diff --git a/www/common/common-hash.js b/www/common/common-hash.js
index 4f7290b81..c5133fae0 100644
--- a/www/common/common-hash.js
+++ b/www/common/common-hash.js
@@ -465,7 +465,7 @@ Version 4: Data URL when not a realtime link yet (new pad or "static" app)
 
         if (!/^https*:\/\//.test(href)) {
             // If it doesn't start with http(s), it should be a relative href
-            if (!/^\//.test(href)) { return ret; }
+            if (!/^\//.test(href)) { return ret; } // XXX this will allow protocol relative URLs
             idx = href.indexOf('/#');
             ret.type = href.slice(1, idx);
             if (idx === -1) { return ret; }
diff --git a/www/common/media-tag.js b/www/common/media-tag.js
index 6755df5a2..02b61cee8 100644
--- a/www/common/media-tag.js
+++ b/www/common/media-tag.js
@@ -408,7 +408,7 @@ var factory = function () {
             if (err || !u8) { return void fetch(); }
 
             var size = Decrypt.decodePrefix(u8.subarray(0,2));
-            console.error(size);
+            console.error(size); // XXX noise
 
             cb(null, u8.subarray(0, size+2));
         });
diff --git a/www/common/outer/local-store.js b/www/common/outer/local-store.js
index 645493de5..c6d937e94 100644
--- a/www/common/outer/local-store.js
+++ b/www/common/outer/local-store.js
@@ -123,7 +123,7 @@ define([
         cb = cb || function () {};
 
         try {
-            Cache.clear(cb);
+            Cache.clear(cb); // XXX might call back twice in extreme circumstances?
         } catch (e) {
             console.error(e);
             cb();