ugh (no CORS on the .xml endpoint, maybe I shouldn't use flask
add some ruby
working admin
add more data in the display
add caching; random pins if unspecified