less aggressive autosave
Makefile app/app.js now also listens for deps
unescaped urls, because it is now possible