add profiling
make test work, sort of
disallow slugs with spaces, and check POST for existing challenge