prefs moved from cookies to localStorage; pin works