diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index 2c677436b..02a63bd98 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -61,7 +61,7 @@ server {
     # add_header X-Frame-Options "SAMEORIGIN";
 
     set $coop '';
-    if ($uri ~ ^\/sheet\/.*$) { set $coop 'same-origin'; }
+    if ($uri ~ ^\/(sheet|presentation|doc)\/.*$) { set $coop 'same-origin'; }
 
     # Enable SharedArrayBuffer in Firefox (for .xlsx export)
     add_header Cross-Origin-Resource-Policy cross-origin;
@@ -116,7 +116,7 @@ server {
     set $unsafe 0;
     # the following assets are loaded via the sandbox domain
     # they unfortunately still require exceptions to the sandboxing to work correctly.
-    if ($uri = "/sheet/inner.html") { set $unsafe 1; }
+    if ($uri ~ ^\/(sheet|doc|presentation)\/inner.html.*$) { set $unsafe 1; }
     if ($uri ~ ^\/common\/onlyoffice\/.*\/index\.html.*$) { set $unsafe 1; }
 
     # everything except the sandbox domain is a privileged scope, as they might be used to handle keys
@@ -159,7 +159,7 @@ server {
     # /api/config is loaded once per page load and is used to retrieve
     # the caching variable which is applied to every other resource
     # which is loaded during that session.
-    location = /api/config {
+    location ~ ^/api/(config|broadcast).*$ {
         proxy_pass http://localhost:3000;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header Host $host;
@@ -204,7 +204,7 @@ server {
     # The nodejs server has some built-in forwarding rules to prevent
     # URLs like /pad from resulting in a 404. This simply adds a trailing slash
     # to a variety of applications.
-    location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams)$ {
+    location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams|calendar|presentation|doc)$ {
         rewrite ^(.*)$ $1/ redirect;
     }
 
diff --git a/www/common/application_config_internal.js b/www/common/application_config_internal.js
index b6ee407c5..2496aa260 100644
--- a/www/common/application_config_internal.js
+++ b/www/common/application_config_internal.js
@@ -43,7 +43,6 @@ define(function() {
     /* You can display a link to your own privacy policy in the static pages footer.
      * To do so, set the following value to the absolute URL of your privacy policy.
      */
-    //config.privacy = '/privacy.html';
     // config.privacy = 'https://xwiki.com/en/company/PrivacyPolicy';
 
     /*  Cryptpad apps use a common API to display notifications to users
diff --git a/www/common/outer/calendar.js b/www/common/outer/calendar.js
index d1d7732b5..bedf74676 100644
--- a/www/common/outer/calendar.js
+++ b/www/common/outer/calendar.js
@@ -631,8 +631,8 @@ ctx.calendars[channel] = {
             data.startDay = startDate.getFullYear() + '-' + (startDate.getMonth()+1) + '-' + startDate.getDate();
             data.endDay = endDate.getFullYear() + '-' + (endDate.getMonth()+1) + '-' + endDate.getDate();
         } else {
-            delete ev.startDay;
-            delete ev.endDay;
+            delete data.startDay;
+            delete data.endDay;
         }
 
         c.proxy.content = c.proxy.content || {};
diff --git a/www/common/outer/userObject.js b/www/common/outer/userObject.js
index b1d92b54c..e7c55da67 100644
--- a/www/common/outer/userObject.js
+++ b/www/common/outer/userObject.js
@@ -830,7 +830,7 @@ define([
                         }
                     }
                     if (!Hash.isValidChannel(el.channel)) {
-                        // XXX delete channel?
+                        // XXX delete channel? replace with parsed.channel?
                         console.error('Remove invalid channel', el.channel, el);
                         // toClean.push(id);
                     }