show errors actually returned?
better auth checking
fix escape() bug with encodeURIComponent()
use tantek's shiny autolinking for the HTML