moved approved passcodes to js variable, added document.URL to redirect