updated TODO list
properly handle the logging of HTTP body
qstr initialization dropped POST data, and AUTH will handler POST qstr alone