split error handlers and request handlers, bump requirements, support changeable passwords, removed hardcoded config options