comments
don't let people hijack values
use http codes and json messages
doc
crypto is dead