diff --git a/account.go b/account.go
index 2a66ecf..920fc9d 100644
--- a/account.go
+++ b/account.go
@@ -1,1070 +1,1070 @@
 /*
  * Copyright © 2018-2019 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"regexp"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/gorilla/sessions"
 	"github.com/guregu/null/zero"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/data"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/writefreely/author"
 	"github.com/writeas/writefreely/config"
 	"github.com/writeas/writefreely/page"
 )
 
 type (
 	userSettings struct {
 		Username string `schema:"username" json:"username"`
 		Email    string `schema:"email" json:"email"`
 		NewPass  string `schema:"new-pass" json:"new_pass"`
 		OldPass  string `schema:"current-pass" json:"current_pass"`
 		IsLogOut bool   `schema:"logout" json:"logout"`
 	}
 
 	UserPage struct {
 		page.StaticPage
 
 		PageTitle string
 		Separator template.HTML
 		IsAdmin   bool
 		CanInvite bool
 	}
 )
 
 func NewUserPage(app *App, r *http.Request, u *User, title string, flashes []string) *UserPage {
 	up := &UserPage{
 		StaticPage: pageForReq(app, r),
 		PageTitle:  title,
 	}
 	up.Username = u.Username
 	up.Flashes = flashes
 	up.Path = r.URL.Path
 	up.IsAdmin = u.IsAdmin()
 	up.CanInvite = canUserInvite(app.cfg, up.IsAdmin)
 	return up
 }
 
 func canUserInvite(cfg *config.Config, isAdmin bool) bool {
 	return cfg.App.UserInvites != "" &&
 		(isAdmin || cfg.App.UserInvites != "admin")
 }
 
 func (up *UserPage) SetMessaging(u *User) {
 	//up.NeedsAuth = app.db.DoesUserNeedAuth(u.ID)
 }
 
 const (
 	loginAttemptExpiration = 3 * time.Second
 )
 
 var actuallyUsernameReg = regexp.MustCompile("username is actually ([a-z0-9\\-]+)\\. Please try that, instead")
 
 func apiSignup(app *App, w http.ResponseWriter, r *http.Request) error {
 	_, err := signup(app, w, r)
 	return err
 }
 
 func signup(app *App, w http.ResponseWriter, r *http.Request) (*AuthUser, error) {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 
 	// Get params
 	var ur userRegistration
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&ur)
 		if err != nil {
 			log.Error("Couldn't parse signup JSON request: %v\n", err)
 			return nil, ErrBadJSON
 		}
 	} else {
 		// Check if user is already logged in
 		u := getUserSession(app, r)
 		if u != nil {
 			return &AuthUser{User: u}, nil
 		}
 
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse signup form request: %v\n", err)
 			return nil, ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&ur, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode signup form request: %v\n", err)
 			return nil, ErrBadFormData
 		}
 	}
 
 	return signupWithRegistration(app, ur, w, r)
 }
 
 func signupWithRegistration(app *App, signup userRegistration, w http.ResponseWriter, r *http.Request) (*AuthUser, error) {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 
 	// Validate required params (alias)
 	if signup.Alias == "" {
 		return nil, impart.HTTPError{http.StatusBadRequest, "A username is required."}
 	}
 	if signup.Pass == "" {
 		return nil, impart.HTTPError{http.StatusBadRequest, "A password is required."}
 	}
 	var desiredUsername string
 	if signup.Normalize {
 		// With this option we simply conform the username to what we expect
 		// without complaining. Since they might've done something funny, like
 		// enter: write.as/Way Out There, we'll use their raw input for the new
 		// collection name and sanitize for the slug / username.
 		desiredUsername = signup.Alias
 		signup.Alias = getSlug(signup.Alias, "")
 	}
 	if !author.IsValidUsername(app.cfg, signup.Alias) {
 		// Ensure the username is syntactically correct.
 		return nil, impart.HTTPError{http.StatusPreconditionFailed, "Username is reserved or isn't valid. It must be at least 3 characters long, and can only include letters, numbers, and hyphens."}
 	}
 
 	// Handle empty optional params
 	// TODO: remove this var
 	createdWithPass := true
 	hashedPass, err := auth.HashPass([]byte(signup.Pass))
 	if err != nil {
 		return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Create struct to insert
 	u := &User{
 		Username:   signup.Alias,
 		HashedPass: hashedPass,
 		HasPass:    createdWithPass,
 		Email:      zero.NewString("", signup.Email != ""),
 		Created:    time.Now().Truncate(time.Second).UTC(),
 	}
 	if signup.Email != "" {
 		encEmail, err := data.Encrypt(app.keys.EmailKey, signup.Email)
 		if err != nil {
 			log.Error("Unable to encrypt email: %s\n", err)
 		} else {
 			u.Email.String = string(encEmail)
 		}
 	}
 
 	// Create actual user
 	if err := app.db.CreateUser(app.cfg, u, desiredUsername); err != nil {
 		return nil, err
 	}
 
 	// Log invite if needed
 	if signup.InviteCode != "" {
 		cu, err := app.db.GetUserForAuth(signup.Alias)
 		if err != nil {
 			return nil, err
 		}
 		err = app.db.CreateInvitedUser(signup.InviteCode, cu.ID)
 		if err != nil {
 			return nil, err
 		}
 	}
 
 	// Add back unencrypted data for response
 	if signup.Email != "" {
 		u.Email.String = signup.Email
 	}
 
 	resUser := &AuthUser{
 		User: u,
 	}
 	if !createdWithPass {
 		resUser.Password = signup.Pass
 	}
 	title := signup.Alias
 	if signup.Normalize {
 		title = desiredUsername
 	}
 	resUser.Collections = &[]Collection{
 		{
 			Alias: signup.Alias,
 			Title: title,
 		},
 	}
 
 	var token string
 	if reqJSON && !signup.Web {
 		token, err = app.db.GetAccessToken(u.ID)
 		if err != nil {
 			return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
 		}
 		resUser.AccessToken = token
 	} else {
 		session, err := app.sessionStore.Get(r, cookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
 			log.Error("Session: %v; ignoring", err)
 		}
 		session.Values[cookieUserVal] = resUser.User.Cookie()
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Couldn't save session: %v", err)
 			return nil, err
 		}
 	}
 	if reqJSON {
 		return resUser, impart.WriteSuccess(w, resUser, http.StatusCreated)
 	}
 
 	return resUser, nil
 }
 
 func viewLogout(app *App, w http.ResponseWriter, r *http.Request) error {
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		return ErrInternalCookieSession
 	}
 
 	// Ensure user has an email or password set before they go, so they don't
 	// lose access to their account.
 	val := session.Values[cookieUserVal]
 	var u = &User{}
 	var ok bool
 	if u, ok = val.(*User); !ok {
 		log.Error("Error casting user object on logout. Vals: %+v Resetting cookie.", session.Values)
 
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Couldn't save session on logout: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
 		}
 
 		return impart.HTTPError{http.StatusFound, "/"}
 	}
 
 	u, err = app.db.GetUserByID(u.ID)
 	if err != nil && err != ErrUserNotFound {
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to fetch user information."}
 	}
 
 	session.Options.MaxAge = -1
 
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't save session on logout: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
 	}
 
 	return impart.HTTPError{http.StatusFound, "/"}
 }
 
 func handleAPILogout(app *App, w http.ResponseWriter, r *http.Request) error {
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		return ErrNoAccessToken
 	}
 	t := auth.GetToken(accessToken)
 	if len(t) == 0 {
 		return ErrNoAccessToken
 	}
 	err := app.db.DeleteToken(t)
 	if err != nil {
 		return err
 	}
 	return impart.HTTPError{Status: http.StatusNoContent}
 }
 
 func viewLogin(app *App, w http.ResponseWriter, r *http.Request) error {
 	var earlyError string
 	oneTimeToken := r.FormValue("with")
 	if oneTimeToken != "" {
 		log.Info("Calling login with one-time token.")
 		err := login(app, w, r)
 		if err != nil {
 			log.Info("Received error: %v", err)
 			earlyError = fmt.Sprintf("%s", err)
 		}
 	}
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// Ignore this
 		log.Error("Unable to get session; ignoring: %v", err)
 	}
 
 	p := &struct {
 		page.StaticPage
 		To            string
 		Message       template.HTML
 		Flashes       []template.HTML
 		LoginUsername string
 	}{
 		pageForReq(app, r),
 		r.FormValue("to"),
 		template.HTML(""),
 		[]template.HTML{},
 		getTempInfo(app, "login-user", r, w),
 	}
 
 	if earlyError != "" {
 		p.Flashes = append(p.Flashes, template.HTML(earlyError))
 	}
 
 	// Display any error messages
 	flashes, _ := getSessionFlashes(app, w, r, session)
 	for _, flash := range flashes {
 		p.Flashes = append(p.Flashes, template.HTML(flash))
 	}
 	err = pages["login.tmpl"].ExecuteTemplate(w, "base", p)
 	if err != nil {
 		log.Error("Unable to render login: %v", err)
 		return err
 	}
 	return nil
 }
 
 func webLogin(app *App, w http.ResponseWriter, r *http.Request) error {
 	err := login(app, w, r)
 	if err != nil {
 		username := r.FormValue("alias")
 		// Login request was unsuccessful; save the error in the session and redirect them
 		if err, ok := err.(impart.HTTPError); ok {
 			session, _ := app.sessionStore.Get(r, cookieName)
 			if session != nil {
 				session.AddFlash(err.Message)
 				session.Save(r, w)
 			}
 
 			if m := actuallyUsernameReg.FindStringSubmatch(err.Message); len(m) > 0 {
 				// Retain fixed username recommendation for the login form
 				username = m[1]
 			}
 		}
 
 		// Pass along certain information
 		saveTempInfo(app, "login-user", username, r, w)
 
 		// Retain post-login URL if one was given
 		redirectTo := "/login"
 		postLoginRedirect := r.FormValue("to")
 		if postLoginRedirect != "" {
 			redirectTo += "?to=" + postLoginRedirect
 		}
 
 		log.Error("Unable to login: %v", err)
 		return impart.HTTPError{http.StatusTemporaryRedirect, redirectTo}
 	}
 
 	return nil
 }
 
 var loginAttemptUsers = sync.Map{}
 
 func login(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	oneTimeToken := r.FormValue("with")
 	verbose := r.FormValue("all") == "true" || r.FormValue("verbose") == "1" || r.FormValue("verbose") == "true" || (reqJSON && oneTimeToken != "")
 
 	redirectTo := r.FormValue("to")
 	if redirectTo == "" {
 		if app.cfg.App.SingleUser {
 			redirectTo = "/me/new"
 		} else {
 			redirectTo = "/"
 		}
 	}
 
 	var u *User
 	var err error
 	var signin userCredentials
 
 	// Log in with one-time token if one is given
 	if oneTimeToken != "" {
 		log.Info("Login: Logging user in via token.")
 		userID := app.db.GetUserID(oneTimeToken)
 		if userID == -1 {
 			log.Error("Login: Got user -1 from token")
 			err := ErrBadAccessToken
 			err.Message = "Expired or invalid login code."
 			return err
 		}
 		log.Info("Login: Found user %d.", userID)
 
 		u, err = app.db.GetUserByID(userID)
 		if err != nil {
 			log.Error("Unable to fetch user on one-time token login: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "There was an error retrieving the user you want."}
 		}
 		log.Info("Login: Got user via token")
 	} else {
 		// Get params
 		if reqJSON {
 			decoder := json.NewDecoder(r.Body)
 			err := decoder.Decode(&signin)
 			if err != nil {
 				log.Error("Couldn't parse signin JSON request: %v\n", err)
 				return ErrBadJSON
 			}
 		} else {
 			err := r.ParseForm()
 			if err != nil {
 				log.Error("Couldn't parse signin form request: %v\n", err)
 				return ErrBadFormData
 			}
 
 			err = app.formDecoder.Decode(&signin, r.PostForm)
 			if err != nil {
 				log.Error("Couldn't decode signin form request: %v\n", err)
 				return ErrBadFormData
 			}
 		}
 
 		log.Info("Login: Attempting login for '%s'", signin.Alias)
 
 		// Validate required params (all)
 		if signin.Alias == "" {
 			msg := "Parameter `alias` required."
 			if signin.Web {
 				msg = "A username is required."
 			}
 			return impart.HTTPError{http.StatusBadRequest, msg}
 		}
 		if !signin.EmailLogin && signin.Pass == "" {
 			msg := "Parameter `pass` required."
 			if signin.Web {
 				msg = "A password is required."
 			}
 			return impart.HTTPError{http.StatusBadRequest, msg}
 		}
 
 		// Prevent excessive login attempts on the same account
 		// Skip this check in dev environment
 		if !app.cfg.Server.Dev {
 			now := time.Now()
 			attemptExp, att := loginAttemptUsers.LoadOrStore(signin.Alias, now.Add(loginAttemptExpiration))
 			if att {
 				if attemptExpTime, ok := attemptExp.(time.Time); ok {
 					if attemptExpTime.After(now) {
 						// This user attempted previously, and the period hasn't expired yet
 						return impart.HTTPError{http.StatusTooManyRequests, "You're doing that too much."}
 					} else {
 						// This user attempted previously, but the time expired; free up space
 						loginAttemptUsers.Delete(signin.Alias)
 					}
 				} else {
 					log.Error("Unable to cast expiration to time")
 				}
 			}
 		}
 
 		// Retrieve password
 		u, err = app.db.GetUserForAuth(signin.Alias)
 		if err != nil {
 			log.Info("Unable to getUserForAuth on %s: %v", signin.Alias, err)
 			if strings.IndexAny(signin.Alias, "@") > 0 {
 				log.Info("Suggesting: %s", ErrUserNotFoundEmail.Message)
 				return ErrUserNotFoundEmail
 			}
 			return err
 		}
 		// Authenticate
 		if u.Email.String == "" {
 			// User has no email set, so check if they haven't added a password, either,
 			// so we can return a more helpful error message.
 			if hasPass, _ := app.db.IsUserPassSet(u.ID); !hasPass {
 				log.Info("Tried logging in to %s, but no password or email.", signin.Alias)
 				return impart.HTTPError{http.StatusPreconditionFailed, "This user never added a password or email address. Please contact us for help."}
 			}
 		}
 		if !auth.Authenticated(u.HashedPass, []byte(signin.Pass)) {
 			return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 		}
 	}
 
 	if reqJSON && !signin.Web {
 		var token string
 		if r.Header.Get("User-Agent") == "" {
 			// Get last created token when User-Agent is empty
 			token = app.db.FetchLastAccessToken(u.ID)
 			if token == "" {
 				token, err = app.db.GetAccessToken(u.ID)
 			}
 		} else {
 			token, err = app.db.GetAccessToken(u.ID)
 		}
 		if err != nil {
 			log.Error("Login: Unable to create access token: %v", err)
 			return impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
 		}
 		resUser := getVerboseAuthUser(app, token, u, verbose)
 		return impart.WriteSuccess(w, resUser, http.StatusOK)
 	}
 
 	session, err := app.sessionStore.Get(r, cookieName)
 	if err != nil {
 		// The cookie should still save, even if there's an error.
 		log.Error("Login: Session: %v; ignoring", err)
 	}
 
 	// Remove unwanted data
 	session.Values[cookieUserVal] = u.Cookie()
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Login: Couldn't save session: %v", err)
 		// TODO: return error
 	}
 
 	// Send success
 	if reqJSON {
 		return impart.WriteSuccess(w, &AuthUser{User: u}, http.StatusOK)
 	}
 	log.Info("Login: Redirecting to %s", redirectTo)
 	w.Header().Set("Location", redirectTo)
 	w.WriteHeader(http.StatusFound)
 	return nil
 }
 
 func getVerboseAuthUser(app *App, token string, u *User, verbose bool) *AuthUser {
 	resUser := &AuthUser{
 		AccessToken: token,
 		User:        u,
 	}
 
 	// Fetch verbose user data if requested
 	if verbose {
 		posts, err := app.db.GetUserPosts(u)
 		if err != nil {
 			log.Error("Login: Unable to get user posts: %v", err)
 		}
 		colls, err := app.db.GetCollections(u, app.cfg.App.Host)
 		if err != nil {
 			log.Error("Login: Unable to get user collections: %v", err)
 		}
 		passIsSet, err := app.db.IsUserPassSet(u.ID)
 		if err != nil {
 			// TODO: correct error meesage
 			log.Error("Login: Unable to get user collections: %v", err)
 		}
 
 		resUser.Posts = posts
 		resUser.Collections = colls
 		resUser.User.HasPass = passIsSet
 	}
 	return resUser
 }
 
 func viewExportOptions(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	// Fetch extra user data
 	p := NewUserPage(app, r, u, "Export", nil)
 
 	showUserPage(w, "export", p)
 	return nil
 }
 
 func viewExportPosts(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	var filename string
 	var u = &User{}
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	if reqJSON {
 		// Use given Authorization header
 		accessToken := r.Header.Get("Authorization")
 		if accessToken == "" {
 			return nil, filename, ErrNoAccessToken
 		}
 
 		userID := app.db.GetUserID(accessToken)
 		if userID == -1 {
 			return nil, filename, ErrBadAccessToken
 		}
 
 		var err error
 		u, err = app.db.GetUserByID(userID)
 		if err != nil {
 			return nil, filename, impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve requested user."}
 		}
 	} else {
 		// Use user cookie
 		session, err := app.sessionStore.Get(r, cookieName)
 		if err != nil {
 			// The cookie should still save, even if there's an error.
 			log.Error("Session: %v; ignoring", err)
 		}
 
 		val := session.Values[cookieUserVal]
 		var ok bool
 		if u, ok = val.(*User); !ok {
 			return nil, filename, ErrNotLoggedIn
 		}
 	}
 
 	filename = u.Username + "-posts-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	// Fetch data we're exporting
 	var err error
 	var data []byte
 	posts, err := app.db.GetUserPosts(u)
 	if err != nil {
 		return data, filename, err
 	}
 
 	// Export as CSV
 	if strings.HasSuffix(r.URL.Path, ".csv") {
 		data = exportPostsCSV(u, posts)
 		return data, filename, err
 	}
 	if strings.HasSuffix(r.URL.Path, ".zip") {
 		data = exportPostsZip(u, posts)
 		return data, filename, err
 	}
 
 	if r.FormValue("pretty") == "1" {
 		data, err = json.MarshalIndent(posts, "", "\t")
 	} else {
 		data, err = json.Marshal(posts)
 	}
 	return data, filename, err
 }
 
 func viewExportFull(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error) {
 	var err error
 	filename := ""
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, filename, ErrNotLoggedIn
 	}
 	filename = u.Username + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
 
 	exportUser := compileFullExport(app, u)
 
 	var data []byte
 	if r.FormValue("pretty") == "1" {
 		data, err = json.MarshalIndent(exportUser, "", "\t")
 	} else {
 		data, err = json.Marshal(exportUser)
 	}
 	return data, filename, err
 }
 
 func viewMeAPI(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	uObj := struct {
 		ID       int64  `json:"id,omitempty"`
 		Username string `json:"username,omitempty"`
 	}{}
 	var err error
 
 	if reqJSON {
 		_, uObj.Username, err = app.db.GetUserDataFromToken(r.Header.Get("Authorization"))
 		if err != nil {
 			return err
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return impart.WriteSuccess(w, uObj, http.StatusOK)
 		}
 		uObj.Username = u.Username
 	}
 
 	return impart.WriteSuccess(w, uObj, http.StatusOK)
 }
 
 func viewMyPostsAPI(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return ErrBadRequestedType
 	}
 
 	var err error
 	p := GetPostsCache(u.ID)
 	if p == nil {
 		userPostsCache.Lock()
 		if userPostsCache.users[u.ID].ready == nil {
 			userPostsCache.users[u.ID] = postsCacheItem{ready: make(chan struct{})}
 			userPostsCache.Unlock()
 
 			p, err = app.db.GetUserPosts(u)
 			if err != nil {
 				return err
 			}
 
 			CachePosts(u.ID, p)
 		} else {
 			userPostsCache.Unlock()
 
 			<-userPostsCache.users[u.ID].ready
 			p = GetPostsCache(u.ID)
 		}
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func viewMyCollectionsAPI(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return ErrBadRequestedType
 	}
 
 	p, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func viewArticles(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	p, err := app.db.GetAnonymousPosts(u)
 	if err != nil {
 		log.Error("unable to fetch anon posts: %v", err)
 	}
 	// nil-out AnonymousPosts slice for easy detection in the template
 	if p != nil && len(*p) == 0 {
 		p = nil
 	}
 
 	f, err := getSessionFlashes(app, w, r, nil)
 	if err != nil {
 		log.Error("unable to fetch flashes: %v", err)
 	}
 
 	c, err := app.db.GetPublishableCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 	}
 
 	d := struct {
 		*UserPage
 		AnonymousPosts *[]PublicPost
 		Collections    *[]Collection
 	}{
 		UserPage:       NewUserPage(app, r, u, u.Username+"'s Posts", f),
 		AnonymousPosts: p,
 		Collections:    c,
 	}
 	d.UserPage.SetMessaging(u)
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	w.Header().Set("Expires", "Thu, 04 Oct 1990 20:00:00 GMT")
 	showUserPage(w, "articles", d)
 
 	return nil
 }
 
 func viewCollections(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	c, err := app.db.GetCollections(u, app.cfg.App.Host)
 	if err != nil {
 		log.Error("unable to fetch collections: %v", err)
 		return fmt.Errorf("No collections")
 	}
 
 	f, _ := getSessionFlashes(app, w, r, nil)
 
 	uc, _ := app.db.GetUserCollectionCount(u.ID)
 	// TODO: handle any errors
 
 	d := struct {
 		*UserPage
 		Collections *[]Collection
 
 		UsedCollections, TotalCollections int
 
 		NewBlogsDisabled bool
 	}{
 		UserPage:         NewUserPage(app, r, u, u.Username+"'s Blogs", f),
 		Collections:      c,
 		UsedCollections:  int(uc),
 		NewBlogsDisabled: !app.cfg.App.CanCreateBlogs(uc),
 	}
 	d.UserPage.SetMessaging(u)
 	showUserPage(w, "collections", d)
 
 	return nil
 }
 
 func viewEditCollection(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	c, err := app.db.GetCollection(vars["collection"])
 	if err != nil {
 		return err
 	}
 	if c.OwnerID != u.ID {
 		return ErrCollectionNotFound
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	obj := struct {
 		*UserPage
 		*Collection
 	}{
 		UserPage:   NewUserPage(app, r, u, "Edit "+c.DisplayTitle(), flashes),
 		Collection: c,
 	}
 
 	showUserPage(w, "collection", obj)
 	return nil
 }
 
 func updateSettings(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 
 	var s userSettings
 	var u *User
 	var sess *sessions.Session
 	var err error
 	if reqJSON {
 		accessToken := r.Header.Get("Authorization")
 		if accessToken == "" {
 			return ErrNoAccessToken
 		}
 
 		u, err = app.db.GetAPIUser(accessToken)
 		if err != nil {
 			return ErrBadAccessToken
 		}
 
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&s)
 		if err != nil {
 			log.Error("Couldn't parse settings JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 
 		// Prevent all username updates
 		// TODO: support changing username via JSON API request
 		s.Username = ""
 	} else {
 		u, sess = getUserAndSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse settings form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&s, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode settings form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	// Do update
 	postUpdateReturn := r.FormValue("return")
 	redirectTo := "/me/settings"
 	if s.IsLogOut {
 		redirectTo += "?logout=1"
 	} else if postUpdateReturn != "" {
 		redirectTo = postUpdateReturn
 	}
 
 	// Only do updates on values we need
 	if s.Username != "" && s.Username == u.Username {
 		// Username hasn't actually changed; blank it out
 		s.Username = ""
 	}
 	err = app.db.ChangeSettings(app, u, &s)
 	if err != nil {
 		if reqJSON {
 			return err
 		}
 
 		if err, ok := err.(impart.HTTPError); ok {
 			addSessionFlash(app, w, r, err.Message, nil)
 		}
 	} else {
 		// Successful update.
 		if reqJSON {
 			return impart.WriteSuccess(w, u, http.StatusOK)
 		}
 
 		if s.IsLogOut {
 			redirectTo = "/me/logout"
 		} else {
 			sess.Values[cookieUserVal] = u.Cookie()
 			addSessionFlash(app, w, r, "Account updated.", nil)
 		}
 	}
 
 	w.Header().Set("Location", redirectTo)
 	w.WriteHeader(http.StatusFound)
 	return nil
 }
 
 func updatePassphrase(app *App, w http.ResponseWriter, r *http.Request) error {
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		return ErrNoAccessToken
 	}
 
 	curPass := r.FormValue("current")
 	newPass := r.FormValue("new")
 	// Ensure a new password is given (always required)
 	if newPass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Provide a new password."}
 	}
 
 	userID, sudo := app.db.GetUserIDPrivilege(accessToken)
 	if userID == -1 {
 		return ErrBadAccessToken
 	}
 
 	// Ensure a current password is given if the access token doesn't have sudo
 	// privileges.
 	if !sudo && curPass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Provide current password."}
 	}
 
 	// Hash the new password
 	hashedPass, err := auth.HashPass([]byte(newPass))
 	if err != nil {
 		return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
 	}
 
 	// Do update
 	err = app.db.ChangePassphrase(userID, sudo, curPass, hashedPass)
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, struct{}{}, http.StatusOK)
 }
 
 func viewStats(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	var c *Collection
 	var err error
 	vars := mux.Vars(r)
 	alias := vars["collection"]
 	if alias != "" {
 		c, err = app.db.GetCollection(alias)
 		if err != nil {
 			return err
 		}
 		if c.OwnerID != u.ID {
 			return ErrCollectionNotFound
 		}
 	}
 
 	topPosts, err := app.db.GetTopPosts(u, alias)
 	if err != nil {
 		log.Error("Unable to get top posts: %v", err)
 		return err
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 	titleStats := ""
 	if c != nil {
 		titleStats = c.DisplayTitle() + " "
 	}
 
 	obj := struct {
 		*UserPage
 		VisitsBlog  string
 		Collection  *Collection
 		TopPosts    *[]PublicPost
 		APFollowers int
 	}{
 		UserPage:   NewUserPage(app, r, u, titleStats+"Stats", flashes),
 		VisitsBlog: alias,
 		Collection: c,
 		TopPosts:   topPosts,
 	}
 	if app.cfg.App.Federation {
 		folls, err := app.db.GetAPFollowers(c)
 		if err != nil {
 			return err
 		}
 		obj.APFollowers = len(*folls)
 	}
 
 	showUserPage(w, "stats", obj)
 	return nil
 }
 
 func viewSettings(app *App, u *User, w http.ResponseWriter, r *http.Request) error {
 	fullUser, err := app.db.GetUserByID(u.ID)
 	if err != nil {
 		log.Error("Unable to get user for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 
 	passIsSet, err := app.db.IsUserPassSet(u.ID)
 	if err != nil {
 		log.Error("Unable to get isUserPassSet for settings: %s", err)
 		return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
 	}
 
 	flashes, _ := getSessionFlashes(app, w, r, nil)
 
 	obj := struct {
 		*UserPage
 		Email    string
 		HasPass  bool
 		IsLogOut bool
 	}{
 		UserPage: NewUserPage(app, r, u, "Account Settings", flashes),
 		Email:    fullUser.EmailClear(app.keys),
 		HasPass:  passIsSet,
 		IsLogOut: r.FormValue("logout") == "1",
 	}
 
 	showUserPage(w, "settings", obj)
 	return nil
 }
 
 func saveTempInfo(app *App, key, val string, r *http.Request, w http.ResponseWriter) error {
 	session, err := app.sessionStore.Get(r, "t")
 	if err != nil {
 		return ErrInternalCookieSession
 	}
 
 	session.Values[key] = val
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't saveTempInfo for key-val (%s:%s): %v", key, val, err)
 	}
 	return err
 }
 
 func getTempInfo(app *App, key string, r *http.Request, w http.ResponseWriter) string {
 	session, err := app.sessionStore.Get(r, "t")
 	if err != nil {
 		return ""
 	}
 
 	// Get the information
 	var s = ""
 	var ok bool
 	if s, ok = session.Values[key].(string); !ok {
 		return ""
 	}
 
 	// Delete cookie
 	session.Options.MaxAge = -1
 	err = session.Save(r, w)
 	if err != nil {
 		log.Error("Couldn't erase temp data for key %s: %v", key, err)
 	}
 
 	// Return value
 	return s
 }
diff --git a/collections.go b/collections.go
index c095ecb..cdf3d5c 100644
--- a/collections.go
+++ b/collections.go
@@ -1,1090 +1,1090 @@
 /*
  * Copyright © 2018 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"math"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strconv"
 	"strings"
 	"unicode"
 
 	"github.com/gorilla/mux"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/auth"
 	"github.com/writeas/web-core/bots"
 	"github.com/writeas/web-core/log"
 	waposts "github.com/writeas/web-core/posts"
 	"github.com/writeas/writefreely/author"
 	"github.com/writeas/writefreely/config"
 	"github.com/writeas/writefreely/page"
 )
 
 type (
 	// TODO: add Direction to db
 	// TODO: add Language to db
 	Collection struct {
 		ID          int64          `datastore:"id" json:"-"`
 		Alias       string         `datastore:"alias" schema:"alias" json:"alias"`
 		Title       string         `datastore:"title" schema:"title" json:"title"`
 		Description string         `datastore:"description" schema:"description" json:"description"`
 		Direction   string         `schema:"dir" json:"dir,omitempty"`
 		Language    string         `schema:"lang" json:"lang,omitempty"`
 		StyleSheet  string         `datastore:"style_sheet" schema:"style_sheet" json:"style_sheet"`
 		Script      string         `datastore:"script" schema:"script" json:"script,omitempty"`
 		Public      bool           `datastore:"public" json:"public"`
 		Visibility  collVisibility `datastore:"private" json:"-"`
 		Format      string         `datastore:"format" json:"format,omitempty"`
 		Views       int64          `json:"views"`
 		OwnerID     int64          `datastore:"owner_id" json:"-"`
 		PublicOwner bool           `datastore:"public_owner" json:"-"`
 		URL         string         `json:"url,omitempty"`
 
 		db       *datastore
 		hostName string
 	}
 	CollectionObj struct {
 		Collection
 		TotalPosts int           `json:"total_posts"`
 		Owner      *User         `json:"owner,omitempty"`
 		Posts      *[]PublicPost `json:"posts,omitempty"`
 	}
 	DisplayCollection struct {
 		*CollectionObj
 		Prefix      string
 		IsTopLevel  bool
 		CurrentPage int
 		TotalPages  int
 		Format      *CollectionFormat
 	}
 	SubmittedCollection struct {
 		// Data used for updating a given collection
 		ID      int64
 		OwnerID uint64
 
 		// Form helpers
 		PreferURL string `schema:"prefer_url" json:"prefer_url"`
 		Privacy   int    `schema:"privacy" json:"privacy"`
 		Pass      string `schema:"password" json:"password"`
 		MathJax   bool   `schema:"mathjax" json:"mathjax"`
 		Handle    string `schema:"handle" json:"handle"`
 
 		// Actual collection values updated in the DB
 		Alias       *string         `schema:"alias" json:"alias"`
 		Title       *string         `schema:"title" json:"title"`
 		Description *string         `schema:"description" json:"description"`
 		StyleSheet  *sql.NullString `schema:"style_sheet" json:"style_sheet"`
 		Script      *sql.NullString `schema:"script" json:"script"`
 		Visibility  *int            `schema:"visibility" json:"public"`
 		Format      *sql.NullString `schema:"format" json:"format"`
 	}
 	CollectionFormat struct {
 		Format string
 	}
 
 	collectionReq struct {
 		// Information about the collection request itself
 		prefix, alias, domain string
 		isCustomDomain        bool
 
 		// User-related fields
 		isCollOwner bool
 	}
 )
 
 func (sc *SubmittedCollection) FediverseHandle() string {
 	if sc.Handle == "" {
 		return apCustomHandleDefault
 	}
 	return getSlug(sc.Handle, "")
 }
 
 // collVisibility represents the visibility level for the collection.
 type collVisibility int
 
 // Visibility levels. Values are bitmasks, stored in the database as
 // decimal numbers. If adding types, append them to this list. If removing,
 // replace the desired visibility with a new value.
 const CollUnlisted collVisibility = 0
 const (
 	CollPublic collVisibility = 1 << iota
 	CollPrivate
 	CollProtected
 )
 
 var collVisibilityStrings = map[string]collVisibility{
 	"unlisted":  CollUnlisted,
 	"public":    CollPublic,
 	"private":   CollPrivate,
 	"protected": CollProtected,
 }
 
 func defaultVisibility(cfg *config.Config) collVisibility {
 	vis, ok := collVisibilityStrings[cfg.App.DefaultVisibility]
 	if !ok {
 		vis = CollUnlisted
 	}
 	return vis
 }
 
 func (cf *CollectionFormat) Ascending() bool {
 	return cf.Format == "novel"
 }
 func (cf *CollectionFormat) ShowDates() bool {
 	return cf.Format == "blog"
 }
 func (cf *CollectionFormat) PostsPerPage() int {
 	if cf.Format == "novel" {
 		return postsPerPage
 	}
 	return postsPerPage
 }
 
 // Valid returns whether or not a format value is valid.
 func (cf *CollectionFormat) Valid() bool {
 	return cf.Format == "blog" ||
 		cf.Format == "novel" ||
 		cf.Format == "notebook"
 }
 
 // NewFormat creates a new CollectionFormat object from the Collection.
 func (c *Collection) NewFormat() *CollectionFormat {
 	cf := &CollectionFormat{Format: c.Format}
 
 	// Fill in default format
 	if cf.Format == "" {
 		cf.Format = "blog"
 	}
 
 	return cf
 }
 
 func (c *Collection) IsUnlisted() bool {
 	return c.Visibility == 0
 }
 
 func (c *Collection) IsPrivate() bool {
 	return c.Visibility&CollPrivate != 0
 }
 
 func (c *Collection) IsProtected() bool {
 	return c.Visibility&CollProtected != 0
 }
 
 func (c *Collection) IsPublic() bool {
 	return c.Visibility&CollPublic != 0
 }
 
 func (c *Collection) FriendlyVisibility() string {
 	if c.IsPrivate() {
 		return "Private"
 	}
 	if c.IsPublic() {
 		return "Public"
 	}
 	if c.IsProtected() {
 		return "Password-protected"
 	}
 	return "Unlisted"
 }
 
 func (c *Collection) ShowFooterBranding() bool {
 	// TODO: implement this setting
 	return true
 }
 
 // CanonicalURL returns a fully-qualified URL to the collection.
 func (c *Collection) CanonicalURL() string {
 	return c.RedirectingCanonicalURL(false)
 }
 
 func (c *Collection) DisplayCanonicalURL() string {
 	us := c.CanonicalURL()
 	u, err := url.Parse(us)
 	if err != nil {
 		return us
 	}
 	p := u.Path
 	if p == "/" {
 		p = ""
 	}
 	return u.Hostname() + p
 }
 
 func (c *Collection) RedirectingCanonicalURL(isRedir bool) string {
 	if c.hostName == "" {
 		// If this is true, the human programmers screwed up. So ask for a bug report and fail, fail, fail
 		log.Error("[PROGRAMMER ERROR] WARNING: Collection.hostName is empty! Federation and many other things will fail! If you're seeing this in the wild, please report this bug and let us know what you were doing just before this: https://github.com/writeas/writefreely/issues/new?template=bug_report.md")
 	}
 	if isSingleUser {
 		return c.hostName + "/"
 	}
 
 	return fmt.Sprintf("%s/%s/", c.hostName, c.Alias)
 }
 
 // PrevPageURL provides a full URL for the previous page of collection posts,
 // returning a /page/N result for pages >1
 func (c *Collection) PrevPageURL(prefix string, n int, tl bool) string {
 	u := ""
 	if n == 2 {
 		// Previous page is 1; no need for /page/ prefix
 		if prefix == "" {
 			u = "/"
 		}
 		// Else leave off trailing slash
 	} else {
 		u = fmt.Sprintf("/page/%d", n-1)
 	}
 
 	if tl {
 		return u
 	}
 	return "/" + prefix + c.Alias + u
 }
 
 // NextPageURL provides a full URL for the next page of collection posts
 func (c *Collection) NextPageURL(prefix string, n int, tl bool) string {
 	if tl {
 		return fmt.Sprintf("/page/%d", n+1)
 	}
 	return fmt.Sprintf("/%s%s/page/%d", prefix, c.Alias, n+1)
 }
 
 func (c *Collection) DisplayTitle() string {
 	if c.Title != "" {
 		return c.Title
 	}
 	return c.Alias
 }
 
 func (c *Collection) StyleSheetDisplay() template.CSS {
 	return template.CSS(c.StyleSheet)
 }
 
 // ForPublic modifies the Collection for public consumption, such as via
 // the API.
 func (c *Collection) ForPublic() {
 	c.URL = c.CanonicalURL()
 }
 
 var isAvatarChar = regexp.MustCompile("[a-z0-9]").MatchString
 
 func (c *Collection) PersonObject(ids ...int64) *activitystreams.Person {
 	accountRoot := c.FederatedAccount()
 	p := activitystreams.NewPerson(accountRoot)
 	p.URL = c.CanonicalURL()
 	uname := c.Alias
 	p.PreferredUsername = uname
 	p.Name = c.DisplayTitle()
 	p.Summary = c.Description
 	if p.Name != "" {
 		if av := c.AvatarURL(); av != "" {
 			p.Icon = activitystreams.Image{
 				Type:      "Image",
 				MediaType: "image/png",
 				URL:       av,
 			}
 		}
 	}
 
 	collID := c.ID
 	if len(ids) > 0 {
 		collID = ids[0]
 	}
 	pub, priv := c.db.GetAPActorKeys(collID)
 	if pub != nil {
 		p.AddPubKey(pub)
 		p.SetPrivKey(priv)
 	}
 
 	return p
 }
 
 func (c *Collection) AvatarURL() string {
 	fl := string(unicode.ToLower([]rune(c.DisplayTitle())[0]))
 	if !isAvatarChar(fl) {
 		return ""
 	}
 	return c.hostName + "/img/avatars/" + fl + ".png"
 }
 
 func (c *Collection) FederatedAPIBase() string {
 	return c.hostName + "/"
 }
 
 func (c *Collection) FederatedAccount() string {
 	accountUser := c.Alias
 	return c.FederatedAPIBase() + "api/collections/" + accountUser
 }
 
 func (c *Collection) RenderMathJax() bool {
 	return c.db.CollectionHasAttribute(c.ID, "render_mathjax")
 }
 
 func newCollection(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	alias := r.FormValue("alias")
 	title := r.FormValue("title")
 
 	var missingParams, accessToken string
 	var u *User
 	c := struct {
 		Alias string `json:"alias" schema:"alias"`
 		Title string `json:"title" schema:"title"`
 		Web   bool   `json:"web" schema:"web"`
 	}{}
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&c)
 		if err != nil {
 			log.Error("Couldn't parse post update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		// TODO: move form parsing to formDecoder
 		c.Alias = alias
 		c.Title = title
 	}
 
 	if c.Alias == "" {
 		if c.Title != "" {
 			// If only a title was given, just use it to generate the alias.
 			c.Alias = getSlug(c.Title, "")
 		} else {
 			missingParams += "`alias` "
 		}
 	}
 	if c.Title == "" {
 		missingParams += "`title` "
 	}
 	if missingParams != "" {
 		return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Parameter(s) %srequired.", missingParams)}
 	}
 
 	var userID int64
 	if reqJSON && !c.Web {
 		accessToken = r.Header.Get("Authorization")
 		if accessToken == "" {
 			return ErrNoAccessToken
 		}
 		userID = app.db.GetUserID(accessToken)
 		if userID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		userID = u.ID
 	}
 
 	if !author.IsValidUsername(app.cfg, c.Alias) {
 		return impart.HTTPError{http.StatusPreconditionFailed, "Collection alias isn't valid."}
 	}
 
 	coll, err := app.db.CreateCollection(app.cfg, c.Alias, c.Title, userID)
 	if err != nil {
 		// TODO: handle this
 		return err
 	}
 
 	res := &CollectionObj{Collection: *coll}
 
 	if reqJSON {
 		return impart.WriteSuccess(w, res, http.StatusCreated)
 	}
 	redirectTo := "/me/c/"
 	// TODO: redirect to pad when necessary
 	return impart.HTTPError{http.StatusFound, redirectTo}
 }
 
 func apiCheckCollectionPermissions(app *App, r *http.Request, c *Collection) (int64, error) {
 	accessToken := r.Header.Get("Authorization")
 	var userID int64 = -1
 	if accessToken != "" {
 		userID = app.db.GetUserID(accessToken)
 	}
 	isCollOwner := userID == c.OwnerID
 	if c.IsPrivate() && !isCollOwner {
 		// Collection is private, but user isn't authenticated
 		return -1, ErrCollectionNotFound
 	}
 	if c.IsProtected() {
 		// TODO: check access token
 		return -1, ErrCollectionUnauthorizedRead
 	}
 
 	return userID, nil
 }
 
 // fetchCollection handles the API endpoint for retrieving collection data.
 func fetchCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	accept := r.Header.Get("Accept")
 	if strings.Contains(accept, "application/activity+json") {
 		return handleFetchCollectionActivities(app, w, r)
 	}
 
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
 	// TODO: move this logic into a common getCollection function
 	// Get base Collection data
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Redirect users who aren't requesting JSON
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	if !reqJSON {
 		return impart.HTTPError{http.StatusFound, c.CanonicalURL()}
 	}
 
 	// Check permissions
 	userID, err := apiCheckCollectionPermissions(app, r, c)
 	if err != nil {
 		return err
 	}
 	isCollOwner := userID == c.OwnerID
 
 	// Fetch extra data about the Collection
 	res := &CollectionObj{Collection: *c}
 	if c.PublicOwner {
 		u, err := app.db.GetUserByID(res.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		} else {
 			res.Owner = u
 		}
 	}
 	app.db.GetPostsCount(res, isCollOwner)
 	// Strip non-public information
 	res.Collection.ForPublic()
 
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 // fetchCollectionPosts handles an API endpoint for retrieving a collection's
 // posts.
 func fetchCollectionPosts(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	alias := vars["alias"]
 
 	c, err := app.db.GetCollection(alias)
 	if err != nil {
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Check permissions
 	userID, err := apiCheckCollectionPermissions(app, r, c)
 	if err != nil {
 		return err
 	}
 	isCollOwner := userID == c.OwnerID
 
 	// Get page
 	page := 1
 	if p := r.FormValue("page"); p != "" {
 		pInt, _ := strconv.Atoi(p)
 		if pInt > 0 {
 			page = pInt
 		}
 	}
 
 	posts, err := app.db.GetPosts(app.cfg, c, page, isCollOwner, false, false)
 	if err != nil {
 		return err
 	}
 	coll := &CollectionObj{Collection: *c, Posts: posts}
 	app.db.GetPostsCount(coll, isCollOwner)
 	// Strip non-public information
 	coll.Collection.ForPublic()
 
 	// Transform post bodies if needed
 	if r.FormValue("body") == "html" {
 		for _, p := range *coll.Posts {
 			p.Content = waposts.ApplyMarkdown([]byte(p.Content))
 		}
 	}
 
 	return impart.WriteSuccess(w, coll, http.StatusOK)
 }
 
 type CollectionPage struct {
 	page.StaticPage
 	*DisplayCollection
 	IsCustomDomain bool
 	IsWelcome      bool
 	IsOwner        bool
 	CanPin         bool
 	Username       string
 	Collections    *[]Collection
 	PinnedPosts    *[]PublicPost
 	IsAdmin        bool
 	CanInvite      bool
 }
 
 func (c *CollectionObj) ScriptDisplay() template.JS {
 	return template.JS(c.Script)
 }
 
 var jsSourceCommentReg = regexp.MustCompile("(?m)^// src:(.+)$")
 
 func (c *CollectionObj) ExternalScripts() []template.URL {
 	scripts := []template.URL{}
 	if c.Script == "" {
 		return scripts
 	}
 
 	matches := jsSourceCommentReg.FindAllStringSubmatch(c.Script, -1)
 	for _, m := range matches {
 		scripts = append(scripts, template.URL(strings.TrimSpace(m[1])))
 	}
 	return scripts
 }
 
 func (c *CollectionObj) CanShowScript() bool {
 	return false
 }
 
 func processCollectionRequest(cr *collectionReq, vars map[string]string, w http.ResponseWriter, r *http.Request) error {
 	cr.prefix = vars["prefix"]
 	cr.alias = vars["collection"]
 	// Normalize the URL, redirecting user to consistent post URL
 	if cr.alias != strings.ToLower(cr.alias) {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", strings.ToLower(cr.alias))}
 	}
 
 	return nil
 }
 
 // processCollectionPermissions checks the permissions for the given
 // collectionReq, returning a Collection if access is granted; otherwise this
 // renders any necessary collection pages, for example, if requesting a custom
 // domain that doesn't yet have a collection associated, or if a collection
 // requires a password. In either case, this will return nil, nil -- thus both
 // values should ALWAYS be checked to determine whether or not to continue.
 func processCollectionPermissions(app *App, cr *collectionReq, u *User, w http.ResponseWriter, r *http.Request) (*Collection, error) {
 	// Display collection if this is a collection
 	var c *Collection
 	var err error
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(cr.alias)
 	}
 	// TODO: verify we don't reveal the existence of a private collection with redirection
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if err.Status == http.StatusNotFound {
 				if cr.isCustomDomain {
 					// User is on the site from a custom domain
 					//tErr := pages["404-domain.tmpl"].ExecuteTemplate(w, "base", pageForHost(page.StaticPage{}, r))
 					//if tErr != nil {
 					//log.Error("Unable to render 404-domain page: %v", err)
 					//}
 					return nil, nil
 				}
 				if len(cr.alias) >= minIDLen && len(cr.alias) <= maxIDLen {
 					// Alias is within post ID range, so just be sure this isn't a post
 					if app.db.PostIDExists(cr.alias) {
 						// TODO: use StatusFound for vanity post URLs when we implement them
 						return nil, impart.HTTPError{http.StatusMovedPermanently, "/" + cr.alias}
 					}
 				}
 				// Redirect if necessary
 				newAlias := app.db.GetCollectionRedirect(cr.alias)
 				if newAlias != "" {
 					return nil, impart.HTTPError{http.StatusFound, "/" + newAlias + "/"}
 				}
 			}
 		}
 		return nil, err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Update CollectionRequest to reflect owner status
 	cr.isCollOwner = u != nil && u.ID == c.OwnerID
 
 	// Check permissions
 	if !cr.isCollOwner {
 		if c.IsPrivate() {
 			return nil, ErrCollectionNotFound
 		} else if c.IsProtected() {
 			uname := ""
 			if u != nil {
 				uname = u.Username
 			}
 
 			// See if we've authorized this collection
 			authd := isAuthorizedForCollection(app, c.Alias, r)
 
 			if !authd {
 				p := struct {
 					page.StaticPage
 					*CollectionObj
 					Username string
 					Next     string
 					Flashes  []template.HTML
 				}{
 					StaticPage:    pageForReq(app, r),
 					CollectionObj: &CollectionObj{Collection: *c},
 					Username:      uname,
 					Next:          r.FormValue("g"),
 					Flashes:       []template.HTML{},
 				}
 				// Get owner information
 				p.CollectionObj.Owner, err = app.db.GetUserByID(c.OwnerID)
 				if err != nil {
 					// Log the error and just continue
 					log.Error("Error getting user for collection: %v", err)
 				}
 
 				flashes, _ := getSessionFlashes(app, w, r, nil)
 				for _, flash := range flashes {
 					p.Flashes = append(p.Flashes, template.HTML(flash))
 				}
 				err = templates["password-collection"].ExecuteTemplate(w, "password-collection", p)
 				if err != nil {
 					log.Error("Unable to render password-collection: %v", err)
 					return nil, err
 				}
 				return nil, nil
 			}
 		}
 	}
 	return c, nil
 }
 
 func checkUserForCollection(app *App, cr *collectionReq, r *http.Request, isPostReq bool) (*User, error) {
 	u := getUserSession(app, r)
 	return u, nil
 }
 
 func newDisplayCollection(c *Collection, cr *collectionReq, page int) *DisplayCollection {
 	coll := &DisplayCollection{
 		CollectionObj: &CollectionObj{Collection: *c},
 		CurrentPage:   page,
 		Prefix:        cr.prefix,
 		IsTopLevel:    isSingleUser,
 		Format:        c.NewFormat(),
 	}
 	c.db.GetPostsCount(coll.CollectionObj, cr.isCollOwner)
 	return coll
 }
 
 func getCollectionPage(vars map[string]string) int {
 	page := 1
 	var p int
 	p, _ = strconv.Atoi(vars["page"])
 	if p > 0 {
 		page = p
 	}
 	return page
 }
 
 // handleViewCollection displays the requested Collection
 func handleViewCollection(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	cr := &collectionReq{}
 
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 
 	c.hostName = app.cfg.App.Host
 
 	// Serve ActivityStreams data now, if requested
 	if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
 		ac := c.PersonObject()
 		ac.Context = []interface{}{activitystreams.Namespace}
 		return impart.RenderActivityJSON(w, ac, http.StatusOK)
 	}
 
 	// Fetch extra data about the Collection
 	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
 	coll := newDisplayCollection(c, cr, page)
 
 	coll.TotalPages = int(math.Ceil(float64(coll.TotalPosts) / float64(coll.Format.PostsPerPage())))
 	if coll.TotalPages > 0 && page > coll.TotalPages {
 		redirURL := fmt.Sprintf("/page/%d", coll.TotalPages)
 		if !app.cfg.App.SingleUser {
 			redirURL = fmt.Sprintf("/%s%s%s", cr.prefix, coll.Alias, redirURL)
 		}
 		return impart.HTTPError{http.StatusFound, redirURL}
 	}
 
 	coll.Posts, _ = app.db.GetPosts(app.cfg, c, page, cr.isCollOwner, false, false)
 
 	// Serve collection
 	displayPage := CollectionPage{
 		DisplayCollection: coll,
 		StaticPage:        pageForReq(app, r),
 		IsCustomDomain:    cr.isCustomDomain,
 		IsWelcome:         r.FormValue("greeting") != "",
 	}
 	displayPage.IsAdmin = u != nil && u.IsAdmin()
 	displayPage.CanInvite = canUserInvite(app.cfg, displayPage.IsAdmin)
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner, app.cfg.App.Host)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	isOwner := owner != nil
 	if !isOwner {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 	}
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj, isOwner)
 
 	collTmpl := "collection"
 	if app.cfg.App.Chorus {
 		collTmpl = "chorus-collection"
 	}
 	err = templates[collTmpl].ExecuteTemplate(w, "collection", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection index: %v", err)
 	}
 
 	// Update collection view count
 	go func() {
 		// Don't update if owner is viewing the collection.
 		if u != nil && u.ID == coll.OwnerID {
 			return
 		}
 		// Only update for human views
 		if r.Method == "HEAD" || bots.IsBot(r.UserAgent()) {
 			return
 		}
 
 		_, err := app.db.Exec("UPDATE collections SET view_count = view_count + 1 WHERE id = ?", coll.ID)
 		if err != nil {
 			log.Error("Unable to update collections count: %v", err)
 		}
 	}()
 
 	return err
 }
 
 func handleViewCollectionTag(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	tag := vars["tag"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	u, err := checkUserForCollection(app, cr, r, false)
 	if err != nil {
 		return err
 	}
 
 	page := getCollectionPage(vars)
 
 	c, err := processCollectionPermissions(app, cr, u, w, r)
 	if c == nil || err != nil {
 		return err
 	}
 
 	coll := newDisplayCollection(c, cr, page)
 
 	coll.Posts, _ = app.db.GetPostsTagged(app.cfg, c, tag, page, cr.isCollOwner)
 	if coll.Posts != nil && len(*coll.Posts) == 0 {
 		return ErrCollectionPageNotFound
 	}
 
 	// Serve collection
 	displayPage := struct {
 		CollectionPage
 		Tag string
 	}{
 		CollectionPage: CollectionPage{
 			DisplayCollection: coll,
 			StaticPage:        pageForReq(app, r),
 			IsCustomDomain:    cr.isCustomDomain,
 		},
 		Tag: tag,
 	}
 	var owner *User
 	if u != nil {
 		displayPage.Username = u.Username
 		displayPage.IsOwner = u.ID == coll.OwnerID
 		if displayPage.IsOwner {
 			// Add in needed information for users viewing their own collection
 			owner = u
 			displayPage.CanPin = true
 
 			pubColls, err := app.db.GetPublishableCollections(owner, app.cfg.App.Host)
 			if err != nil {
 				log.Error("unable to fetch collections: %v", err)
 			}
 			displayPage.Collections = pubColls
 		}
 	}
 	isOwner := owner != nil
 	if !isOwner {
 		// Current user doesn't own collection; retrieve owner information
 		owner, err = app.db.GetUserByID(coll.OwnerID)
 		if err != nil {
 			// Log the error and just continue
 			log.Error("Error getting user for collection: %v", err)
 		}
 	}
 	displayPage.Owner = owner
 	coll.Owner = displayPage.Owner
 	// Add more data
 	// TODO: fix this mess of collections inside collections
 	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj, isOwner)
 
 	err = templates["collection-tags"].ExecuteTemplate(w, "collection-tags", displayPage)
 	if err != nil {
 		log.Error("Unable to render collection tag page: %v", err)
 	}
 
 	return nil
 }
 
 func handleCollectionPostRedirect(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	loc := fmt.Sprintf("/%s", slug)
 	if !app.cfg.App.SingleUser {
 		loc = fmt.Sprintf("/%s/%s", cr.alias, slug)
 	}
 	return impart.HTTPError{http.StatusFound, loc}
 }
 
 func existingCollection(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 	isWeb := r.FormValue("web") == "1"
 
 	var u *User
 	if reqJSON && !isWeb {
 		// Ensure an access token was given
 		accessToken := r.Header.Get("Authorization")
 		u = &User{}
 		u.ID = app.db.GetUserID(accessToken)
 		if u.ID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 	}
 
 	if r.Method == "DELETE" {
 		err := app.db.DeleteCollection(collAlias, u.ID)
 		if err != nil {
 			// TODO: if not HTTPError, report error to admin
 			log.Error("Unable to delete collection: %s", err)
 			return err
 		}
 		addSessionFlash(app, w, r, "Deleted your blog, "+collAlias+".", nil)
 		return impart.HTTPError{Status: http.StatusNoContent}
 	}
 
 	c := SubmittedCollection{OwnerID: uint64(u.ID)}
 	var err error
 
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&c)
 		if err != nil {
 			log.Error("Couldn't parse collection update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse collection update form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&c, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode collection update form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	err = app.db.UpdateCollection(&c, collAlias)
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if reqJSON {
 				return err
 			}
 			addSessionFlash(app, w, r, err.Message, nil)
 			return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
 		} else {
 			log.Error("Couldn't update collection: %v\n", err)
 			return err
 		}
 	}
 
 	if reqJSON {
 		return impart.WriteSuccess(w, struct {
 		}{}, http.StatusOK)
 	}
 
 	addSessionFlash(app, w, r, "Blog updated!", nil)
 	return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
 }
 
 // collectionAliasFromReq takes a request and returns the collection alias
 // if it can be ascertained, as well as whether or not the collection uses a
 // custom domain.
 func collectionAliasFromReq(r *http.Request) string {
 	vars := mux.Vars(r)
 	alias := vars["subdomain"]
 	isSubdomain := alias != ""
 	if !isSubdomain {
 		// Fall back to write.as/{collection} since this isn't a custom domain
 		alias = vars["collection"]
 	}
 	return alias
 }
 
 func handleWebCollectionUnlock(app *App, w http.ResponseWriter, r *http.Request) error {
 	var readReq struct {
 		Alias string `schema:"alias" json:"alias"`
 		Pass  string `schema:"password" json:"password"`
 		Next  string `schema:"to" json:"to"`
 	}
 
 	// Get params
 	if impart.ReqJSON(r) {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&readReq)
 		if err != nil {
 			log.Error("Couldn't parse readReq JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse readReq form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&readReq, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode readReq form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	if readReq.Alias == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Need a collection `alias` to read."}
 	}
 	if readReq.Pass == "" {
 		return impart.HTTPError{http.StatusBadRequest, "Please supply a password."}
 	}
 
 	var collHashedPass []byte
 	err := app.db.QueryRow("SELECT password FROM collectionpasswords INNER JOIN collections ON id = collection_id WHERE alias = ?", readReq.Alias).Scan(&collHashedPass)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			log.Error("No collectionpassword found when trying to read collection %s", readReq.Alias)
 			return impart.HTTPError{http.StatusInternalServerError, "Something went very wrong. The humans have been alerted."}
 		}
 		return err
 	}
 
 	if !auth.Authenticated(collHashedPass, []byte(readReq.Pass)) {
 		return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
 	}
 
 	// Success; set cookie
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
 	if err == nil {
 		session.Values[readReq.Alias] = true
 		err = session.Save(r, w)
 		if err != nil {
 			log.Error("Didn't save unlocked blog '%s': %v", readReq.Alias, err)
 		}
 	}
 
 	next := "/" + readReq.Next
 	if !app.cfg.App.SingleUser {
 		next = "/" + readReq.Alias + next
 	}
 	return impart.HTTPError{http.StatusFound, next}
 }
 
 func isAuthorizedForCollection(app *App, alias string, r *http.Request) bool {
 	authd := false
 	session, err := app.sessionStore.Get(r, blogPassCookieName)
 	if err == nil {
 		_, authd = session.Values[alias]
 	}
 	return authd
 }
diff --git a/handle.go b/handle.go
index 99c23ae..7e410f5 100644
--- a/handle.go
+++ b/handle.go
@@ -1,848 +1,848 @@
 /*
  * Copyright © 2018-2019 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"fmt"
 	"html/template"
 	"net/http"
 	"net/url"
 	"runtime/debug"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gorilla/sessions"
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/writefreely/config"
 	"github.com/writeas/writefreely/page"
 )
 
 // UserLevel represents the required user level for accessing an endpoint
 type UserLevel int
 
 const (
 	UserLevelNoneType         UserLevel = iota // user or not -- ignored
 	UserLevelOptionalType                      // user or not -- object fetched if user
 	UserLevelNoneRequiredType                  // non-user (required)
 	UserLevelUserType                          // user (required)
 )
 
 func UserLevelNone(cfg *config.Config) UserLevel {
 	return UserLevelNoneType
 }
 
 func UserLevelOptional(cfg *config.Config) UserLevel {
 	return UserLevelOptionalType
 }
 
 func UserLevelNoneRequired(cfg *config.Config) UserLevel {
 	return UserLevelNoneRequiredType
 }
 
 func UserLevelUser(cfg *config.Config) UserLevel {
 	return UserLevelUserType
 }
 
 // UserLevelReader returns the permission level required for any route where
 // users can read published content.
 func UserLevelReader(cfg *config.Config) UserLevel {
 	if cfg.App.Private {
 		return UserLevelUserType
 	}
 	return UserLevelOptionalType
 }
 
 type (
 	handlerFunc          func(app *App, w http.ResponseWriter, r *http.Request) error
 	userHandlerFunc      func(app *App, u *User, w http.ResponseWriter, r *http.Request) error
 	userApperHandlerFunc func(apper Apper, u *User, w http.ResponseWriter, r *http.Request) error
 	dataHandlerFunc      func(app *App, w http.ResponseWriter, r *http.Request) ([]byte, string, error)
 	authFunc             func(app *App, r *http.Request) (*User, error)
 	UserLevelFunc        func(cfg *config.Config) UserLevel
 )
 
 type Handler struct {
 	errors       *ErrorPages
 	sessionStore *sessions.CookieStore
 	app          Apper
 }
 
 // ErrorPages hold template HTML error pages for displaying errors to the user.
 // In each, there should be a defined template named "base".
 type ErrorPages struct {
 	NotFound            *template.Template
 	Gone                *template.Template
 	InternalServerError *template.Template
 	Blank               *template.Template
 }
 
 // NewHandler returns a new Handler instance, using the given StaticPage data,
 // and saving alias to the application's CookieStore.
 func NewHandler(apper Apper) *Handler {
 	h := &Handler{
 		errors: &ErrorPages{
 			NotFound:            template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>404</title></head><body><p>Not found.</p></body></html>{{end}}")),
 			Gone:                template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>410</title></head><body><p>Gone.</p></body></html>{{end}}")),
 			InternalServerError: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>500</title></head><body><p>Internal server error.</p></body></html>{{end}}")),
 			Blank:               template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>{{.Title}}</title></head><body><p>{{.Content}}</p></body></html>{{end}}")),
 		},
 		sessionStore: apper.App().sessionStore,
 		app:          apper,
 	}
 
 	return h
 }
 
 // NewWFHandler returns a new Handler instance, using WriteFreely template files.
 // You MUST call writefreely.InitTemplates() before this.
 func NewWFHandler(apper Apper) *Handler {
 	h := NewHandler(apper)
 	h.SetErrorPages(&ErrorPages{
 		NotFound:            pages["404-general.tmpl"],
 		Gone:                pages["410.tmpl"],
 		InternalServerError: pages["500.tmpl"],
 		Blank:               pages["blank.tmpl"],
 	})
 	return h
 }
 
 // SetErrorPages sets the given set of ErrorPages as templates for any errors
 // that come up.
 func (h *Handler) SetErrorPages(e *ErrorPages) {
 	h.errors = e
 }
 
 // User handles requests made in the web application by the authenticated user.
 // This provides user-friendly HTML pages and actions that work in the browser.
 func (h *Handler) User(f userHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil {
 				err := ErrNotLoggedIn
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app.App(), u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 // Admin handles requests on /admin routes
 func (h *Handler) Admin(f userHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil || !u.IsAdmin() {
 				err := impart.HTTPError{http.StatusNotFound, ""}
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app.App(), u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 // AdminApper handles requests on /admin routes that require an Apper.
 func (h *Handler) AdminApper(f userApperHandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = http.StatusInternalServerError
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u := getUserSession(h.app.App(), r)
 			if u == nil || !u.IsAdmin() {
 				err := impart.HTTPError{http.StatusNotFound, ""}
 				status = err.Status
 				return err
 			}
 
 			err := f(h.app, u, w, r)
 			if err == nil {
 				status = http.StatusOK
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = http.StatusInternalServerError
 			}
 
 			return err
 		}())
 	}
 }
 
 func apiAuth(app *App, r *http.Request) (*User, error) {
 	// Authorize user from Authorization header
 	t := r.Header.Get("Authorization")
 	if t == "" {
 		return nil, ErrNoAccessToken
 	}
 	u := &User{ID: app.db.GetUserID(t)}
 	if u.ID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return u, nil
 }
 
 // optionaAPIAuth is used for endpoints that accept authenticated requests via
 // Authorization header or cookie, unlike apiAuth. It returns a different err
 // in the case where no Authorization header is present.
 func optionalAPIAuth(app *App, r *http.Request) (*User, error) {
 	// Authorize user from Authorization header
 	t := r.Header.Get("Authorization")
 	if t == "" {
 		return nil, ErrNotLoggedIn
 	}
 	u := &User{ID: app.db.GetUserID(t)}
 	if u.ID == -1 {
 		return nil, ErrBadAccessToken
 	}
 
 	return u, nil
 }
 
 func webAuth(app *App, r *http.Request) (*User, error) {
 	u := getUserSession(app, r)
 	if u == nil {
 		return nil, ErrNotLoggedIn
 	}
 	return u, nil
 }
 
 // UserAPI handles requests made in the API by the authenticated user.
 // This provides user-friendly HTML pages and actions that work in the browser.
 func (h *Handler) UserAPI(f userHandlerFunc) http.HandlerFunc {
 	return h.UserAll(false, f, apiAuth)
 }
 
 func (h *Handler) UserAll(web bool, f userHandlerFunc, a authFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		handleFunc := func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			u, err := a(h.app.App(), r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 				return err
 			}
 
 			err = f(h.app.App(), u, w, r)
 			if err == nil {
 				status = 200
 			} else if err, ok := err.(impart.HTTPError); ok {
 				status = err.Status
 			} else {
 				status = 500
 			}
 
 			return err
 		}
 
 		if web {
 			h.handleHTTPError(w, r, handleFunc())
 		} else {
 			h.handleError(w, r, handleFunc())
 		}
 	}
 }
 
 func (h *Handler) RedirectOnErr(f handlerFunc, loc string) handlerFunc {
 	return func(app *App, w http.ResponseWriter, r *http.Request) error {
 		err := f(app, w, r)
 		if err != nil {
 			if ie, ok := err.(impart.HTTPError); ok {
 				// Override default redirect with returned error's, if it's a
 				// redirect error.
 				if ie.Status == http.StatusFound {
 					return ie
 				}
 			}
 			return impart.HTTPError{http.StatusFound, loc}
 		}
 		return nil
 	}
 }
 
 func (h *Handler) Page(n string) http.HandlerFunc {
 	return h.Web(func(app *App, w http.ResponseWriter, r *http.Request) error {
 		t, ok := pages[n]
 		if !ok {
 			return impart.HTTPError{http.StatusNotFound, "Page not found."}
 		}
 
 		sp := pageForReq(app, r)
 
 		err := t.ExecuteTemplate(w, "base", sp)
 		if err != nil {
 			log.Error("Unable to render page: %v", err)
 		}
 		return err
 	}, UserLevelOptional)
 }
 
 func (h *Handler) WebErrors(f handlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// TODO: factor out this logic shared with Web()
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					u := getUserSession(h.app.App(), r)
 					username := "None"
 					if u != nil {
 						username = u.Username
 					}
 					log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			var session *sessions.Session
 			var err error
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err = h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			// TODO: pass User object to function
 			err = f(h.app.App(), w, r)
 			if err == nil {
 				status = 200
 			} else if httpErr, ok := err.(impart.HTTPError); ok {
 				status = httpErr.Status
 				if status < 300 || status > 399 {
 					addSessionFlash(h.app.App(), w, r, httpErr.Message, session)
 					return impart.HTTPError{http.StatusFound, r.Referer()}
 				}
 			} else {
 				e := fmt.Sprintf("[Web handler] 500: %v", err)
 				if !strings.HasSuffix(e, "write: broken pipe") {
 					log.Error(e)
 				} else {
 					log.Error(e)
 				}
 				log.Info("Web handler internal error render")
 				h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 				status = 500
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) CollectionPostOrStatic(w http.ResponseWriter, r *http.Request) {
 	if strings.Contains(r.URL.Path, ".") && !isRaw(r) {
 		start := time.Now()
 		status := 200
 		defer func() {
 			log.Info(h.app.ReqLog(r, status, time.Since(start)))
 		}()
 
 		// Serve static file
 		h.app.App().shttp.ServeHTTP(w, r)
 		return
 	}
 
 	h.Web(viewCollectionPost, UserLevelReader)(w, r)
 }
 
 // Web handles requests made in the web application. This provides user-
 // friendly HTML pages and actions that work in the browser.
 func (h *Handler) Web(f handlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					u := getUserSession(h.app.App(), r)
 					username := "None"
 					if u != nil {
 						username = u.Username
 					}
 					log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
 					log.Info("Web deferred internal error render")
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err := h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			// TODO: pass User object to function
 			err := f(h.app.App(), w, r)
 			if err == nil {
 				status = 200
 			} else if httpErr, ok := err.(impart.HTTPError); ok {
 				status = httpErr.Status
 			} else {
 				e := fmt.Sprintf("[Web handler] 500: %v", err)
 				log.Error(e)
 				log.Info("Web internal error render")
 				h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 				status = 500
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) All(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleError(w, r, func() error {
 			// TODO: return correct "success" status
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			// TODO: do any needed authentication
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) AllReader(f handlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleError(w, r, func() error {
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s:\n%s", e, debug.Stack())
 					impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if h.app.App().cfg.App.Private {
 				// This instance is private, so ensure it's being accessed by a valid user
 				// Check if authenticated with an access token
 				_, apiErr := optionalAPIAuth(h.app.App(), r)
 				if apiErr != nil {
 					if err, ok := apiErr.(impart.HTTPError); ok {
 						status = err.Status
 					} else {
 						status = 500
 					}
 
 					if apiErr == ErrNotLoggedIn {
 						// Fall back to web auth since there was no access token given
 						_, err := webAuth(h.app.App(), r)
 						if err != nil {
 							if err, ok := apiErr.(impart.HTTPError); ok {
 								status = err.Status
 							} else {
 								status = 500
 							}
 							return err
 						}
 					} else {
 						return apiErr
 					}
 				}
 			}
 
 			err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 			}
 
 			return err
 		}())
 	}
 }
 
 func (h *Handler) Download(f dataHandlerFunc, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			var status int
 			start := time.Now()
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			data, filename, err := f(h.app.App(), w, r)
 			if err != nil {
 				if err, ok := err.(impart.HTTPError); ok {
 					status = err.Status
 				} else {
 					status = 500
 				}
 				return err
 			}
 
 			ext := ".json"
 			ct := "application/json"
 			if strings.HasSuffix(r.URL.Path, ".csv") {
 				ext = ".csv"
 				ct = "text/csv"
 			} else if strings.HasSuffix(r.URL.Path, ".zip") {
 				ext = ".zip"
 				ct = "application/zip"
 			}
 			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s%s", filename, ext))
 			w.Header().Set("Content-Type", ct)
 			w.Header().Set("Content-Length", strconv.Itoa(len(data)))
 			fmt.Fprint(w, string(data))
 
 			status = 200
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) Redirect(url string, ul UserLevelFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			start := time.Now()
 
 			var status int
 			if ul(h.app.App().cfg) != UserLevelNoneType {
 				session, err := h.sessionStore.Get(r, cookieName)
 				if err != nil && (ul(h.app.App().cfg) == UserLevelNoneRequiredType || ul(h.app.App().cfg) == UserLevelUserType) {
 					// Cookie is required, but we can ignore this error
 					log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul(h.app.App().cfg), err)
 				}
 
 				_, gotUser := session.Values[cookieUserVal].(*User)
 				if ul(h.app.App().cfg) == UserLevelNoneRequiredType && gotUser {
 					to := correctPageFromLoginAttempt(r)
 					log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
 					err := impart.HTTPError{http.StatusFound, to}
 					status = err.Status
 					return err
 				} else if ul(h.app.App().cfg) == UserLevelUserType && !gotUser {
 					log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
 					err := ErrNotLoggedIn
 					status = err.Status
 					return err
 				}
 			}
 
 			status = sendRedirect(w, http.StatusFound, url)
 
 			log.Info(h.app.ReqLog(r, status, time.Since(start)))
 
 			return nil
 		}())
 	}
 }
 
 func (h *Handler) handleHTTPError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		} else if err.Status == http.StatusUnauthorized {
 			q := ""
 			if r.URL.RawQuery != "" {
 				q = url.QueryEscape("?" + r.URL.RawQuery)
 			}
 			sendRedirect(w, http.StatusFound, "/login?to="+r.URL.Path+q)
 			return
 		} else if err.Status == http.StatusGone {
 			w.WriteHeader(err.Status)
 			p := &struct {
 				page.StaticPage
 				Content *template.HTML
 			}{
 				StaticPage: pageForReq(h.app.App(), r),
 			}
 			if err.Message != "" {
 				co := template.HTML(err.Message)
 				p.Content = &co
 			}
 			h.errors.Gone.ExecuteTemplate(w, "base", p)
 			return
 		} else if err.Status == http.StatusNotFound {
 			w.WriteHeader(err.Status)
 			if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
 				// This is a fediverse request; simply return the header
 				return
 			}
 			h.errors.NotFound.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusInternalServerError {
 			w.WriteHeader(err.Status)
 			log.Info("handleHTTPErorr internal error render")
 			h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 			return
 		} else if err.Status == http.StatusAccepted {
 			impart.WriteSuccess(w, "", err.Status)
 			return
 		} else {
 			p := &struct {
 				page.StaticPage
 				Title   string
 				Content template.HTML
 			}{
 				pageForReq(h.app.App(), r),
 				fmt.Sprintf("Uh oh (%d)", err.Status),
 				template.HTML(fmt.Sprintf("<p style=\"text-align: center\" class=\"introduction\">%s</p>", err.Message)),
 			}
 			h.errors.Blank.ExecuteTemplate(w, "base", p)
 			return
 		}
 		impart.WriteError(w, err)
 		return
 	}
 
 	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 }
 
 func (h *Handler) handleError(w http.ResponseWriter, r *http.Request, err error) {
 	if err == nil {
 		return
 	}
 
 	if err, ok := err.(impart.HTTPError); ok {
 		if err.Status >= 300 && err.Status < 400 {
 			sendRedirect(w, err.Status, err.Message)
 			return
 		}
 
 		//		if strings.Contains(r.Header.Get("Accept"), "text/html") {
 		impart.WriteError(w, err)
 		//		}
 		return
 	}
 
-	if IsJSON(r.Header.Get("Content-Type")) {
+	if IsJSON(r) {
 		impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
 		return
 	}
 	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 }
 
 func correctPageFromLoginAttempt(r *http.Request) string {
 	to := r.FormValue("to")
 	if to == "" {
 		to = "/"
 	} else if !strings.HasPrefix(to, "/") {
 		to = "/" + to
 	}
 	return to
 }
 
 func (h *Handler) LogHandlerFunc(f http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		h.handleHTTPError(w, r, func() error {
 			status := 200
 			start := time.Now()
 
 			defer func() {
 				if e := recover(); e != nil {
 					log.Error("Handler.LogHandlerFunc\n\n%s: %s", e, debug.Stack())
 					h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app.App(), r))
 					status = 500
 				}
 
 				// TODO: log actual status code returned
 				log.Info(h.app.ReqLog(r, status, time.Since(start)))
 			}()
 
 			if h.app.App().cfg.App.Private {
 				// This instance is private, so ensure it's being accessed by a valid user
 				// Check if authenticated with an access token
 				_, apiErr := optionalAPIAuth(h.app.App(), r)
 				if apiErr != nil {
 					if err, ok := apiErr.(impart.HTTPError); ok {
 						status = err.Status
 					} else {
 						status = 500
 					}
 
 					if apiErr == ErrNotLoggedIn {
 						// Fall back to web auth since there was no access token given
 						_, err := webAuth(h.app.App(), r)
 						if err != nil {
 							if err, ok := apiErr.(impart.HTTPError); ok {
 								status = err.Status
 							} else {
 								status = 500
 							}
 							return err
 						}
 					} else {
 						return apiErr
 					}
 				}
 			}
 
 			f(w, r)
 
 			return nil
 		}())
 	}
 }
 
 func sendRedirect(w http.ResponseWriter, code int, location string) int {
 	w.Header().Set("Location", location)
 	w.WriteHeader(code)
 	return code
 }
diff --git a/posts.go b/posts.go
index 88730f7..1f35eda 100644
--- a/posts.go
+++ b/posts.go
@@ -1,1467 +1,1467 @@
 /*
  * Copyright © 2018-2019 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
 	"regexp"
 	"strings"
 	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/guregu/null"
 	"github.com/guregu/null/zero"
 	"github.com/kylemcc/twitter-text-go/extract"
 	"github.com/microcosm-cc/bluemonday"
 	stripmd "github.com/writeas/go-strip-markdown"
 	"github.com/writeas/impart"
 	"github.com/writeas/monday"
 	"github.com/writeas/slug"
 	"github.com/writeas/web-core/activitystreams"
 	"github.com/writeas/web-core/bots"
 	"github.com/writeas/web-core/converter"
 	"github.com/writeas/web-core/i18n"
 	"github.com/writeas/web-core/log"
 	"github.com/writeas/web-core/tags"
 	"github.com/writeas/writefreely/config"
 	"github.com/writeas/writefreely/page"
 	"github.com/writeas/writefreely/parse"
 )
 
 const (
 	// Post ID length bounds
 	minIDLen      = 10
 	maxIDLen      = 10
 	userPostIDLen = 10
 	postIDLen     = 10
 
 	postMetaDateFormat = "2006-01-02 15:04:05"
 )
 
 type (
 	AnonymousPost struct {
 		ID          string
 		Content     string
 		HTMLContent template.HTML
 		Font        string
 		Language    string
 		Direction   string
 		Title       string
 		GenTitle    string
 		Description string
 		Author      string
 		Views       int64
 		IsPlainText bool
 		IsCode      bool
 		IsLinkable  bool
 	}
 
 	AuthenticatedPost struct {
 		ID  string `json:"id" schema:"id"`
 		Web bool   `json:"web" schema:"web"`
 		*SubmittedPost
 	}
 
 	// SubmittedPost represents a post supplied by a client for publishing or
 	// updating. Since Title and Content can be updated to "", they are
 	// pointers that can be easily tested to detect changes.
 	SubmittedPost struct {
 		Slug     *string                  `json:"slug" schema:"slug"`
 		Title    *string                  `json:"title" schema:"title"`
 		Content  *string                  `json:"body" schema:"body"`
 		Font     string                   `json:"font" schema:"font"`
 		IsRTL    converter.NullJSONBool   `json:"rtl" schema:"rtl"`
 		Language converter.NullJSONString `json:"lang" schema:"lang"`
 		Created  *string                  `json:"created" schema:"created"`
 	}
 
 	// Post represents a post as found in the database.
 	Post struct {
 		ID             string        `db:"id" json:"id"`
 		Slug           null.String   `db:"slug" json:"slug,omitempty"`
 		Font           string        `db:"text_appearance" json:"appearance"`
 		Language       zero.String   `db:"language" json:"language"`
 		RTL            zero.Bool     `db:"rtl" json:"rtl"`
 		Privacy        int64         `db:"privacy" json:"-"`
 		OwnerID        null.Int      `db:"owner_id" json:"-"`
 		CollectionID   null.Int      `db:"collection_id" json:"-"`
 		PinnedPosition null.Int      `db:"pinned_position" json:"-"`
 		Created        time.Time     `db:"created" json:"created"`
 		Updated        time.Time     `db:"updated" json:"updated"`
 		ViewCount      int64         `db:"view_count" json:"-"`
 		Title          zero.String   `db:"title" json:"title"`
 		HTMLTitle      template.HTML `db:"title" json:"-"`
 		Content        string        `db:"content" json:"body"`
 		HTMLContent    template.HTML `db:"content" json:"-"`
 		HTMLExcerpt    template.HTML `db:"content" json:"-"`
 		Tags           []string      `json:"tags"`
 		Images         []string      `json:"images,omitempty"`
 
 		OwnerName string `json:"owner,omitempty"`
 	}
 
 	// PublicPost holds properties for a publicly returned post, i.e. a post in
 	// a context where the viewer may not be the owner. As such, sensitive
 	// metadata for the post is hidden and properties supporting the display of
 	// the post are added.
 	PublicPost struct {
 		*Post
 		IsSubdomain bool           `json:"-"`
 		IsTopLevel  bool           `json:"-"`
 		DisplayDate string         `json:"-"`
 		Views       int64          `json:"views"`
 		Owner       *PublicUser    `json:"-"`
 		IsOwner     bool           `json:"-"`
 		Collection  *CollectionObj `json:"collection,omitempty"`
 	}
 
 	RawPost struct {
 		Id, Slug     string
 		Title        string
 		Content      string
 		Views        int64
 		Font         string
 		Created      time.Time
 		IsRTL        sql.NullBool
 		Language     sql.NullString
 		OwnerID      int64
 		CollectionID sql.NullInt64
 
 		Found bool
 		Gone  bool
 	}
 
 	AnonymousAuthPost struct {
 		ID    string `json:"id"`
 		Token string `json:"token"`
 	}
 	ClaimPostRequest struct {
 		*AnonymousAuthPost
 		CollectionAlias  string `json:"collection"`
 		CreateCollection bool   `json:"create_collection"`
 
 		// Generated properties
 		Slug string `json:"-"`
 	}
 	ClaimPostResult struct {
 		ID           string      `json:"id,omitempty"`
 		Code         int         `json:"code,omitempty"`
 		ErrorMessage string      `json:"error_msg,omitempty"`
 		Post         *PublicPost `json:"post,omitempty"`
 	}
 )
 
 func (p *Post) Direction() string {
 	if p.RTL.Valid {
 		if p.RTL.Bool {
 			return "rtl"
 		}
 		return "ltr"
 	}
 	return "auto"
 }
 
 // DisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) DisplayTitle() string {
 	if p.Title.String != "" {
 		return p.Title.String
 	}
 	t := friendlyPostTitle(p.Content, p.ID)
 	return t
 }
 
 // PlainDisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) PlainDisplayTitle() string {
 	if t := stripmd.Strip(p.DisplayTitle()); t != "" {
 		return t
 	}
 	return p.ID
 }
 
 // FormattedDisplayTitle dynamically generates a title from the Post's contents if it
 // doesn't already have an explicit title.
 func (p *Post) FormattedDisplayTitle() template.HTML {
 	if p.HTMLTitle != "" {
 		return p.HTMLTitle
 	}
 	return template.HTML(p.DisplayTitle())
 }
 
 // Summary gives a shortened summary of the post based on the post's title,
 // especially for display in a longer list of posts. It extracts a summary for
 // posts in the Title\n\nBody format, returning nothing if the entire was short
 // enough that the extracted title == extracted summary.
 func (p Post) Summary() string {
 	if p.Content == "" {
 		return ""
 	}
 	// Strip out HTML
 	p.Content = bluemonday.StrictPolicy().Sanitize(p.Content)
 	// and Markdown
 	p.Content = stripmd.Strip(p.Content)
 
 	title := p.Title.String
 	var desc string
 	if title == "" {
 		// No title, so generate one
 		title = friendlyPostTitle(p.Content, p.ID)
 		desc = postDescription(p.Content, title, p.ID)
 		if desc == title {
 			return ""
 		}
 		return desc
 	}
 
 	return shortPostDescription(p.Content)
 }
 
 // Excerpt shows any text that comes before a (more) tag.
 // TODO: use HTMLExcerpt in templates instead of this method
 func (p *Post) Excerpt() template.HTML {
 	return p.HTMLExcerpt
 }
 
 func (p *Post) CreatedDate() string {
 	return p.Created.Format("2006-01-02")
 }
 
 func (p *Post) Created8601() string {
 	return p.Created.Format("2006-01-02T15:04:05Z")
 }
 
 func (p *Post) IsScheduled() bool {
 	return p.Created.After(time.Now())
 }
 
 func (p *Post) HasTag(tag string) bool {
 	// Regexp looks for tag and has a non-capturing group at the end looking
 	// for the end of the word.
 	// Assisted by: https://stackoverflow.com/a/35192941/1549194
 	hasTag, _ := regexp.MatchString("#"+tag+`(?:[[:punct:]]|\s|\z)`, p.Content)
 	return hasTag
 }
 
 func (p *Post) HasTitleLink() bool {
 	if p.Title.String == "" {
 		return false
 	}
 	hasLink, _ := regexp.MatchString(`([^!]+|^)\[.+\]\(.+\)`, p.Title.String)
 	return hasLink
 }
 
 func handleViewPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	friendlyID := vars["post"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw() and viewCollectionPost()
 	isJSON := strings.HasSuffix(friendlyID, ".json")
 	isXML := strings.HasSuffix(friendlyID, ".xml")
 	isCSS := strings.HasSuffix(friendlyID, ".css")
 	isMarkdown := strings.HasSuffix(friendlyID, ".md")
 	isRaw := strings.HasSuffix(friendlyID, ".txt") || isJSON || isXML || isCSS || isMarkdown
 
 	// Display reserved page if that is requested resource
 	if t, ok := pages[r.URL.Path[1:]+".tmpl"]; ok {
 		return handleTemplatedPage(app, w, r, t)
 	} else if (strings.Contains(r.URL.Path, ".") && !isRaw && !isMarkdown) || r.URL.Path == "/robots.txt" || r.URL.Path == "/manifest.json" {
 		// Serve static file
 		app.shttp.ServeHTTP(w, r)
 		return nil
 	}
 
 	// Display collection if this is a collection
 	c, _ := app.db.GetCollection(friendlyID)
 	if c != nil {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", friendlyID)}
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	if friendlyID != strings.ToLower(friendlyID) {
 		return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s", strings.ToLower(friendlyID))}
 	}
 
 	ext := ""
 	if isRaw {
 		parts := strings.Split(friendlyID, ".")
 		friendlyID = parts[0]
 		if len(parts) > 1 {
 			ext = "." + parts[1]
 		}
 	}
 
 	var ownerID sql.NullInt64
 	var title string
 	var content string
 	var font string
 	var language []byte
 	var rtl []byte
 	var views int64
 	var post *AnonymousPost
 	var found bool
 	var gone bool
 
 	fixedID := slug.Make(friendlyID)
 	if fixedID != friendlyID {
 		return impart.HTTPError{http.StatusFound, fmt.Sprintf("/%s%s", fixedID, ext)}
 	}
 
 	err := app.db.QueryRow(fmt.Sprintf("SELECT owner_id, title, content, text_appearance, view_count, language, rtl FROM posts WHERE id = ?"), friendlyID).Scan(&ownerID, &title, &content, &font, &views, &language, &rtl)
 	switch {
 	case err == sql.ErrNoRows:
 		found = false
 
 		// Output the error in the correct format
 		if isJSON {
 			content = "{\"error\": \"Post not found.\"}"
 		} else if isRaw {
 			content = "Post not found."
 		} else {
 			return ErrPostNotFound
 		}
 	case err != nil:
 		found = false
 
 		log.Error("Post loading err: %s\n", err)
 		return ErrInternalGeneral
 	default:
 		found = true
 
 		var d string
 		if len(rtl) == 0 {
 			d = "auto"
 		} else if rtl[0] == 49 {
 			// TODO: find a cleaner way to get this (possibly NULL) value
 			d = "rtl"
 		} else {
 			d = "ltr"
 		}
 		generatedTitle := friendlyPostTitle(content, friendlyID)
 		sanitizedContent := content
 		if font != "code" {
 			sanitizedContent = template.HTMLEscapeString(content)
 		}
 		var desc string
 		if title == "" {
 			desc = postDescription(content, title, friendlyID)
 		} else {
 			desc = shortPostDescription(content)
 		}
 		post = &AnonymousPost{
 			ID:          friendlyID,
 			Content:     sanitizedContent,
 			Title:       title,
 			GenTitle:    generatedTitle,
 			Description: desc,
 			Author:      "",
 			Font:        font,
 			IsPlainText: isRaw,
 			IsCode:      font == "code",
 			IsLinkable:  font != "code",
 			Views:       views,
 			Language:    string(language),
 			Direction:   d,
 		}
 		if !isRaw {
 			post.HTMLContent = template.HTML(applyMarkdown([]byte(content), "", app.cfg))
 		}
 	}
 
 	// Check if post has been unpublished
 	if content == "" {
 		gone = true
 
 		if isJSON {
 			content = "{\"error\": \"Post was unpublished.\"}"
 		} else if isCSS {
 			content = ""
 		} else if isRaw {
 			content = "Post was unpublished."
 		} else {
 			return ErrPostUnpublished
 		}
 	}
 
 	var u = &User{}
 	if isRaw {
 		contentType := "text/plain"
 		if isJSON {
 			contentType = "application/json"
 		} else if isCSS {
 			contentType = "text/css"
 		} else if isXML {
 			contentType = "application/xml"
 		} else if isMarkdown {
 			contentType = "text/markdown"
 		}
 		w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
 		if isMarkdown && post.Title != "" {
 			fmt.Fprintf(w, "%s\n", post.Title)
 			for i := 1; i <= len(post.Title); i++ {
 				fmt.Fprintf(w, "=")
 			}
 			fmt.Fprintf(w, "\n\n")
 		}
 		fmt.Fprint(w, content)
 
 		if !found {
 			return ErrPostNotFound
 		} else if gone {
 			return ErrPostUnpublished
 		}
 	} else {
 		var err error
 		page := struct {
 			*AnonymousPost
 			page.StaticPage
 			Username string
 			IsOwner  bool
 			SiteURL  string
 		}{
 			AnonymousPost: post,
 			StaticPage:    pageForReq(app, r),
 			SiteURL:       app.cfg.App.Host,
 		}
 		if u = getUserSession(app, r); u != nil {
 			page.Username = u.Username
 			page.IsOwner = ownerID.Valid && ownerID.Int64 == u.ID
 		}
 
 		err = templates["post"].ExecuteTemplate(w, "post", page)
 		if err != nil {
 			log.Error("Post template execute error: %v", err)
 		}
 	}
 
 	go func() {
 		if u != nil && ownerID.Valid && ownerID.Int64 == u.ID {
 			// Post is owned by someone; skip view increment since that person is viewing this post.
 			return
 		}
 		// Update stats for non-raw post views
 		if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
 			_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE id = ?", friendlyID)
 			if err != nil {
 				log.Error("Unable to update posts count: %v", err)
 			}
 		}
 	}()
 
 	return nil
 }
 
 // API v2 funcs
 // newPost creates a new post with or without an owning Collection.
 //
 // Endpoints:
 //   /posts
 //   /posts?collection={alias}
 // ? /collections/{alias}/posts
 func newPost(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 	if collAlias == "" {
 		collAlias = r.FormValue("collection")
 	}
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" {
 		// TODO: remove this
 		accessToken = r.FormValue("access_token")
 	}
 
 	// FIXME: determine web submission with Content-Type header
 	var u *User
 	var userID int64 = -1
 	var username string
 	if accessToken == "" {
 		u = getUserSession(app, r)
 		if u != nil {
 			userID = u.ID
 			username = u.Username
 		}
 	} else {
 		userID = app.db.GetUserID(accessToken)
 	}
 	if userID == -1 {
 		return ErrNotLoggedIn
 	}
 
 	if accessToken == "" && u == nil && collAlias != "" {
 		return impart.HTTPError{http.StatusBadRequest, "Parameter `access_token` required."}
 	}
 
 	// Get post data
 	var p *SubmittedPost
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&p)
 		if err != nil {
 			log.Error("Couldn't parse new post JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 		if p.Title == nil {
 			t := ""
 			p.Title = &t
 		}
 		if strings.TrimSpace(*(p.Content)) == "" {
 			return ErrNoPublishableContent
 		}
 	} else {
 		post := r.FormValue("body")
 		appearance := r.FormValue("font")
 		title := r.FormValue("title")
 		rtlValue := r.FormValue("rtl")
 		langValue := r.FormValue("lang")
 		if strings.TrimSpace(post) == "" {
 			return ErrNoPublishableContent
 		}
 
 		var isRTL, rtlValid bool
 		if rtlValue == "auto" && langValue != "" {
 			isRTL = i18n.LangIsRTL(langValue)
 			rtlValid = true
 		} else {
 			isRTL = rtlValue == "true"
 			rtlValid = rtlValue != "" && langValue != ""
 		}
 
 		// Create a new post
 		p = &SubmittedPost{
 			Title:    &title,
 			Content:  &post,
 			Font:     appearance,
 			IsRTL:    converter.NullJSONBool{sql.NullBool{Bool: isRTL, Valid: rtlValid}},
 			Language: converter.NullJSONString{sql.NullString{String: langValue, Valid: langValue != ""}},
 		}
 	}
 	if !p.isFontValid() {
 		p.Font = "norm"
 	}
 
 	var newPost *PublicPost = &PublicPost{}
 	var coll *Collection
 	var err error
 	if accessToken != "" {
 		newPost, err = app.db.CreateOwnedPost(p, accessToken, collAlias, app.cfg.App.Host)
 	} else {
 		//return ErrNotLoggedIn
 		// TODO: verify user is logged in
 		var collID int64
 		if collAlias != "" {
 			coll, err = app.db.GetCollection(collAlias)
 			if err != nil {
 				return err
 			}
 			coll.hostName = app.cfg.App.Host
 			if coll.OwnerID != u.ID {
 				return ErrForbiddenCollection
 			}
 			collID = coll.ID
 		}
 		// TODO: return PublicPost from createPost
 		newPost.Post, err = app.db.CreatePost(userID, collID, p)
 	}
 	if err != nil {
 		return err
 	}
 	if coll != nil {
 		coll.ForPublic()
 		newPost.Collection = &CollectionObj{Collection: *coll}
 	}
 
 	newPost.extractData()
 	newPost.OwnerName = username
 
 	// Write success now
 	response := impart.WriteSuccess(w, newPost, http.StatusCreated)
 
 	if newPost.Collection != nil && !app.cfg.App.Private && app.cfg.App.Federation && !newPost.Created.After(time.Now()) {
 		go federatePost(app, newPost, newPost.Collection.ID, false)
 	}
 
 	return response
 }
 
 func existingPost(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 	vars := mux.Vars(r)
 	postID := vars["post"]
 
 	p := AuthenticatedPost{ID: postID}
 	var err error
 
 	if reqJSON {
 		// Decode JSON request
 		decoder := json.NewDecoder(r.Body)
 		err = decoder.Decode(&p)
 		if err != nil {
 			log.Error("Couldn't parse post update JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err = r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse post update form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		// Can't decode to a nil SubmittedPost property, so create instance now
 		p.SubmittedPost = &SubmittedPost{}
 		err = app.formDecoder.Decode(&p, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode post update form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 
 	if p.Web {
 		p.IsRTL.Valid = true
 	}
 
 	if p.SubmittedPost == nil {
 		return ErrPostNoUpdatableVals
 	}
 
 	// Ensure an access token was given
 	accessToken := r.Header.Get("Authorization")
 	// Get user's cookie session if there's no token
 	var u *User
 	//var username string
 	if accessToken == "" {
 		u = getUserSession(app, r)
 		if u != nil {
 			//username = u.Username
 		}
 	}
 	if u == nil && accessToken == "" {
 		return ErrNoAccessToken
 	}
 
 	// Get user ID from current session or given access token, if one was given.
 	var userID int64
 	if u != nil {
 		userID = u.ID
 	} else if accessToken != "" {
 		userID, err = AuthenticateUser(app.db, accessToken)
 		if err != nil {
 			return err
 		}
 	}
 
 	// Modify post struct
 	p.ID = postID
 
 	err = app.db.UpdateOwnedPost(&p, userID)
 	if err != nil {
 		if reqJSON {
 			return err
 		}
 
 		if err, ok := err.(impart.HTTPError); ok {
 			addSessionFlash(app, w, r, err.Message, nil)
 		} else {
 			addSessionFlash(app, w, r, err.Error(), nil)
 		}
 	}
 
 	var pRes *PublicPost
 	pRes, err = app.db.GetPost(p.ID, 0)
 	if reqJSON {
 		if err != nil {
 			return err
 		}
 		pRes.extractData()
 	}
 
 	if pRes.CollectionID.Valid {
 		coll, err := app.db.GetCollectionBy("id = ?", pRes.CollectionID.Int64)
 		if err == nil && !app.cfg.App.Private && app.cfg.App.Federation {
 			coll.hostName = app.cfg.App.Host
 			pRes.Collection = &CollectionObj{Collection: *coll}
 			go federatePost(app, pRes, pRes.Collection.ID, true)
 		}
 	}
 
 	// Write success now
 	if reqJSON {
 		return impart.WriteSuccess(w, pRes, http.StatusOK)
 	}
 
 	addSessionFlash(app, w, r, "Changes saved.", nil)
 	collectionAlias := vars["alias"]
 	redirect := "/" + postID + "/meta"
 	if collectionAlias != "" {
 		collPre := "/" + collectionAlias
 		if app.cfg.App.SingleUser {
 			collPre = ""
 		}
 		redirect = collPre + "/" + pRes.Slug.String + "/edit/meta"
 	} else {
 		if app.cfg.App.SingleUser {
 			redirect = "/d" + redirect
 		}
 	}
 	w.Header().Set("Location", redirect)
 	w.WriteHeader(http.StatusFound)
 
 	return nil
 }
 
 func deletePost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	friendlyID := vars["post"]
 	editToken := r.FormValue("token")
 
 	var ownerID int64
 	var u *User
 	accessToken := r.Header.Get("Authorization")
 	if accessToken == "" && editToken == "" {
 		u = getUserSession(app, r)
 		if u == nil {
 			return ErrNoAccessToken
 		}
 	}
 
 	var res sql.Result
 	var t *sql.Tx
 	var err error
 	var collID sql.NullInt64
 	var coll *Collection
 	var pp *PublicPost
 	if editToken != "" {
 		// TODO: SELECT owner_id, as well, and return appropriate error if NULL instead of running two queries
 		var dummy int64
 		err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ?", friendlyID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			return impart.HTTPError{http.StatusNotFound, "Post not found."}
 		}
 		err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ? AND owner_id IS NULL", friendlyID).Scan(&dummy)
 		switch {
 		case err == sql.ErrNoRows:
 			// Post already has an owner. This could provide a bad experience
 			// for the user, but it's more important to ensure data isn't lost
 			// unexpectedly. So prevent deletion via token.
 			return impart.HTTPError{http.StatusConflict, "This post belongs to some user (hopefully yours). Please log in and delete it from that user's account."}
 		}
 		res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND modify_token = ? AND owner_id IS NULL", friendlyID, editToken)
 	} else if accessToken != "" || u != nil {
 		// Caller provided some way to authenticate; assume caller expects the
 		// post to be deleted based on a specific post owner, thus we should
 		// return corresponding errors.
 		if accessToken != "" {
 			ownerID = app.db.GetUserID(accessToken)
 			if ownerID == -1 {
 				return ErrBadAccessToken
 			}
 		} else {
 			ownerID = u.ID
 		}
 
 		// TODO: don't make two queries
 		var realOwnerID sql.NullInt64
 		err = app.db.QueryRow("SELECT collection_id, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&collID, &realOwnerID)
 		if err != nil {
 			return err
 		}
 		if !collID.Valid {
 			// There's no collection; simply delete the post
 			res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
 		} else {
 			// Post belongs to a collection; do any additional clean up
 			coll, err = app.db.GetCollectionBy("id = ?", collID.Int64)
 			if err != nil {
 				log.Error("Unable to get collection: %v", err)
 				return err
 			}
 			if app.cfg.App.Federation {
 				// First fetch full post for federation
 				pp, err = app.db.GetOwnedPost(friendlyID, ownerID)
 				if err != nil {
 					log.Error("Unable to get owned post: %v", err)
 					return err
 				}
 				collObj := &CollectionObj{Collection: *coll}
 				pp.Collection = collObj
 			}
 
 			t, err = app.db.Begin()
 			if err != nil {
 				log.Error("No begin: %v", err)
 				return err
 			}
 			res, err = t.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
 		}
 	} else {
 		return impart.HTTPError{http.StatusBadRequest, "No authenticated user or post token given."}
 	}
 	if err != nil {
 		return err
 	}
 
 	affected, err := res.RowsAffected()
 	if err != nil {
 		if t != nil {
 			t.Rollback()
 			log.Error("Rows affected err! Rolling back")
 		}
 		return err
 	} else if affected == 0 {
 		if t != nil {
 			t.Rollback()
 			log.Error("No rows affected! Rolling back")
 		}
 		return impart.HTTPError{http.StatusForbidden, "Post not found, or you're not the owner."}
 	}
 	if t != nil {
 		t.Commit()
 	}
 	if coll != nil && !app.cfg.App.Private && app.cfg.App.Federation {
 		go deleteFederatedPost(app, pp, collID.Int64)
 	}
 
 	return impart.HTTPError{Status: http.StatusNoContent}
 }
 
 // addPost associates a post with the authenticated user.
 func addPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var ownerID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		ownerID = app.db.GetUserID(at)
 		if ownerID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		ownerID = u.ID
 	}
 
 	// Parse claimed posts in format:
 	// [{"id": "...", "token": "..."}]
 	var claims *[]ClaimPostRequest
 	decoder := json.NewDecoder(r.Body)
 	err := decoder.Decode(&claims)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 
 	// Update all given posts
 	res, err := app.db.ClaimPosts(app.cfg, ownerID, collAlias, claims)
 	if err != nil {
 		return err
 	}
 
 	if !app.cfg.App.Private && app.cfg.App.Federation {
 		for _, pRes := range *res {
 			if pRes.Code != http.StatusOK {
 				continue
 			}
 			if !pRes.Post.Created.After(time.Now()) {
 				pRes.Post.Collection.hostName = app.cfg.App.Host
 				go federatePost(app, pRes.Post, pRes.Post.Collection.ID, false)
 			}
 		}
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 func dispersePost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var ownerID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		ownerID = app.db.GetUserID(at)
 		if ownerID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		ownerID = u.ID
 	}
 
 	// Parse posts in format:
 	// ["..."]
 	var postIDs []string
 	decoder := json.NewDecoder(r.Body)
 	err := decoder.Decode(&postIDs)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	// Update all given posts
 	res, err := app.db.DispersePosts(ownerID, postIDs)
 	if err != nil {
 		return err
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 type (
 	PinPostResult struct {
 		ID           string `json:"id,omitempty"`
 		Code         int    `json:"code,omitempty"`
 		ErrorMessage string `json:"error_msg,omitempty"`
 	}
 )
 
 // pinPost pins a post to a blog
 func pinPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var userID int64
 
 	// Authenticate user
 	at := r.Header.Get("Authorization")
 	if at != "" {
 		userID = app.db.GetUserID(at)
 		if userID == -1 {
 			return ErrBadAccessToken
 		}
 	} else {
 		u := getUserSession(app, r)
 		if u == nil {
 			return ErrNotLoggedIn
 		}
 		userID = u.ID
 	}
 
 	// Parse request
 	var posts []struct {
 		ID       string `json:"id"`
 		Position int64  `json:"position"`
 	}
 	decoder := json.NewDecoder(r.Body)
 	err := decoder.Decode(&posts)
 	if err != nil {
 		return ErrBadJSONArray
 	}
 
 	// Validate data
 	vars := mux.Vars(r)
 	collAlias := vars["alias"]
 
 	coll, err := app.db.GetCollection(collAlias)
 	if err != nil {
 		return err
 	}
 	if coll.OwnerID != userID {
 		return ErrForbiddenCollection
 	}
 
 	// Do (un)pinning
 	isPinning := r.URL.Path[strings.LastIndex(r.URL.Path, "/"):] == "/pin"
 	res := []PinPostResult{}
 	for _, p := range posts {
 		err = app.db.UpdatePostPinState(isPinning, p.ID, coll.ID, userID, p.Position)
 		ppr := PinPostResult{ID: p.ID}
 		if err != nil {
 			ppr.Code = http.StatusInternalServerError
 			// TODO: set error messsage
 		} else {
 			ppr.Code = http.StatusOK
 		}
 		res = append(res, ppr)
 	}
 	return impart.WriteSuccess(w, res, http.StatusOK)
 }
 
 func fetchPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	var collID int64
 	var coll *Collection
 	var err error
 	vars := mux.Vars(r)
 	if collAlias := vars["alias"]; collAlias != "" {
 		// Fetch collection information, since an alias is provided
 		coll, err = app.db.GetCollection(collAlias)
 		if err != nil {
 			return err
 		}
 		coll.hostName = app.cfg.App.Host
 		_, err = apiCheckCollectionPermissions(app, r, coll)
 		if err != nil {
 			return err
 		}
 		collID = coll.ID
 	}
 
 	p, err := app.db.GetPost(vars["post"], collID)
 	if err != nil {
 		return err
 	}
 
 	p.extractData()
 
 	accept := r.Header.Get("Accept")
 	if strings.Contains(accept, "application/activity+json") {
 		// Fetch information about the collection this belongs to
 		if coll == nil && p.CollectionID.Valid {
 			coll, err = app.db.GetCollectionByID(p.CollectionID.Int64)
 			if err != nil {
 				return err
 			}
 		}
 		if coll == nil {
 			// This is a draft post; 404 for now
 			// TODO: return ActivityObject
 			return impart.HTTPError{http.StatusNotFound, ""}
 		}
 
 		p.Collection = &CollectionObj{Collection: *coll}
 		po := p.ActivityObject(app.cfg)
 		po.Context = []interface{}{activitystreams.Namespace}
 		return impart.RenderActivityJSON(w, po, http.StatusOK)
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func fetchPostProperty(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	p, err := app.db.GetPostProperty(vars["post"], 0, vars["property"])
 	if err != nil {
 		return err
 	}
 
 	return impart.WriteSuccess(w, p, http.StatusOK)
 }
 
 func (p *Post) processPost() PublicPost {
 	res := &PublicPost{Post: p, Views: 0}
 	res.Views = p.ViewCount
 	// TODO: move to own function
 	loc := monday.FuzzyLocale(p.Language.String)
 	res.DisplayDate = monday.Format(p.Created, monday.LongFormatsByLocale[loc], loc)
 
 	return *res
 }
 
 func (p *PublicPost) CanonicalURL() string {
 	if p.Collection == nil || p.Collection.Alias == "" {
 		return p.Collection.hostName + "/" + p.ID
 	}
 	return p.Collection.CanonicalURL() + p.Slug.String
 }
 
 func (p *PublicPost) ActivityObject(cfg *config.Config) *activitystreams.Object {
 	o := activitystreams.NewArticleObject()
 	o.ID = p.Collection.FederatedAPIBase() + "api/posts/" + p.ID
 	o.Published = p.Created
 	o.URL = p.CanonicalURL()
 	o.AttributedTo = p.Collection.FederatedAccount()
 	o.CC = []string{
 		p.Collection.FederatedAccount() + "/followers",
 	}
 	o.Name = p.DisplayTitle()
 	if p.HTMLContent == template.HTML("") {
 		p.formatContent(cfg, false)
 	}
 	o.Content = string(p.HTMLContent)
 	if p.Language.Valid {
 		o.ContentMap = map[string]string{
 			p.Language.String: string(p.HTMLContent),
 		}
 	}
 	if len(p.Tags) == 0 {
 		o.Tag = []activitystreams.Tag{}
 	} else {
 		var tagBaseURL string
 		if isSingleUser {
 			tagBaseURL = p.Collection.CanonicalURL() + "tag:"
 		} else {
 			if cfg.App.Chorus {
 				tagBaseURL = fmt.Sprintf("%s/read/t/", p.Collection.hostName)
 			} else {
 				tagBaseURL = fmt.Sprintf("%s/%s/tag:", p.Collection.hostName, p.Collection.Alias)
 			}
 		}
 		for _, t := range p.Tags {
 			o.Tag = append(o.Tag, activitystreams.Tag{
 				Type: activitystreams.TagHashtag,
 				HRef: tagBaseURL + t,
 				Name: "#" + t,
 			})
 		}
 	}
 	return o
 }
 
 // TODO: merge this into getSlugFromPost or phase it out
 func getSlug(title, lang string) string {
 	return getSlugFromPost("", title, lang)
 }
 
 func getSlugFromPost(title, body, lang string) string {
 	if title == "" {
 		title = postTitle(body, body)
 	}
 	title = parse.PostLede(title, false)
 	// Truncate lede if needed
 	title, _ = parse.TruncToWord(title, 80)
 	var s string
 	if lang != "" && len(lang) == 2 {
 		s = slug.MakeLang(title, lang)
 	} else {
 		s = slug.Make(title)
 	}
 
 	// Transliteration may cause the slug to expand past the limit, so truncate again
 	s, _ = parse.TruncToWord(s, 80)
 	return strings.TrimFunc(s, func(r rune) bool {
 		// TruncToWord doesn't respect words in a slug, since spaces are replaced
 		// with hyphens. So remove any trailing hyphens.
 		return r == '-'
 	})
 }
 
 // isFontValid returns whether or not the submitted post's appearance is valid.
 func (p *SubmittedPost) isFontValid() bool {
 	validFonts := map[string]bool{
 		"norm": true,
 		"sans": true,
 		"mono": true,
 		"wrap": true,
 		"code": true,
 	}
 
 	_, valid := validFonts[p.Font]
 	return valid
 }
 
 func getRawPost(app *App, friendlyID string) *RawPost {
 	var content, font, title string
 	var isRTL sql.NullBool
 	var lang sql.NullString
 	var ownerID sql.NullInt64
 	var created time.Time
 
 	err := app.db.QueryRow("SELECT title, content, text_appearance, language, rtl, created, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&title, &content, &font, &lang, &isRTL, &created, &ownerID)
 	switch {
 	case err == sql.ErrNoRows:
 		return &RawPost{Content: "", Found: false, Gone: false}
 	case err != nil:
 		return &RawPost{Content: "", Found: true, Gone: false}
 	}
 
 	return &RawPost{Title: title, Content: content, Font: font, Created: created, IsRTL: isRTL, Language: lang, OwnerID: ownerID.Int64, Found: true, Gone: content == ""}
 
 }
 
 // TODO; return a Post!
 func getRawCollectionPost(app *App, slug, collAlias string) *RawPost {
 	var id, title, content, font string
 	var isRTL sql.NullBool
 	var lang sql.NullString
 	var created time.Time
 	var ownerID null.Int
 	var views int64
 	var err error
 
 	if app.cfg.App.SingleUser {
 		err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, owner_id FROM posts WHERE slug = ? AND collection_id = 1", slug).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &ownerID)
 	} else {
 		err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, owner_id FROM posts WHERE slug = ? AND collection_id = (SELECT id FROM collections WHERE alias = ?)", slug, collAlias).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &ownerID)
 	}
 	switch {
 	case err == sql.ErrNoRows:
 		return &RawPost{Content: "", Found: false, Gone: false}
 	case err != nil:
 		return &RawPost{Content: "", Found: true, Gone: false}
 	}
 
 	return &RawPost{
 		Id:       id,
 		Slug:     slug,
 		Title:    title,
 		Content:  content,
 		Font:     font,
 		Created:  created,
 		IsRTL:    isRTL,
 		Language: lang,
 		OwnerID:  ownerID.Int64,
 		Found:    true,
 		Gone:     content == "",
 		Views:    views,
 	}
 }
 
 func isRaw(r *http.Request) bool {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw in viewCollectionPost() and handleViewPost()
 	isJSON := strings.HasSuffix(slug, ".json")
 	isXML := strings.HasSuffix(slug, ".xml")
 	isMarkdown := strings.HasSuffix(slug, ".md")
 	return strings.HasSuffix(slug, ".txt") || isJSON || isXML || isMarkdown
 }
 
 func viewCollectionPost(app *App, w http.ResponseWriter, r *http.Request) error {
 	vars := mux.Vars(r)
 	slug := vars["slug"]
 
 	// NOTE: until this is done better, be sure to keep this in parity with
 	// isRaw() and handleViewPost()
 	isJSON := strings.HasSuffix(slug, ".json")
 	isXML := strings.HasSuffix(slug, ".xml")
 	isMarkdown := strings.HasSuffix(slug, ".md")
 	isRaw := strings.HasSuffix(slug, ".txt") || isJSON || isXML || isMarkdown
 
 	cr := &collectionReq{}
 	err := processCollectionRequest(cr, vars, w, r)
 	if err != nil {
 		return err
 	}
 
 	// Check for hellbanned users
 	u, err := checkUserForCollection(app, cr, r, true)
 	if err != nil {
 		return err
 	}
 
 	// Normalize the URL, redirecting user to consistent post URL
 	if slug != strings.ToLower(slug) {
 		loc := fmt.Sprintf("/%s", strings.ToLower(slug))
 		if !app.cfg.App.SingleUser {
 			loc = "/" + cr.alias + loc
 		}
 		return impart.HTTPError{http.StatusMovedPermanently, loc}
 	}
 
 	// Display collection if this is a collection
 	var c *Collection
 	if app.cfg.App.SingleUser {
 		c, err = app.db.GetCollectionByID(1)
 	} else {
 		c, err = app.db.GetCollection(cr.alias)
 	}
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			if err.Status == http.StatusNotFound {
 				// Redirect if necessary
 				newAlias := app.db.GetCollectionRedirect(cr.alias)
 				if newAlias != "" {
 					return impart.HTTPError{http.StatusFound, "/" + newAlias + "/" + slug}
 				}
 			}
 		}
 		return err
 	}
 	c.hostName = app.cfg.App.Host
 
 	// Check collection permissions
 	if c.IsPrivate() && (u == nil || u.ID != c.OwnerID) {
 		return ErrPostNotFound
 	}
 	if c.IsProtected() && ((u == nil || u.ID != c.OwnerID) && !isAuthorizedForCollection(app, c.Alias, r)) {
 		return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
 	}
 
 	cr.isCollOwner = u != nil && c.OwnerID == u.ID
 
 	if isRaw {
 		slug = strings.Split(slug, ".")[0]
 	}
 
 	// Fetch extra data about the Collection
 	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
 	coll := &CollectionObj{Collection: *c}
 	owner, err := app.db.GetUserByID(coll.OwnerID)
 	if err != nil {
 		// Log the error and just continue
 		log.Error("Error getting user for collection: %v", err)
 	} else {
 		coll.Owner = owner
 	}
 
 	postFound := true
 	p, err := app.db.GetPost(slug, coll.ID)
 	if err != nil {
 		if err == ErrCollectionPageNotFound {
 			postFound = false
 
 			if slug == "feed" {
 				// User tried to access blog feed without a trailing slash, and
 				// there's no post with a slug "feed"
 				return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/feed/"}
 			}
 
 			po := &Post{
 				Slug:     null.NewString(slug, true),
 				Font:     "norm",
 				Language: zero.NewString("en", true),
 				RTL:      zero.NewBool(false, true),
 				Content: `<p class="msg">This page is missing.</p>
 
 Are you sure it was ever here?`,
 			}
 			pp := po.processPost()
 			p = &pp
 		} else {
 			return err
 		}
 	}
 	p.IsOwner = owner != nil && p.OwnerID.Valid && owner.ID == p.OwnerID.Int64
 	p.Collection = coll
 	p.IsTopLevel = app.cfg.App.SingleUser
 
 	// Check if post has been unpublished
 	if p.Content == "" && p.Title.String == "" {
 		return impart.HTTPError{http.StatusGone, "Post was unpublished."}
 	}
 
 	// Serve collection post
 	if isRaw {
 		contentType := "text/plain"
 		if isJSON {
 			contentType = "application/json"
 		} else if isXML {
 			contentType = "application/xml"
 		} else if isMarkdown {
 			contentType = "text/markdown"
 		}
 		w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
 		if !postFound {
 			w.WriteHeader(http.StatusNotFound)
 			fmt.Fprintf(w, "Post not found.")
 			// TODO: return error instead, so status is correctly reflected in logs
 			return nil
 		}
 		if isMarkdown && p.Title.String != "" {
 			fmt.Fprintf(w, "# %s\n\n", p.Title.String)
 		}
 		fmt.Fprint(w, p.Content)
 	} else if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
 		if !postFound {
 			return ErrCollectionPageNotFound
 		}
 		p.extractData()
 		ap := p.ActivityObject(app.cfg)
 		ap.Context = []interface{}{activitystreams.Namespace}
 		return impart.RenderActivityJSON(w, ap, http.StatusOK)
 	} else {
 		p.extractData()
 		p.Content = strings.Replace(p.Content, "<!--more-->", "", 1)
 		// TODO: move this to function
 		p.formatContent(app.cfg, cr.isCollOwner)
 		tp := struct {
 			*PublicPost
 			page.StaticPage
 			IsOwner        bool
 			IsPinned       bool
 			IsCustomDomain bool
 			PinnedPosts    *[]PublicPost
 			IsFound        bool
 			IsAdmin        bool
 			CanInvite      bool
 		}{
 			PublicPost:     p,
 			StaticPage:     pageForReq(app, r),
 			IsOwner:        cr.isCollOwner,
 			IsCustomDomain: cr.isCustomDomain,
 			IsFound:        postFound,
 		}
 		tp.IsAdmin = u != nil && u.IsAdmin()
 		tp.CanInvite = canUserInvite(app.cfg, tp.IsAdmin)
 		tp.PinnedPosts, _ = app.db.GetPinnedPosts(coll, p.IsOwner)
 		tp.IsPinned = len(*tp.PinnedPosts) > 0 && PostsContains(tp.PinnedPosts, p)
 
 		if !postFound {
 			w.WriteHeader(http.StatusNotFound)
 		}
 		postTmpl := "collection-post"
 		if app.cfg.App.Chorus {
 			postTmpl = "chorus-collection-post"
 		}
 		if err := templates[postTmpl].ExecuteTemplate(w, "post", tp); err != nil {
 			log.Error("Error in collection-post template: %v", err)
 		}
 	}
 
 	go func() {
 		if p.OwnerID.Valid {
 			// Post is owned by someone. Don't update stats if owner is viewing the post.
 			if u != nil && p.OwnerID.Int64 == u.ID {
 				return
 			}
 		}
 		// Update stats for non-raw post views
 		if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
 			_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE slug = ? AND collection_id = ?", slug, coll.ID)
 			if err != nil {
 				log.Error("Unable to update posts count: %v", err)
 			}
 		}
 	}()
 
 	return nil
 }
 
 // TODO: move this to utils after making it more generic
 func PostsContains(sl *[]PublicPost, s *PublicPost) bool {
 	for _, e := range *sl {
 		if e.ID == s.ID {
 			return true
 		}
 	}
 	return false
 }
 
 func (p *Post) extractData() {
 	p.Tags = tags.Extract(p.Content)
 	p.extractImages()
 }
 
 func (rp *RawPost) UserFacingCreated() string {
 	return rp.Created.Format(postMetaDateFormat)
 }
 
 func (rp *RawPost) Created8601() string {
 	return rp.Created.Format("2006-01-02T15:04:05Z")
 }
 
 var imageURLRegex = regexp.MustCompile(`(?i)^https?:\/\/[^ ]*\.(gif|png|jpg|jpeg|image)$`)
 
 func (p *Post) extractImages() {
 	matches := extract.ExtractUrls(p.Content)
 	urls := map[string]bool{}
 	for i := range matches {
 		u := matches[i].Text
 		if !imageURLRegex.MatchString(u) {
 			continue
 		}
 		urls[u] = true
 	}
 
 	resURLs := make([]string, 0)
 	for k := range urls {
 		resURLs = append(resURLs, k)
 	}
 	p.Images = resURLs
 }
diff --git a/request.go b/request.go
index 4939f9c..2eb29f5 100644
--- a/request.go
+++ b/request.go
@@ -1,18 +1,22 @@
 /*
  * Copyright © 2018 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
-import "mime"
+import (
+	"mime"
+	"net/http"
+)
 
-func IsJSON(h string) bool {
-	ct, _, _ := mime.ParseMediaType(h)
-	return ct == "application/json"
+func IsJSON(r *http.Request) bool {
+	ct, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type"))
+	accept := r.Header.Get("Accept")
+	return ct == "application/json" || accept == "application/json"
 }
diff --git a/unregisteredusers.go b/unregisteredusers.go
index 550c83b..b6f6ce6 100644
--- a/unregisteredusers.go
+++ b/unregisteredusers.go
@@ -1,147 +1,148 @@
 /*
  * Copyright © 2018-2019 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
  * WriteFreely is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License, included
  * in the LICENSE file in this source code package.
  */
 
 package writefreely
 
 import (
 	"database/sql"
 	"encoding/json"
+	"net/http"
+
 	"github.com/writeas/impart"
 	"github.com/writeas/web-core/log"
-	"net/http"
 )
 
 func handleWebSignup(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 
 	// Get params
 	var ur userRegistration
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&ur)
 		if err != nil {
 			log.Error("Couldn't parse signup JSON request: %v\n", err)
 			return ErrBadJSON
 		}
 	} else {
 		err := r.ParseForm()
 		if err != nil {
 			log.Error("Couldn't parse signup form request: %v\n", err)
 			return ErrBadFormData
 		}
 
 		err = app.formDecoder.Decode(&ur, r.PostForm)
 		if err != nil {
 			log.Error("Couldn't decode signup form request: %v\n", err)
 			return ErrBadFormData
 		}
 	}
 	ur.Web = true
 	ur.Normalize = true
 
 	to := "/"
 	if app.cfg.App.SimpleNav {
 		to = "/new"
 	}
 	if ur.InviteCode != "" {
 		to = "/invite/" + ur.InviteCode
 	}
 	_, err := signupWithRegistration(app, ur, w, r)
 	if err != nil {
 		if err, ok := err.(impart.HTTPError); ok {
 			session, _ := app.sessionStore.Get(r, cookieName)
 			if session != nil {
 				session.AddFlash(err.Message)
 				session.Save(r, w)
 				return impart.HTTPError{http.StatusFound, to}
 			}
 		}
 		return err
 	}
 	return impart.HTTPError{http.StatusFound, to}
 }
 
 // { "username": "asdf" }
 // result: { code: 204 }
 func handleUsernameCheck(app *App, w http.ResponseWriter, r *http.Request) error {
-	reqJSON := IsJSON(r.Header.Get("Content-Type"))
+	reqJSON := IsJSON(r)
 
 	// Get params
 	var d struct {
 		Username string `json:"username"`
 	}
 	if reqJSON {
 		decoder := json.NewDecoder(r.Body)
 		err := decoder.Decode(&d)
 		if err != nil {
 			log.Error("Couldn't decode username check: %v\n", err)
 			return ErrBadFormData
 		}
 	} else {
 		return impart.HTTPError{http.StatusNotAcceptable, "Must be JSON request"}
 	}
 
 	// Check if username is okay
 	finalUsername := getSlug(d.Username, "")
 	if finalUsername == "" {
 		errMsg := "Invalid username"
 		if d.Username != "" {
 			// Username was provided, but didn't convert into valid latin characters
 			errMsg += " - must have at least 2 letters or numbers"
 		}
 		return impart.HTTPError{http.StatusBadRequest, errMsg + "."}
 	}
 	if app.db.PostIDExists(finalUsername) {
 		return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 	}
 	var un string
 	err := app.db.QueryRow("SELECT username FROM users WHERE username = ?", finalUsername).Scan(&un)
 	switch {
 	case err == sql.ErrNoRows:
 		return impart.WriteSuccess(w, finalUsername, http.StatusOK)
 	case err != nil:
 		log.Error("Couldn't SELECT username: %v", err)
 		return impart.HTTPError{http.StatusInternalServerError, "We messed up."}
 	}
 
 	// Username was found, so it's taken
 	return impart.HTTPError{http.StatusConflict, "Username is already taken."}
 }
 
 func getValidUsername(app *App, reqName, prevName string) (string, *impart.HTTPError) {
 	// Check if username is okay
 	finalUsername := getSlug(reqName, "")
 	if finalUsername == "" {
 		errMsg := "Invalid username"
 		if reqName != "" {
 			// Username was provided, but didn't convert into valid latin characters
 			errMsg += " - must have at least 2 letters or numbers"
 		}
 		return "", &impart.HTTPError{http.StatusBadRequest, errMsg + "."}
 	}
 	if finalUsername == prevName {
 		return "", &impart.HTTPError{http.StatusNotModified, "Username unchanged."}
 	}
 	if app.db.PostIDExists(finalUsername) {
 		return "", &impart.HTTPError{http.StatusConflict, "Username is already taken."}
 	}
 	var un string
 	err := app.db.QueryRow("SELECT username FROM users WHERE username = ?", finalUsername).Scan(&un)
 	switch {
 	case err == sql.ErrNoRows:
 		return finalUsername, nil
 	case err != nil:
 		log.Error("Couldn't SELECT username: %v", err)
 		return "", &impart.HTTPError{http.StatusInternalServerError, "We messed up."}
 	}
 
 	// Username was found, so it's taken
 	return "", &impart.HTTPError{http.StatusConflict, "Username is already taken."}
 }