diff --git a/www/auth/main.js b/www/auth/main.js
index 84a17d922..c155204ec 100644
--- a/www/auth/main.js
+++ b/www/auth/main.js
@@ -71,7 +71,7 @@ define([
             // Get contacts and extract their avatar channel and key
             var getData = function (obj, href) {
                 var parsed = Hash.parsePadUrl(href);
-                if (parsed.type !== "file") { return; }
+                if (!parsed || parsed.type !== "file") { return; } // XXX
                 var secret = Hash.getSecrets('file', parsed.hash);
                 if (!secret.keys || !secret.channel) { return; }
                 obj.avatarKey = Hash.encodeBase64(secret.keys && secret.keys.cryptKey);
@@ -81,6 +81,7 @@ define([
             contacts.friends = proxy.friends || {};
             Object.keys(contacts.friends).map(function (key) {
                 var friend = contacts.friends[key];
+                // if (!friend) { return; } // XXX how should this be handled?
                 var ret = {
                     edPublic: friend.edPublic,
                     name: friend.displayName,
@@ -90,6 +91,7 @@ define([
             });
             Object.keys(contacts.teams).map(function (key) {
                 var team = contacts.teams[key];
+                // if (!team) { return; } // XXX how should this be handled. Is this possible?
                 var avatar = team.metadata && team.metadata.avatar;
                 var ret = {
                     edPublic: team.keys && team.keys.drive && team.keys.drive.edPublic,
diff --git a/www/common/inner/common-mediatag.js b/www/common/inner/common-mediatag.js
index d86b481cd..f056904b5 100644
--- a/www/common/inner/common-mediatag.js
+++ b/www/common/inner/common-mediatag.js
@@ -7,6 +7,7 @@ define([
     '/common/media-tag.js',
     '/customize/messages.js',
 
+    '/bower_components/tweetnacl/nacl-fast.min.js',
     '/bower_components/croppie/croppie.min.js',
     '/bower_components/file-saver/FileSaver.min.js',
     'css!/bower_components/croppie/croppie.css',
@@ -28,7 +29,7 @@ define([
     MT.getCursorAvatar = function (cursor) {
         var html = '<span class="cp-cursor-avatar">';
         html += (cursor.avatar && avatars[cursor.avatar]) || '';
-        html += cursor.name + '</span>';
+        html += Util.fixHTML(cursor.name) + '</span>';
         return html;
     };
 
diff --git a/www/common/outer/roster.js b/www/common/outer/roster.js
index 162efb21c..d7976c8da 100644
--- a/www/common/outer/roster.js
+++ b/www/common/outer/roster.js
@@ -481,7 +481,9 @@ var factory = function (Util, Hash, CPNetflux, Sortify, nThen, Crypto) {
         if (!config.anon_rpc) { return void cb("EXPECTED_ANON_RPC"); }
 
 
-        var response = Util.response();
+        var response = Util.response(function (label, info) {
+            console.error('ROSTER_RESPONSE__' + label, info);
+        });
         var anon_rpc = config.anon_rpc;
         var keys = config.keys;
         var me = keys.myCurvePublic;
diff --git a/www/common/sframe-common-file.js b/www/common/sframe-common-file.js
index d2d086f47..90ca5e256 100644
--- a/www/common/sframe-common-file.js
+++ b/www/common/sframe-common-file.js
@@ -32,7 +32,9 @@ define([
     module.create = function (common, config) {
         var File = {};
         var origin = common.getMetadataMgr().getPrivateData().origin;
-        var response = Util.response();
+        var response = Util.response(function (label, info) {
+            console.error('COMMON_UPLOAD__' + label, info);
+        });
 
         var teamId = config.teamId;