most UI is working now
beyond rails nasty security hole