 
 								H.set('posts', JSON.stringify(posts));
 							}
 							{{ end }}
 						{{ end }}
 
 						justPublished = true;
 						if (draftDoc != 'lastDoc') {
 							H.remove(draftDoc);
 							{{if .Editing}}H.remove('draft{{.Post.Id}}font');{{end}}
 						} else {
 							H.set(draftDoc, '');
 						}
 
 						{{if .EditCollection}}
 						window.location = '{{.EditCollection.CanonicalURL}}{{.Post.Slug}}';
 						{{else}}
 						window.location = nextURL;
 						{{end}}
 					} else {
 						$btnPublish.el.textContent = 'Post';
 						alert("Failed to post. Please try again.");
 					}
 				}
 			}
 			http.send(JSON.stringify(params));
 		};
 
 		setButtonStates();
 		$writer.on('keyup input', function() {
 			setButtonStates();
 			clearTimeout(typingTimer);
 			typingTimer = setTimeout(doneTyping, doneTypingInterval);
 		}, false);
 		$writer.on('keydown', function(e) {
 			clearTimeout(typingTimer);
 			if (e.keyCode == 13 && (e.metaKey || e.ctrlKey)) {
 				$btnPublish.el.click();
 			}
 		});
 		$btnPublish.on('click', function(e) {
 			e.preventDefault();
 			if (!publishing && $writer.el.value) {
 				var content = $writer.el.value;
 				publish(content, selectedFont);
 			}
 		});
 		H.getEl('erase-edit').on('click', function(e) {
 			e.preventDefault();
 			H.remove(draftDoc);
 			H.remove(draftDoc+'-published');
 			justPublished = true; // Block auto-save
 			location.reload();
 		});
 
 		WebFontConfig = {
 			custom: { families: [ 'Lora:400,700:latin' ], urls: [ '/css/fonts.css' ] }
 		};
 		var selectedFont = H.get('{{if .Editing}}draft{{.Post.Id}}font{{else}}padFont{{end}}', '{{.Post.Font}}');
 
 		var doneTyping = function() {
 			if (draftDoc == 'lastDoc' || $writer.el.value != origDoc) {
 				H.save($writer, draftDoc);
 				if (!defaultTimeSet) {
 					var lastLocalPublishStr = localStorage.getItem(draftDoc+'-published');
 					if (lastLocalPublishStr == null || lastLocalPublishStr == '') {
 						localStorage.setItem(draftDoc+'-published', updatedStr);
 					}
 					defaultTimeSet = true;
 				}
 				updateWordCount();
 			}
 		};
 		window.addEventListener('beforeunload', function(e) {
 			if (draftDoc != 'lastDoc' && $writer.el.value == origDoc) {
 				H.remove(draftDoc);
 				H.remove(draftDoc+'-published');
 			} else if (!justPublished) {
 				doneTyping();
 			}
 		});
 
 		try {
 		  (function() {
 			var wf=document.createElement('script');
 			wf.src = '/js/webfont.js';
 			wf.type='text/javascript';
 			wf.async='true';
 			var s=document.getElementsByTagName('script')[0];
 			s.parentNode.insertBefore(wf, s);
 		  })();
 		} catch (e) {
 		  // whatevs
 		}
 		</script>
 	</body>
 </html>{{end}}
diff --git a/templates/classic.tmpl b/templates/classic.tmpl
index 7032f58..58f82c7 100644
--- a/templates/classic.tmpl
+++ b/templates/classic.tmpl
@@ -1,402 +1,402 @@
 {{define "pad"}}<!DOCTYPE HTML>
 <html>
 	<head>
 
 		<title>{{if .Editing}}Editing {{if .Post.Title}}{{.Post.Title}}{{else}}{{.Post.Id}}{{end}}{{else}}New Post{{end}} &mdash; {{.SiteName}}</title>
 		
 		<link rel="stylesheet" type="text/css" href="/css/write.css" />
 		<link rel="stylesheet" type="text/css" href="/css/prose.css" />
 		{{if .CustomCSS}}<link rel="stylesheet" type="text/css" href="/local/custom.css" />{{end}}
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 
 		<meta name="google" value="notranslate">
 	</head>
 	<body id="pad" class="light classic">
 
 		<div id="overlay"></div>
 		
 		<!-- <div style="text-align: center"> -->
 		<!-- 	<label style="border-right: 1px solid silver"> -->
 		<!-- 		Markdown <input type=radio name=inputformat value=markdown checked>&nbsp;</label> -->
 		<!-- 	<label>&nbsp;<input type=radio name=inputformat value=prosemirror> WYSIWYM</label> -->
 		<!-- </div> -->
 		<input type="text" id="title" name="title" placeholder="Title..." {{if .Post.Title}}value="{{.Post.Title}}"{{end}} autofocus />
 		<div id="editor" style="margin-bottom: 0"></div>
 
 		<div style="display: none"><textarea id="content"{{if .Post.Content }} value={{.Post.Content}}>{{.Post.Content}}{{else}}>{{end}}</textarea></div>
 		
 		<header id="tools">
 			<div id="clip">
 				{{if not .SingleUser}}<h1><a href="/me/c/" title="View blogs"><img class="ic-24dp" src="/img/ic_blogs_dark@2x.png" /></a></h1>{{end}}
 				<nav id="target" {{if .SingleUser}}style="margin-left:0"{{end}}><ul>
 						{{if .Editing}}<li>{{if .EditCollection}}<a href="{{.EditCollection.CanonicalURL}}">{{.EditCollection.Title}}</a>{{else}}<a>Draft</a>{{end}}</li>
 						{{else}}<li><a id="publish-to"><span id="target-name">Draft</span> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /></a>
 						<ul>
 							<li class="menu-heading">Publish to...</li>
 							{{if .Blogs}}{{range $idx, $el := .Blogs}}
 								<li class="target{{if eq $idx 0}} selected{{end}}" id="blog-{{$el.Alias}}"><a href="#{{$el.Alias}}"><i class="material-icons md-18">public</i> {{if $el.Title}}{{$el.Title}}{{else}}{{$el.Alias}}{{end}}</a></li>
 							{{end}}{{end}}
 							<li class="target" id="blog-anonymous"><a href="#anonymous"><i class="material-icons md-18">description</i> <em>Draft</em></a></li>
 							<li id="user-separator" class="separator"><hr /></li>
 						{{ if .SingleUser }}
 							<li><a href="/"><i class="material-icons md-18">launch</i> View Blog</a></li>
 							<li><a href="/me/c/{{.Username}}"><i class="material-icons md-18">palette</i> Customize</a></li>
 							<li><a href="/me/c/{{.Username}}/stats"><i class="material-icons md-18">trending_up</i> Stats</a></li>
 						{{ else }}
 							<li><a href="/me/c/"><i class="material-icons md-18">library_books</i> View Blogs</a></li>
 						{{ end }}
 							<li><a href="/me/posts/"><i class="material-icons md-18">view_list</i> View Drafts</a></li>
 							<li><a href="/me/logout"><i class="material-icons md-18">power_settings_new</i>  Log out</a></li>
 						</ul>
 					</li>{{end}}
 				</ul></nav>
 				<nav id="font-picker" class="if-room room-3 hidden" style="margin-left:-1em"><ul>
 						<li><a href="#" id="" onclick="return false"><img class="ic-24dp" src="/img/ic_font_dark@2x.png" /> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /></a>
 						<ul style="text-align: center">
 							<li class="menu-heading">Font</li>
 							<li class="selected"><a class="font norm" href="#norm">Serif</a></li>
 							<li><a class="font sans" href="#sans">Sans-serif</a></li>
 							<li><a class="font wrap" href="#wrap">Monospace</a></li>
 						</ul>
 					</li>
 				</ul></nav>
 				<span id="wc" class="hidden if-room room-4">0 words</span>
 			</div>
-			<noscript style="margin-left: 2em;"><strong>NOTE</strong>: for now, you'll need Javascript enabled to post.</noscript>
+			<noscript style="margin-left: 2em;"><strong>NOTE</strong>: for now, you'll need JavaScript enabled to post.</noscript>
 			<div id="belt">
 				{{if .Editing}}<div class="tool hidden if-room"><a href="{{if .EditCollection}}{{.EditCollection.CanonicalURL}}{{.Post.Slug}}/edit/meta{{else}}/{{if .SingleUser}}d/{{end}}{{.Post.Id}}/meta{{end}}" title="Edit post metadata" id="edit-meta"><img class="ic-24dp" src="/img/ic_info_dark@2x.png" /></a></div>{{end}}
 				<div class="tool hidden if-room room-2"><a href="#theme" title="Toggle theme" id="toggle-theme"><img class="ic-24dp" src="/img/ic_brightness_dark@2x.png" /></a></div>
 				<div class="tool if-room room-1"><a href="{{if not .User}}/pad/posts{{else}}/me/posts/{{end}}" title="View posts" id="view-posts"><img class="ic-24dp" src="/img/ic_list_dark@2x.png" /></a></div>
 				<div class="tool"><a href="#publish" title="Publish" id="publish"><img class="ic-24dp" src="/img/ic_send_dark@2x.png" /></a></div>
 			</div>
 		</header>
 
 		<script src="/js/h.js"></script>
 		<script>
 		function toggleTheme() {
 			var btns = Array.prototype.slice.call(document.getElementById('tools').querySelectorAll('a img'));
 			var newTheme = '';
 			if (document.body.classList.contains('light')) {
 				newTheme = 'dark';
 				document.body.className = document.body.className.replace(/(?:^|\s)light(?!\S)/g, newTheme);
 				for (var i=0; i<btns.length; i++) {
 					btns[i].src = btns[i].src.replace('_dark@2x.png', '@2x.png');
 				}
 			} else {
 				newTheme = 'light';
 				document.body.className = document.body.className.replace(/(?:^|\s)dark(?!\S)/g, newTheme);
 				for (var i=0; i<btns.length; i++) {
 					btns[i].src = btns[i].src.replace('@2x.png', '_dark@2x.png');
 				}
 			}
 			H.set('padTheme', newTheme);
 		}
 		if (H.get('padTheme', 'light') != 'light') {
 			toggleTheme();
 		}
 		var $title = H.getEl('title');
 		var $writer = H.getQEl('div.ProseMirror');
 		var $content = H.getEl('content');
 		var $btnPublish = H.getEl('publish');
 		var $wc = H.getEl("wc");
 		var updateWordCount = function() {
 			var words = 0;
 			var val = $content.el.value.trim();
 			if (val != '') {
 				words = $content.el.value.trim().replace(/\s+/gi, ' ').split(' ').length;
 			}
 			val = $title.el.value.trim();
 			if (val != '') {
 				words += $title.el.value.trim().replace(/\s+/gi, ' ').split(' ').length;
 			}
 			$wc.el.innerText = words + " word" + (words != 1 ? "s" : "");
 		};
 		var setButtonStates = function() {
 			if (!canPublish) {
 				$btnPublish.el.className = 'disabled';
 				return;
 			}
 			if ($content.el.value.length === 0 || (draftDoc != 'lastDoc' && $content.el.value == origDoc)) {
 				$btnPublish.el.className = 'disabled';
 			} else {
 				$btnPublish.el.className = '';
 			}
 		};
 		{{if .Post.Id}}var draftDoc = 'draft{{.Post.Id}}';
 		var origDoc = '{{.Post.Content}}';{{else}}var draftDoc = 'lastDoc';{{end}}
 
 		// ProseMirror editor
 		window.draftKey = draftDoc;
 
 		// H.loadClassic($title, $writer, draftDoc, true);
 		updateWordCount();
 		
 		var typingTimer;
 		var doneTypingInterval = 200;
 
 		var posts;
 		{{if and .Post.Id (not .Post.Slug)}}
 		var token = null;
 		var curPostIdx;
 		posts = JSON.parse(H.get('posts', '[]'));
 		for (var i=0; i<posts.length; i++) {
 			if (posts[i].id == "{{.Post.Id}}") {
 				token = posts[i].token;
 				break;
 			}
 		}
 		var canPublish = token != null;
 		{{else}}var canPublish = true;{{end}}
 		var publishing = false;
 		var justPublished = false;
 		var silenced = {{.Silenced}};
 		var publish = function(title, content, font) {
 			if (silenced === true) {
 				alert("Your account is silenced, so you can't publish or update posts.");
 				return;
 			}
 			{{if and (and .Post.Id (not .Post.Slug)) (not .User)}}
 			if (!token) {
 				alert("You don't have permission to update this post.");
 				return;
 			}
 			if ($btnPublish.el.className == 'disabled') {
 				return;
 			}
 			{{end}}
 			$btnPublish.el.children[0].textContent = 'more_horiz';
 			publishing = true;
 			var xpostTarg = H.get('crosspostTarget', '[]');
 
 			var http = new XMLHttpRequest();
 			var post = H.getTitleStrict(content);
 
 			var params = {
 				body: post.content,
 				title: title,
 				font: font
 			};
 			{{ if .Post.Slug }}
 			var url = "/api/collections/{{.EditCollection.Alias}}/posts/{{.Post.Id}}";
 			{{ else if .Post.Id }}
 			var url = "/api/posts/{{.Post.Id}}";
 			if (typeof token === 'undefined' || !token) {
 				token = "";
 			}
 			params.token = token;
 			{{ else }}
 			var lang = navigator.languages ? navigator.languages[0] : (navigator.language || navigator.userLanguage);
 			lang = lang.substring(0, 2);
 			params.lang = lang;
 
 			var url = "/api/posts";
 			var postTarget = H.get('postTarget', 'anonymous');
 			if (postTarget != 'anonymous') {
 				url = "/api/collections/" + postTarget + "/posts";
 			}
 			params.crosspost = JSON.parse(xpostTarg);
 			{{ end }}
 
 			http.open("POST", url, true);
 
 			// Send the proper header information along with the request
 			http.setRequestHeader("Content-type", "application/json");
 
 			http.onreadystatechange = function() {
 				if (http.readyState == 4) {
 					publishing = false;
 					if (http.status == 200 || http.status == 201) {
 						data = JSON.parse(http.responseText);
 						id = data.data.id;
 						nextURL = '{{if .SingleUser}}/d{{end}}/'+id;
 
 						{{ if not .Post.Id }}
 							// Post created
 							if (postTarget != 'anonymous') {
 							  nextURL = {{if not .SingleUser}}'/'+postTarget+{{end}}'/'+data.data.slug;
 							}
 							editToken = data.data.token;
 
 							{{ if not .User }}if (postTarget == 'anonymous') {
 								// Save the data
 								var posts = JSON.parse(H.get('posts', '[]'));
 
 								{{if .Post.Id}}var newPost = H.createPost("{{.Post.Id}}", token, content);
 								for (var i=0; i<posts.length; i++) {
 									if (posts[i].id == "{{.Post.Id}}") {
 										posts[i].title = newPost.title;
 										posts[i].summary = newPost.summary;
 										break;
 									}
 								}
 								nextURL = "/pad/posts";{{else}}posts.push(H.createPost(id, editToken, content));{{end}}
 
 								H.set('posts', JSON.stringify(posts));
 							}
 							{{ end }}
 						{{ end }}
 
 						justPublished = true;
 						if (draftDoc != 'lastDoc') {
 							H.remove(draftDoc);
 							{{if .Editing}}H.remove('draft{{.Post.Id}}font');{{end}}
 						} else {
 							H.set(draftDoc, '');
 						}
 
 						{{if .EditCollection}}
 						window.location = '{{.EditCollection.CanonicalURL}}{{.Post.Slug}}';
 						{{else}}
 						window.location = nextURL;
 						{{end}}
 					} else {
 						$btnPublish.el.children[0].textContent = 'send';
 						alert("Failed to post. Please try again.");
 					}
 				}
 			}
 			http.send(JSON.stringify(params));
 		};
 
 		setButtonStates();
 		$title.on('keydown', function(e) {
 			if (e.keyCode == 13) {
 				if (e.metaKey || e.ctrlKey) {
 					$btnPublish.el.click();
 				} else {
 					e.preventDefault();
 					$writer.el.focus();
 				}
 			}
 		});
 		/*
 		$writer.on('keyup input', function() {
 			setButtonStates();
 			clearTimeout(typingTimer);
 			typingTimer = setTimeout(doneTyping, doneTypingInterval);
 		}, false);
 		$writer.on('keydown', function(e) {
 			clearTimeout(typingTimer);
 			if (e.keyCode == 13 && (e.metaKey || e.ctrlKey)) {
 				$btnPublish.el.click();
 			}
 		});
 		*/
 		$btnPublish.on('click', function(e) {
 			e.preventDefault();
 			if (!publishing && ($title.el.value || $content.el.value)) {
 				var title = $title.el.value;
 				var content = $content.el.value;
 				publish(title, content, selectedFont);
 			}
 		});
 
 		H.getEl('toggle-theme').on('click', function(e) {
 			e.preventDefault();
 			var newTheme = 'light';
 			if (document.body.className == 'light') {
 				newTheme = 'dark';
 			}
 			toggleTheme();
 		});
 
 		var targets = document.querySelectorAll('#target li.target a');
 		for (var i=0; i<targets.length; i++) {
 			targets[i].addEventListener('click', function(e) {
 				e.preventDefault();
 				var targetName = this.href.substring(this.href.indexOf('#')+1);
 				H.set('postTarget', targetName);
 
 				document.querySelector('#target li.target.selected').classList.remove('selected');
 				this.parentElement.classList.add('selected');
 				var newText = this.innerText.split(' ');
 				newText.shift();
 				document.getElementById('target-name').innerText = newText.join(' ');
 			});
 		}
 		var postTarget = H.get('postTarget', '{{if .Blogs}}{{$blog := index .Blogs 0}}{{$blog.Alias}}{{else}}anonymous{{end}}');
 		if (location.hash != '') {
 			postTarget = location.hash.substring(1);
 			// TODO: pushState to /pad (or whatever the URL is) so we live on a clean URL
 			location.hash = '';
 		}
 		var pte = document.querySelector('#target li.target#blog-'+postTarget+' a');
 		if (pte != null) {
 			pte.click();
 		} else {
 			postTarget = 'anonymous';
 			H.set('postTarget', postTarget);
 		}
 
 		var sansLoaded = false;
 		WebFontConfig = {
 			custom: { families: [ 'Lora:400,700:latin' ], urls: [ '/css/fonts.css' ] }
 		};
 		var loadSans = function() {
 		  if (sansLoaded) return;
 		  sansLoaded = true;
 		  WebFontConfig.custom.families.push('Open+Sans:400,700:latin');
 		  try {
 			  (function() {
 				var wf=document.createElement('script');
 				wf.src = '/js/webfont.js';
 				wf.type='text/javascript';
 				wf.async='true';
 				var s=document.getElementsByTagName('script')[0];
 				s.parentNode.insertBefore(wf, s);
 			  })();
 		  } catch (e) {}
 		};
 		var fonts = document.querySelectorAll('nav#font-picker a.font');
 		for (var i=0; i<fonts.length; i++) {
 			fonts[i].addEventListener('click', function(e) {
 				e.preventDefault();
 				selectedFont = this.href.substring(this.href.indexOf('#')+1);
 				// TODO: don't change classes on the editor window
 				//$title.el.className = selectedFont;
 				//$writer.el.className = selectedFont;
 				document.querySelector('nav#font-picker li.selected').classList.remove('selected');
 				this.parentElement.classList.add('selected');
 				H.set('{{if .Editing}}draft{{.Post.Id}}font{{else}}padFont{{end}}', selectedFont);
 				if (selectedFont == 'sans') {
 					loadSans();
 				}
 			});
 		}
 		var selectedFont = H.get('{{if .Editing}}draft{{.Post.Id}}font{{else}}padFont{{end}}', '{{.Post.Font}}');
 		var sfe = document.querySelector('nav#font-picker a.font.'+selectedFont);
 		if (sfe != null) {
 			sfe.click();
 		}
 
 		var doneTyping = function() {
 			if (draftDoc == 'lastDoc' || $content.el.value != origDoc) {
 				H.saveClassic($title, $content, draftDoc);
 				updateWordCount();
 			}
 		};
 		window.addEventListener('beforeunload', function(e) {
 			if (draftDoc != 'lastDoc' && $content.el.value == origDoc) {
 				H.remove(draftDoc);
 			} else if (!justPublished) {
 				doneTyping();
 			}
 		});
 
 		try {
 		  (function() {
 			var wf=document.createElement('script');
 			wf.src = '/js/webfont.js';
 			wf.type='text/javascript';
 			wf.async='true';
 			var s=document.getElementsByTagName('script')[0];
 			s.parentNode.insertBefore(wf, s);
 		  })();
 		} catch (e) {
 		  // whatevs
 		}
 		</script>
 		<script src="/js/prose.bundle.js"></script>
 		<link href="/css/icons.css" rel="stylesheet">
 	</body>
 </html>{{end}}
diff --git a/templates/include/post-render.tmpl b/templates/include/post-render.tmpl
index daf3984..fed16d0 100644
--- a/templates/include/post-render.tmpl
+++ b/templates/include/post-render.tmpl
@@ -1,107 +1,107 @@
-<!-- Miscelaneous render related template parts we use multiple times -->
+<!-- Miscellaneous render related template parts we use multiple times -->
 {{define "collection-meta"}}
 	{{if .Monetization -}}
 		<meta name="monetization" content="{{.DisplayMonetization}}" />
 	{{- end}}
 	{{if .Verification -}}
 		<link rel="me" href="{{.Verification}}" />
 	{{- end}}
 {{end}}
 
 {{define "highlighting"}}
 <script>
   // TODO: this feels more like a mutation observer
   addEventListener('DOMContentLoaded', function () {
     var hlbaseUri = "/js/";
     var lb = document.querySelectorAll("code[class^='language-']");
 
 
     // Custom aliasmap
     var aliasmap = {
       "elisp"      : "lisp",
       "emacs-lisp" : "lisp",
       "c"          : "cpp",
       "cc"         : "cpp",
       "h"          : "cpp",
       "c++"        : "cpp",
       "h++"        : "cpp",
       "hpp"        : "cpp",
       "hh"         : "cpp",
       "hxx"        : "cpp",
       "cxx"        : "cpp",
       "sh"         : "bash",
       "js"         : "javascript",
       "jsx"        : "javascript",
       "html"       : "xml"
     };
 
     // Given a set of nodes, run highlighting on them
     function highlight(nodes) {
       for (i=0; i < nodes.length; i++) {
           hljs.highlightBlock(nodes[i]);
       }
     }
 
     // Given a array of URIs, load them in order
     function loadLanguages(uris, callback) {
       uris.forEach(function(uri) {
         var sc = document.createElement('script');
         sc.src = uri;
         sc.async = false; // critical?
 	  // Set callback on last script
         if (uris.indexOf(uri) == uris.length-1) {
 	  // Set callback regardless
 	  // so we're sure it will run if last element had error
 	  // (we only know after loading, so we've had load time already)
           sc.onload  = callback; sc.onerror = callback;
         }
         document.head.appendChild(sc);
       });
     }
 
     // We don't have to do anything if there are no language blocks
     if (lb.length > 0) {
       // We have blocks to be highlighted, so we load css
       var st = document.createElement('link');
       st.rel = "stylesheet";
       st.href = "/css/lib/atom-one-light.min.css";
       document.head.appendChild(st);
 
       // Construct set of files to load, in order
       var jss = [hlbaseUri + "highlight.min.js"];
       // Check what we need to load
       for (i=0; i < lb.length; i++) {
         lang = lb[i].className.replace('language-','').toLowerCase();
         // Support the aliases specified above
         if (aliasmap[lang]) lang = aliasmap[lang];
         lurl = hlbaseUri + "highlightjs/" + lang + ".min.js";
         if (!jss.includes(lurl)) {
           jss.push(lurl);
         }
       }
-      // Load files in order, higlight on last load
+      // Load files in order, highlight on last load
       loadLanguages(jss, () => {highlight(lb)});
     }
   });
 </script>
 {{end}}
 
 <!-- Include mathjax configuration -->
 {{define "mathjax"}}
 <script>
   MathJax = {
       tex: {
         inlineMath: [
           ["\\(", "\\)"],
           ['$', '$'],
         ],
         displayMath: [
           ['$$', '$$'],
           ['\\[', '\\]'],
         ],
       },
     };
 </script>
 <script type="text/javascript" id="MathJax-script" src="/js/mathjax/tex-svg-full.js" async>
 </script>
 {{end}}
diff --git a/templates/pad.tmpl b/templates/pad.tmpl
index 555bbb3..eb1afba 100644
--- a/templates/pad.tmpl
+++ b/templates/pad.tmpl
@@ -1,421 +1,421 @@
 {{define "pad"}}<!DOCTYPE HTML>
 <html>
 	<head>
 
 		<title>{{if .Editing}}Editing {{if .Post.Title}}{{.Post.Title}}{{else}}{{.Post.Id}}{{end}}{{else}}New Post{{end}} &mdash; {{.SiteName}}</title>
 		
 		<link rel="stylesheet" type="text/css" href="/css/write.css" />
 		{{if .CustomCSS}}<link rel="stylesheet" type="text/css" href="/local/custom.css" />{{end}}
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 
 		<meta name="google" value="notranslate">
 	</head>
 	<body id="pad" class="light">
 
 		<div id="overlay"></div>
 		
 		<textarea id="writer" placeholder="Write..." class="{{.Post.Font}}" autofocus>{{if .Post.Title}}# {{.Post.Title}}
 
 {{end}}{{.Post.Content}}</textarea>
 
 		<div class="alert success hidden" id="edited-elsewhere">This post has been updated elsewhere since you last published! <a href="#" id="erase-edit">Delete draft and reload</a>.</div>
 		
 		<header id="tools">
 			<div id="clip">
 				{{if not .SingleUser}}<h1><a href="/me/c/" title="View blogs"><img class="ic-24dp" src="/img/ic_blogs_dark@2x.png" /></a></h1>{{end}}
 				<nav id="target" {{if .SingleUser}}style="margin-left:0"{{end}}><ul>
 						{{if .Editing}}<li>{{if .EditCollection}}<a href="{{.EditCollection.CanonicalURL}}">{{.EditCollection.Title}}</a>{{else}}<a>Draft</a>{{end}}</li>
 						{{else}}<li class="has-submenu"><a href="#" id="publish-to" onclick="return false"><span id="target-name">Draft</span> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /></a>
 						<ul>
 							<li class="menu-heading">Publish to...</li>
 							{{if .Blogs}}{{range $idx, $el := .Blogs}}
 								<li class="target{{if eq $idx 0}} selected{{end}}" id="blog-{{$el.Alias}}"><a href="#{{$el.Alias}}"><i class="material-icons md-18">public</i> {{if $el.Title}}{{$el.Title}}{{else}}{{$el.Alias}}{{end}}</a></li>
 							{{end}}{{end}}
 							<li class="target" id="blog-anonymous"><a href="#anonymous"><i class="material-icons md-18">description</i> <em>Draft</em></a></li>
 							<li id="user-separator" class="separator"><hr /></li>
 						{{ if .SingleUser }}
 							<li><a href="/"><i class="material-icons md-18">launch</i> View Blog</a></li>
 							<li><a href="/me/c/{{.Username}}"><i class="material-icons md-18">palette</i> Customize</a></li>
 							<li><a href="/me/c/{{.Username}}/stats"><i class="material-icons md-18">trending_up</i> Stats</a></li>
 						{{ else }}
 							<li><a href="/me/c/"><i class="material-icons md-18">library_books</i> View Blogs</a></li>
 						{{ end }}
 							<li><a href="/me/posts/"><i class="material-icons md-18">view_list</i> View Drafts</a></li>
 							<li><a href="/me/logout"><i class="material-icons md-18">power_settings_new</i>  Log out</a></li>
 						</ul>
 					</li>{{end}}
 				</ul></nav>
 				<nav id="font-picker" class="if-room room-3 hidden" style="margin-left:-1em"><ul>
 						<li class="has-submenu"><a href="#" id="" onclick="return false"><img class="ic-24dp" src="/img/ic_font_dark@2x.png" /> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /></a>
 						<ul style="text-align: center">
 							<li class="menu-heading">Font</li>
 							<li class="selected"><a class="font norm" href="#norm">Serif</a></li>
 							<li><a class="font sans" href="#sans">Sans-serif</a></li>
 							<li><a class="font wrap" href="#wrap">Monospace</a></li>
 						</ul>
 					</li>
 				</ul></nav>
 				<span id="wc" class="hidden if-room room-4">0 words</span>
 			</div>
-			<noscript style="margin-left: 2em;"><strong>NOTE</strong>: for now, you'll need Javascript enabled to post.</noscript>
+			<noscript style="margin-left: 2em;"><strong>NOTE</strong>: for now, you'll need JavaScript enabled to post.</noscript>
 			<div id="belt">
 				{{if .Editing}}<div class="tool hidden if-room"><a href="{{if .EditCollection}}{{.EditCollection.CanonicalURL}}{{.Post.Slug}}/edit/meta{{else}}/{{if .SingleUser}}d/{{end}}{{.Post.Id}}/meta{{end}}" title="Edit post metadata" id="edit-meta"><img class="ic-24dp" src="/img/ic_info_dark@2x.png" /></a></div>{{end}}
 				<div class="tool hidden if-room room-2"><a href="#theme" title="Toggle theme" id="toggle-theme"><img class="ic-24dp" src="/img/ic_brightness_dark@2x.png" /></a></div>
 				<div class="tool if-room room-1"><a href="{{if not .User}}/pad/posts{{else}}/me/posts/{{end}}" title="View posts" id="view-posts"><img class="ic-24dp" src="/img/ic_list_dark@2x.png" /></a></div>
 				<div class="tool"><a href="#publish" title="Publish" id="publish"><img class="ic-24dp" src="/img/ic_send_dark@2x.png" /></a></div>
 			</div>
 		</header>
 
 		<script src="/js/h.js"></script>
 		<script type="text/javascript" src="/js/menu.js"></script>
 		<script>
 		function toggleTheme() {
 			if (document.body.classList.contains('light')) {
 				setTheme('dark');
 			} else {
 				setTheme('light');
 			}
 			H.set('padTheme', newTheme);
 		}
 
 		function setTheme(newTheme) {
 			document.body.classList.remove('light');
 			document.body.classList.remove('dark');
 			document.body.classList.add(newTheme);
 			var btns = Array.prototype.slice.call(document.getElementById('tools').querySelectorAll('a img'));
 			if (newTheme == 'light') {
 				// check if current theme is dark otherwise we'll get `_dark_dark@2x.png`
 				if (H.get('padTheme', 'auto') == 'dark'){
 					for (var i=0; i<btns.length; i++) {
 						btns[i].src = btns[i].src.replace('@2x.png', '_dark@2x.png');
 					}
 				}
 			} else {
 				for (var i=0; i<btns.length; i++) {
 					btns[i].src = btns[i].src.replace('_dark@2x.png', '@2x.png');
 				}
 			}
 			H.set('padTheme', newTheme);
 		}
 
 		if (H.get('padTheme', 'auto') == 'light') {
 			setTheme('light');
 		} else if (H.get('padTheme', 'auto') == 'dark') {
 			setTheme('dark');
 		} else {
 			const isDarkMode = window.matchMedia("(prefers-color-scheme: dark)").matches
 			if (isDarkMode) {
 				setTheme('dark');
 			} else {
 				setTheme('light');
 			}
 		}
 
 		var $writer = H.getEl('writer');
 		var $btnPublish = H.getEl('publish');
 		var $btnEraseEdit = H.getEl('edited-elsewhere');
 		var $wc = H.getEl("wc");
 		var updateWordCount = function() {
 			var words = 0;
 			var val = $writer.el.value.trim();
 			if (val != '') {
 				words = $writer.el.value.trim().replace(/\s+/gi, ' ').split(' ').length;
 			}
 			$wc.el.innerText = words + " word" + (words != 1 ? "s" : "");
 		};
 		var setButtonStates = function() {
 			if (!canPublish) {
 				$btnPublish.el.className = 'disabled';
 				return;
 			}
 			if ($writer.el.value.length === 0 || (draftDoc != 'lastDoc' && $writer.el.value == origDoc)) {
 				$btnPublish.el.className = 'disabled';
 			} else {
 				$btnPublish.el.className = '';
 			}
 		};
 		{{if .Post.Id}}var draftDoc = 'draft{{.Post.Id}}';
 		var origDoc = '{{.Post.Content}}';{{else}}var draftDoc = 'lastDoc';{{end}}
 		var updatedStr = '{{.Post.Updated8601}}';
 		var updated = null;
 		if (updatedStr != '') {
 			updated = new Date(updatedStr);
 		}
 		var ok = H.load($writer, draftDoc, true, updated);
 		if (!ok) {
 			// Show "edited elsewhere" warning
 			$btnEraseEdit.el.classList.remove('hidden');
 		}
 		var defaultTimeSet = false;
 		updateWordCount();
 		
 		var typingTimer;
 		var doneTypingInterval = 200;
 
 		var posts;
 		{{if and .Post.Id (not .Post.Slug)}}
 		var token = null;
 		var curPostIdx;
 		posts = JSON.parse(H.get('posts', '[]'));
 		for (var i=0; i<posts.length; i++) {
 			if (posts[i].id == "{{.Post.Id}}") {
 				token = posts[i].token;
 				break;
 			}
 		}
 		var canPublish = token != null;
 		{{else}}var canPublish = true;{{end}}
 		var publishing = false;
 		var justPublished = false;
 		var silenced = {{.Silenced}};
 		var publish = function(content, font) {
 			if (silenced === true) {
 				alert("Your account is silenced, so you can't publish or update posts.");
 				return;
 			}
 			{{if and (and .Post.Id (not .Post.Slug)) (not .User)}}
 			if (!token) {
 				alert("You don't have permission to update this post.");
 				return;
 			}
 			if ($btnPublish.el.className == 'disabled') {
 				return;
 			}
 			{{end}}
 			$btnPublish.el.children[0].textContent = 'more_horiz';
 			publishing = true;
 			var xpostTarg = H.get('crosspostTarget', '[]');
 
 			var http = new XMLHttpRequest();
 			var post = H.getTitleStrict(content);
 
 			var params = {
 				body: post.content,
 				title: post.title,
 				font: font
 			};
 
 			{{ if .Post.Slug }}
 			var url = "/api/collections/{{.EditCollection.Alias}}/posts/{{.Post.Id}}";
 			{{ else if .Post.Id }}
 			var url = "/api/posts/{{.Post.Id}}";
 			if (typeof token === 'undefined' || !token) {
 				token = "";
 			}
 			params.token = token;
 			{{ else }}
 			var lang = navigator.languages ? navigator.languages[0] : (navigator.language || navigator.userLanguage);
 			lang = lang.substring(0, 2);
 			params.lang = lang;
 
 			var url = "/api/posts";
 			var postTarget = H.get('postTarget', 'anonymous');
 			if (postTarget != 'anonymous') {
 				url = "/api/collections/" + postTarget + "/posts";
 			}
 			params.crosspost = JSON.parse(xpostTarg);
 			{{ end }}
 
 			http.open("POST", url, true);
 
 			// Send the proper header information along with the request
 			http.setRequestHeader("Content-type", "application/json");
 
 			http.onreadystatechange = function() {
 				if (http.readyState == 4) {
 					publishing = false;
 					if (http.status == 200 || http.status == 201) {
 						data = JSON.parse(http.responseText);
 						id = data.data.id;
 						nextURL = '{{if .SingleUser}}/d{{end}}/'+id;
 						localStorage.setItem('draft'+id+'-published', new Date().toISOString());
 
 						{{ if not .Post.Id }}
 							// Post created
 							if (postTarget != 'anonymous') {
 							  nextURL = {{if not .SingleUser}}'/'+postTarget+{{end}}'/'+data.data.slug;
 							}
 							editToken = data.data.token;
 
 							{{ if not .User }}if (postTarget == 'anonymous') {
 								// Save the data
 								var posts = JSON.parse(H.get('posts', '[]'));
 
 								{{if .Post.Id}}var newPost = H.createPost("{{.Post.Id}}", token, content);
 								for (var i=0; i<posts.length; i++) {
 									if (posts[i].id == "{{.Post.Id}}") {
 										posts[i].title = newPost.title;
 										posts[i].summary = newPost.summary;
 										break;
 									}
 								}
 								nextURL = "/pad/posts";{{else}}posts.push(H.createPost(id, editToken, content));{{end}}
 
 								H.set('posts', JSON.stringify(posts));
 							}
 							{{ end }}
 						{{ end }}
 
 						justPublished = true;
 						if (draftDoc != 'lastDoc') {
 							H.remove(draftDoc);
 							{{if .Editing}}H.remove('draft{{.Post.Id}}font');{{end}}
 						} else {
 							H.set(draftDoc, '');
 						}
 
 						{{if .EditCollection}}
 						window.location = '{{.EditCollection.CanonicalURL}}{{.Post.Slug}}';
 						{{else}}
 						window.location = nextURL;
 						{{end}}
 					} else {
 						$btnPublish.el.children[0].textContent = 'send';
 						alert("Failed to post. Please try again.");
 					}
 				}
 			}
 			http.send(JSON.stringify(params));
 		};
 
 		setButtonStates();
 		$writer.on('keyup input', function() {
 			setButtonStates();
 			clearTimeout(typingTimer);
 			typingTimer = setTimeout(doneTyping, doneTypingInterval);
 		}, false);
 		$writer.on('keydown', function(e) {
 			clearTimeout(typingTimer);
 			if (e.keyCode == 13 && (e.metaKey || e.ctrlKey)) {
 				$btnPublish.el.click();
 			}
 		});
 		$btnPublish.on('click', function(e) {
 			e.preventDefault();
 			if (!publishing && $writer.el.value) {
 				var content = $writer.el.value;
 				publish(content, selectedFont);
 			}
 		});
 		H.getEl('erase-edit').on('click', function(e) {
 			e.preventDefault();
 			H.remove(draftDoc);
 			H.remove(draftDoc+'-published');
 			justPublished = true; // Block auto-save
 			location.reload();
 		});
 
 		H.getEl('toggle-theme').on('click', function(e) {
 			e.preventDefault();
 			var newTheme = 'light';
 			if (document.body.className == 'light') {
 				newTheme = 'dark';
 			}
 			toggleTheme();
 		});
 
 		var targets = document.querySelectorAll('#target li.target a');
 		for (var i=0; i<targets.length; i++) {
 			targets[i].addEventListener('click', function(e) {
 				e.preventDefault();
 				var targetName = this.href.substring(this.href.indexOf('#')+1);
 				H.set('postTarget', targetName);
 
 				document.querySelector('#target li.target.selected').classList.remove('selected');
 				this.parentElement.classList.add('selected');
 				var newText = this.innerText.split(' ');
 				newText.shift();
 				document.getElementById('target-name').innerText = newText.join(' ');
 			});
 		}
 		var postTarget = H.get('postTarget', '{{if .Blogs}}{{$blog := index .Blogs 0}}{{$blog.Alias}}{{else}}anonymous{{end}}');
 		if (location.hash != '') {
 			postTarget = location.hash.substring(1);
 			// TODO: pushState to /pad (or whatever the URL is) so we live on a clean URL
 			location.hash = '';
 		}
 		var pte = document.querySelector('#target li.target#blog-'+postTarget+' a');
 		if (pte != null) {
 			pte.click();
 		} else {
 			postTarget = 'anonymous';
 			H.set('postTarget', postTarget);
 		}
 
 		var sansLoaded = false;
 		WebFontConfig = {
 			custom: { families: [ 'Lora:400,700:latin' ], urls: [ '/css/fonts.css' ] }
 		};
 		var loadSans = function() {
 		  if (sansLoaded) return;
 		  sansLoaded = true;
 		  WebFontConfig.custom.families.push('Open+Sans:400,700:latin');
 		  try {
 			  (function() {
 				var wf=document.createElement('script');
 				wf.src = '/js/webfont.js';
 				wf.type='text/javascript';
 				wf.async='true';
 				var s=document.getElementsByTagName('script')[0];
 				s.parentNode.insertBefore(wf, s);
 			  })();
 		  } catch (e) {}
 		};
 		var fonts = document.querySelectorAll('nav#font-picker a.font');
 		for (var i=0; i<fonts.length; i++) {
 			fonts[i].addEventListener('click', function(e) {
 				e.preventDefault();
 				selectedFont = this.href.substring(this.href.indexOf('#')+1);
 				$writer.el.className = selectedFont;
 				document.querySelector('nav#font-picker li.selected').classList.remove('selected');
 				this.parentElement.classList.add('selected');
 				H.set('{{if .Editing}}draft{{.Post.Id}}font{{else}}padFont{{end}}', selectedFont);
 				if (selectedFont == 'sans') {
 					loadSans();
 				}
 			});
 		}
 		var selectedFont = H.get('{{if .Editing}}draft{{.Post.Id}}font{{else}}padFont{{end}}', '{{.Post.Font}}');
 		var sfe = document.querySelector('nav#font-picker a.font.'+selectedFont);
 		if (sfe != null) {
 			sfe.click();
 		}
 
 		var doneTyping = function() {
 			if (draftDoc == 'lastDoc' || $writer.el.value != origDoc) {
 				H.save($writer, draftDoc);
 				if (!defaultTimeSet) {
 					var lastLocalPublishStr = localStorage.getItem(draftDoc+'-published');
 					if (lastLocalPublishStr == null || lastLocalPublishStr == '') {
 						localStorage.setItem(draftDoc+'-published', updatedStr);
 					}
 					defaultTimeSet = true;
 				}
 				updateWordCount();
 			}
 		};
 		window.addEventListener('beforeunload', function(e) {
 			if (draftDoc != 'lastDoc' && $writer.el.value == origDoc) {
 				H.remove(draftDoc);
 				H.remove(draftDoc+'-published');
 			} else if (!justPublished) {
 				doneTyping();
 			}
 		});
 
 		try {
 		  (function() {
 			var wf=document.createElement('script');
 			wf.src = '/js/webfont.js';
 			wf.type='text/javascript';
 			wf.async='true';
 			var s=document.getElementsByTagName('script')[0];
 			s.parentNode.insertBefore(wf, s);
 		  })();
 		} catch (e) {
 		  // whatevs
 		}
 		</script>
 		<link href="/css/icons.css" rel="stylesheet">
 	</body>
 </html>{{end}}
diff --git a/templates/user/admin/users.tmpl b/templates/user/admin/users.tmpl
index f6b218c..935d445 100644
--- a/templates/user/admin/users.tmpl
+++ b/templates/user/admin/users.tmpl
@@ -1,42 +1,42 @@
 {{define "users"}}
 {{template "header" .}}
 
 <div class="snug content-container">
 	{{template "admin-header" .}}
 
-	<!-- TODO: if other use for flashes use patern like account_import.go -->
+	<!-- TODO: if other use for flashes use pattern like account_import.go -->
 	{{if .Flashes}}
 		<p class="alert success">
 		{{range .Flashes}}{{.}}{{end}}
 		</p>
 	{{end}}
 	<div class="row admin-actions" style="justify-content: space-between;">
 		<span style="font-style: italic; font-size: 1.2em">{{.TotalUsers}} {{pluralize "user" "users" .TotalUsers}}</span>
 		<a class="btn cta" href="/me/invites">+ Invite people</a>
 	</div>
 
 	<table class="classy export" style="width:100%">
 		<tr>
 			<th>User</th>
 			<th>Joined</th>
 			<th>Type</th>
 			<th>Status</th>
 		</tr>
 		{{range .Users}}
 		<tr>
 			<td><a href="/admin/user/{{.Username}}">{{.Username}}</a></td>
 			<td>{{.CreatedFriendly}}</td>
 			<td style="text-align:center">{{if .IsAdmin}}Admin{{else}}User{{end}}</td>
 			<td style="text-align:center">{{if .IsSilenced}}Silenced{{else}}Active{{end}}</td>
 		</tr>
 		{{end}}
 	</table>
 
 	<nav class="pager pages">
 		{{range $n := .TotalPages}}<a href="/admin/users{{if ne $n 1}}?p={{$n}}{{end}}" {{if eq $.CurPage $n}}class="selected"{{end}}>{{$n}}</a>{{end}}
 	</nav>
 
 </div>
 
 {{template "footer" .}}
 {{end}}
diff --git a/templates/user/admin/view-user.tmpl b/templates/user/admin/view-user.tmpl
index dac88bf..4a06c03 100644
--- a/templates/user/admin/view-user.tmpl
+++ b/templates/user/admin/view-user.tmpl
@@ -1,215 +1,215 @@
 {{define "view-user"}}
 {{template "header" .}}
 <style>
 table.classy th {
 	text-align: left;
 }
 h3 {
 	font-weight: normal;
 }
 td.active-silence {
 	display: flex;
 	align-items: center;
 }
 
 td.active-silence > input[type="submit"] {
 	margin-left: auto;
 	margin-right: 5%;
 }
 
 @media only screen and (max-width: 500px) {
 	td.active-silence {
 		flex-wrap: wrap;
 	}
 	td.active-silence > input[type="submit"] {
 		margin: auto;
 	}
 }
 input.copy-text {
 	text-align: center;
 	font-size: 1.2em;
 	color: #555;
 	width: 100%;
 	box-sizing: border-box;
 }
 .modal {
 	position: fixed;
 }
 </style>
 <div class="snug content-container">
 	<div id="overlay"></div>
 
 	{{template "admin-header" .}}
 
 	<h2 id="posts-header">{{.User.Username}}</h2>
 	{{if .NewPassword}}<div class="alert success">
 		<p>This user's password has been reset to:</p>
 		<p><input type="text" class="copy-text" value="{{.NewPassword}}" onfocus="if (this.select) this.select(); else this.setSelectionRange(0, this.value.length);" readonly /></p>
-		<p>They can use this new password to log in to their account. <strong>This will only be shown once</strong>, so be sure to copy it and send it to them now.</p>
+		<p>They can use this new password to log into their account. <strong>This will only be shown once</strong>, so be sure to copy it and send it to them now.</p>
 		{{if .ClearEmail}}<p>Their email address is: <a href="mailto:{{.ClearEmail}}">{{.ClearEmail}}</a></p>{{end}}
 		</div>
 	{{end}}
 	<table class="classy export">
 		<tr>
 			<th>No.</th>
 			<td>{{.User.ID}}</td>
 		</tr>
 		<tr>
 			<th>Type</th>
 			<td>{{if .User.IsAdmin}}Admin{{else}}User{{end}}</td>
 		</tr>
 		<tr>
 			<th>Username</th>
 			<td>{{.User.Username}}</td>
 		</tr>
 		<tr>
 			<th>Joined</th>
 			<td>{{.User.CreatedFriendly}}</td>
 		</tr>
 		<tr>
 			<th>Total Posts</th>
 			<td>{{.TotalPosts}}</td>
 		</tr>
 		<tr>
 			<th>Last Post</th>
 			<td>{{if .LastPost}}{{.LastPost}}{{else}}Never{{end}}</td>
 		</tr>
 		<tr>
 			<form action="/admin/user/{{.User.Username}}/status" method="POST" {{if not .User.IsSilenced}}onsubmit="return confirmSilence()"{{end}}>
 				<th><a id="status"></a>Status</th>
 				<td class="active-silence">
 				{{if .User.IsSilenced}}
 					<p>Silenced</p>
 					<input type="submit" value="Unsilence"/>
 				{{else}}
 					<p>Active</p>
 					<input class="danger" type="submit" value="Silence" {{if .User.IsAdmin}}disabled{{end}}/>
 				{{end}}
 				</td>
 			</form>
 		</tr>
 		<tr>
 			<th>Password</th>
 			<td>
 				{{if ne .Username .User.Username}}
 				<form id="reset-form" action="/admin/user/{{.User.Username}}/passphrase" method="post" autocomplete="false">
 					<input type="hidden" name="user" value="{{.User.ID}}"/>
 					<button type="submit">Reset</button>
 				</form>
 				{{else}}
 				<a href="/me/settings" title="Go to reset password page">Change your password</a>
 				{{end}}
 			</td>
 		</tr>
 	</table>
 
 	<h2>Blogs</h2>
 
 	{{range .Colls}}
 	<h3><a href="/{{.Alias}}/">{{.Title}}</a></h3>
 	<table class="classy export">
 		<tr>
 			<th>Alias</th>
 			<td>{{.Alias}}</td>
 		</tr>
 		<tr>
 			<th>Title</th>
 			<td>{{.Title}}</td>
 		</tr>
 		<tr>
 			<th>Description</th>
 			<td>{{.Description}}</td>
 		</tr>
 		<tr>
 			<th>Visibility</th>
 			<td>{{.FriendlyVisibility}}</td>
 		</tr>
 		<tr>
 			<th>Views</th>
 			<td>{{.Views}}</td>
 		</tr>
 		<tr>
 			<th>Posts</th>
 			<td>{{.TotalPosts}}</td>
 		</tr>
 		<tr>
 			<th>Last Post</th>
 			<td>{{if .LastPost}}{{.LastPost}}{{else}}Never{{end}}</td>
 		</tr>
 		{{if $.Config.Federation}}
 		<tr>
 			<th>Fediverse Followers</th>
 			<td>{{.Followers}}</td>
 		</tr>
 		{{end}}
 	</table>
 	{{end}}
 
 	{{ if not .User.IsAdmin }}
 	<h2>Incinerator</h2>
 	<div class="alert danger">
 		<div class="row">
 			<div>
 				<h3>Delete this user</h3>
 				<p>Permanently erase all user data, with no way to recover it.</p>
 			</div>
 			<button class="cta danger" onclick="prepareDeleteUser()">Delete this user...</button>
 		</div>
 	</div>
 	{{end}}
 </div>
 
 <div id="modal-delete-user" class="modal">
 	<h2>Are you sure?</h2>
 	<div class="body">
 		<p style="text-align:left">This action <strong>cannot</strong> be undone. It will permanently erase all traces of this user, <strong>{{.User.Username}}</strong>, including their account information, blogs, and posts.</p>
 		<p>Please type <strong>{{.User.Username}}</strong> to confirm.</p>
 
 		<ul id="delete-errors" class="errors"></ul>
 
 		<form action="/admin/user/{{.User.Username}}/delete" method="post" onsubmit="confirmDeletion()">
 			<input id="confirm-text" placeholder="{{.User.Username}}" type="text" class="confirm boxy" name="confirm-username" style="margin-top: 0.5em;" />
 			<div style="text-align:right; margin-top: 1em;">
 				<a id="cancel-delete" style="margin-right:2em" href="#">Cancel</a>
 				<input class="danger" type="submit" id="confirm-delete" value="Delete this user" disabled />
 			</div>
 	</div>
 </div>
 
 <script src="/js/h.js"></script>
 <script src="/js/modals.js"></script>
 <script type="text/javascript">
 H.getEl('cancel-delete').on('click', closeModals);
 
 let $confirmDelBtn = document.getElementById('confirm-delete');
 let $confirmText = document.getElementById('confirm-text')
 $confirmText.addEventListener('input', function() {
 	$confirmDelBtn.disabled = this.value !== '{{.User.Username}}'
 });
 
 function prepareDeleteUser() {
 	$confirmText.value = ''
 	showModal('delete-user')
 	$confirmText.focus()
 }
 
 function confirmDeletion() {
 	$confirmDelBtn.disabled = true
 	$confirmDelBtn.value = 'Deleting...'
 }
 
 function confirmSilence() {
 	return confirm("Silence this user? They'll still be able to log in and access their posts, but no one else will be able to see them anymore. You can reverse this decision at any time.");
 }
 
 	form = document.getElementById("reset-form");
 	form.addEventListener('submit', function(e) {
 		e.preventDefault();
 		agreed = confirm("Reset this user's password? This will generate a new temporary password that you'll need to share with them, and invalidate their old one.");
 		if (agreed === true) {
 			form.submit();
 		}
 	});
 </script>
 {{template "footer" .}}
 {{end}}
diff --git a/templates/user/settings.tmpl b/templates/user/settings.tmpl
index 338ea9a..829e4be 100644
--- a/templates/user/settings.tmpl
+++ b/templates/user/settings.tmpl
@@ -1,231 +1,231 @@
 {{define "settings"}}
 {{template "header" .}}
 
 <style type="text/css">
 .option { margin: 2em 0em; }
 h2 {
 	margin-top: 2.5em;
 }
 h3 { font-weight: normal; }
 .section p, .section label {
 	font-size: 0.86em;
 }
 .oauth-provider img {
 	max-height: 2.75em;
 	vertical-align: middle;
 }
 .modal {
 	position: fixed;
 }
 </style>
 <div class="content-container snug">
 	<div id="overlay"></div>
 
 	{{if .Silenced}}
 		{{template "user-silenced"}}
 	{{end}}
 	<h1>{{if .IsLogOut}}Before you go...{{else}}Account Settings{{end}}</h1>
 	{{if .Flashes}}<ul class="errors">
 		{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
 	</ul>{{end}}
 
 	{{ if .IsLogOut }}
 	<div class="alert info">
 		<p class="introduction">Please add an <strong>email address</strong> and/or <strong>passphrase</strong> so you can log in again later.</p>
 	</div>
 	{{ else }}
 	<div>
 		<p>Change your account settings here.</p>
 	</div>
 
 	<form method="post" action="/api/me/self" autocomplete="false">
 		<div class="option">
 			<h3>Username</h3>
 			<div class="section">
 				<input type="text" name="username" value="{{.Username}}" tabindex="1" />
 				<input type="submit" value="Update" style="margin-left: 1em;" />
 			</div>
 		</div>
 	</form>
 	{{ end }}
 
 	{{if not .DisablePasswordAuth}}
 	<form method="post" action="/api/me/self" autocomplete="false">
 		<input type="hidden" name="logout" value="{{.IsLogOut}}" />
 		<div class="option">
 			<h3>Passphrase</h3>
 			<div class="section">
-				{{if and (not .HasPass) (not .IsLogOut)}}<div class="alert info"><p>Add a passphrase to easily log in to your account.</p></div>{{end}}
+				{{if and (not .HasPass) (not .IsLogOut)}}<div class="alert info"><p>Add a passphrase to easily log into your account.</p></div>{{end}}
 				{{if .HasPass}}<p>Current passphrase</p>
 				<input type="password" name="current-pass" placeholder="Current passphrase" tabindex="1" /> <input class="show" type="checkbox" id="show-cur-pass" /><label for="show-cur-pass"> Show</label>
 				<p>New passphrase</p>
 				{{end}}
 				{{if .IsLogOut}}<input type="text" value="{{.Username}}" style="display:none" />{{end}}
 				<input type="password" name="new-pass" autocomplete="new-password" placeholder="New passphrase" tabindex="{{if .IsLogOut}}1{{else}}2{{end}}" /> <input class="show" type="checkbox" id="show-new-pass" /><label for="show-new-pass"> Show</label>
 			</div>
 		</div>
 
 		<div class="option">
 			<h3>Email</h3>
 			<div class="section">
 				{{if and (not .Email) (not .IsLogOut)}}<div class="alert info"><p>Add your email to get:</p>
 				<ul>
 					<li>No-passphrase login</li>
 					<li>Account recovery if you forget your passphrase</li>
 				</ul></div>{{end}}
 				<input type="email" name="email" style="letter-spacing: 1px" placeholder="Email address" value="{{.Email}}" size="40" tabindex="{{if .IsLogOut}}2{{else}}3{{end}}" />
 			</div>
 		</div>
 
 		<div class="option" style="text-align: center;">
 			<input type="submit" value="Save changes" tabindex="4" />
 		</div>
 	</form>
 	{{end}}
 
 	{{ if .OauthSection }}
 		{{ if .OauthAccounts }}
 		<div class="option">
 			<h2>Linked Accounts</h2>
 			<p>These are your linked external accounts.</p>
 			{{ range $oauth_account := .OauthAccounts }}
 				<form method="post" action="/api/me/oauth/remove" autocomplete="false">
 					<input type="hidden" name="provider" value="{{ $oauth_account.Provider }}" />
 					<input type="hidden" name="client_id" value="{{ $oauth_account.ClientID }}" />
 					<input type="hidden" name="remote_user_id" value="{{ $oauth_account.RemoteUserID }}" />
 					<div class="section oauth-provider">
 						{{ if $oauth_account.DisplayName}}
 							{{ if $oauth_account.AllowDisconnect}}
 							<input type="submit" value="Remove {{.DisplayName}}" />
 							{{else}}
 							<a class="btn cta"><strong>{{.DisplayName}}</strong></a>
 							{{end}}
 						{{else}}
 							<img src="/img/mark/{{$oauth_account.Provider}}.png" alt="{{ $oauth_account.Provider | title }}" />
 							<input type="submit" value="Remove {{ $oauth_account.Provider | title }}" />
 						{{end}}
 					</div>
 				</form>
 			{{ end }}
 		</div>
 		{{ end }}
 		{{ if or .OauthSlack .OauthWriteAs .OauthGitLab .OauthGeneric .OauthGitea }}
 		<div class="option">
 			<h2>Link External Accounts</h2>
 			<p>Connect additional accounts to enable logging in with those providers, instead of using your username and password.</p>
 			<div class="row signinbtns">
 			{{ if .OauthWriteAs }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="writeas-login" href="/oauth/write.as?attach=t">
 						<img src="/img/mark/writeas-white.png" alt="Write.as" />
 						Link <strong>Write.as</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthSlack }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="slack-login" href="/oauth/slack?attach=t">
 						<img src="/img/mark/slack.png" alt="Slack" />
 						Link <strong>Slack</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthGitLab }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="gitlab-login" href="/oauth/gitlab?attach=t">
 						<img src="/img/mark/gitlab.png" alt="GitLab" />
 						Link <strong>{{.GitLabDisplayName}}</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthGitea }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="gitea-login" href="/oauth/gitea?attach=t">
 						<img src="/img/mark/gitea.png" alt="Gitea" />
 						Link <strong>{{.GiteaDisplayName}}</strong>
 					</a>
 				</div>
 			{{ end }}
 			{{ if .OauthGeneric }}
 				<div class="section oauth-provider">
 					<a class="btn cta loginbtn" id="generic-oauth-login" href="/oauth/generic?attach=t">
 						Link <strong>{{ .OauthGenericDisplayName }}</strong>
 					</a>
 				</div>
 			{{ end }}
 			</div>
 		</div>
 		{{ end }}
 	{{ end }}
 
 	{{ if and .OpenDeletion (not .IsAdmin) }}
 		<h2>Incinerator</h2>
 		<div class="alert danger">
 			<div class="row">
 				<div>
 					<h3>Delete your account</h3>
 					<p>Permanently erase all your data, with no way to recover it.</p>
 				</div>
 				<button class="cta danger" onclick="prepareDeleteUser()">Delete your account...</button>
 			</div>
 		</div>
 	{{end}}
 </div>
 
 <div id="modal-delete-user" class="modal">
 	<h2>Are you sure?</h2>
 	<div class="body">
 		<p style="text-align:left">This action <strong>cannot</strong> be undone. It will immediately and permanently erase your account, including your blogs and posts. Before continuing, you might want to <a href="/me/export">export your data</a>.</p>
 		<p>If you're sure, please type <strong>{{.Username}}</strong> to confirm.</p>
 
 		<ul id="delete-errors" class="errors"></ul>
 
 		<form action="/me/delete" method="post" onsubmit="confirmDeletion()">
 			{{ .CSRFField }}
 			<input id="confirm-text" placeholder="{{.Username}}" type="text" class="confirm boxy" name="confirm-username" style="margin-top: 0.5em;" />
 			<div style="text-align:right; margin-top: 1em;">
 				<a id="cancel-delete" style="margin-right:2em" href="#">Cancel</a>
 				<input class="danger" type="submit" id="confirm-delete" value="Delete your account" disabled />
 			</div>
 	</div>
 </div>
 
 <script src="/js/h.js"></script>
 <script src="/js/modals.js"></script>
 <script>
 var showChecks = document.querySelectorAll('input.show');
 for (var i=0; i<showChecks.length; i++) {
 	showChecks[i].addEventListener('click', function() {
 		var prevEl = this.previousElementSibling;
 		if (prevEl.type == "password") {
 			prevEl.type = "text";
 		} else {
 			prevEl.type = "password";
 		}
 	});
 }
 
 {{ if and .OpenDeletion (not .IsAdmin) }}
 	H.getEl('cancel-delete').on('click', closeModals);
 
 	let $confirmDelBtn = document.getElementById('confirm-delete');
 	let $confirmText = document.getElementById('confirm-text')
 	$confirmText.addEventListener('input', function() {
 		$confirmDelBtn.disabled = this.value !== '{{.Username}}'
 	});
 
 	function prepareDeleteUser() {
 		$confirmText.value = ''
 		showModal('delete-user')
 		$confirmText.focus()
 	}
 
 	function confirmDeletion() {
 		$confirmDelBtn.disabled = true
 		$confirmDelBtn.value = 'Deleting...'
 	}
 {{ end }}
 </script>
 
 {{template "footer" .}}
 {{end}}