- wire up button with lock
- fix router URLs
- disable auth for next MPD session