diff --git a/atproto-notifications/src/App.tsx b/atproto-notifications/src/App.tsx
index b1a67c8..a5e88f9 100644
--- a/atproto-notifications/src/App.tsx
+++ b/atproto-notifications/src/App.tsx
@@ -126,7 +126,7 @@ function App() {
   } else if (!hasPush) {
     content = <Problem>your browser does not support registering push notifications.</Problem>
   } else if (!whoamiHost) {
-    content = <GetJson endpoint='/hello' ok={info => <Blah info={info} />} />
+    content = <GetJson endpoint='/hello' ok={info => <Blah info={info} />} credentials />
   } else if (!user) {
     if (verif === 'verifying') content = <p><em>verifying&hellip;</em></p>;
     else {
diff --git a/atproto-notifications/src/components/Fetch.tsx b/atproto-notifications/src/components/Fetch.tsx
index e4599a5..f7269bf 100644
--- a/atproto-notifications/src/components/Fetch.tsx
+++ b/atproto-notifications/src/components/Fetch.tsx
@@ -41,8 +41,10 @@ export function Fetch({ using, args, ok, loading, error }) {
 
 /////
 
-async function getJson(url) {
-  const res = await fetch(url);
+async function getJson(url, credentials) {
+  const opts = {};
+  if (credentials) opts.credentials = 'include';
+  const res = await fetch(url, opts);
   if (!res.ok) {
     const m = await res.text();
     throw new Error(`Failed to fetch: ${m}`);
@@ -50,7 +52,7 @@ async function getJson(url) {
   return await res.json();
 }
 
-export function GetJson({ endpoint, params, ...forFetch }) {
+export function GetJson({ endpoint, params, credentials, ...forFetch }) {
   const host = import.meta.env.VITE_NOTIFICATIONS_HOST;
   const url = new URL(endpoint, host);
   for (let [key, val] of Object.entries(params ?? {})) {
@@ -59,7 +61,7 @@ export function GetJson({ endpoint, params, ...forFetch }) {
   return (
     <Fetch
       using={getJson}
-      args={[url.toString()]}
+      args={[url.toString(), credentials]}
       {...forFetch}
     />
   );
diff --git a/server/index.js b/server/index.js
index 2966be2..74745e8 100755
--- a/server/index.js
+++ b/server/index.js
@@ -188,6 +188,7 @@ const getAccountCookie = (req, res, appSecret, adminDid, noDidCheck = false) =>
 
   // not yet public!!
   if (!did || (did !== adminDid && !noDidCheck)) {
+    console.log('no, clearing you', did, did === adminDid, noDidCheck);
     clearAccountCookie(res)
       .setHeader('Content-Type', 'application/json')
       .writeHead(403)