diff --git a/main.go b/main.go
index 53370bb..1c1c706 100644
--- a/main.go
+++ b/main.go
@@ -91,8 +91,6 @@ func run(args []string) error {
 				},
 			},
 		},
-	}
-	app.Commands = []*cli.Command{
 		&cli.Command{
 			Name:   "dev",
 			Usage:  "run simplified dev/demo mode",
@@ -256,6 +254,7 @@ func runDev(ctx context.Context, cmd *cli.Command) error {
 	config := ServerConfig{
 		Directory:           dir,
 		CookieSessionSecret: []byte(cmd.String("session-secret")),
+		DevMode:             true,
 	}
 
 	srv, err := NewServer(db, config)
diff --git a/renderer.go b/renderer.go
index 11f627c..98581e9 100644
--- a/renderer.go
+++ b/renderer.go
@@ -26,6 +26,7 @@ func NewRendererLoader(prefix string, fs *embed.FS) pongo2.TemplateLoader {
 		fs:     fs,
 	}
 }
+
 func (l *RendererLoader) Abs(_, name string) string {
 	// TODO: remove this workaround
 	// Figure out why this method is being called
@@ -72,7 +73,7 @@ func (r Renderer) Render(w io.Writer, name string, data any, c echo.Context) err
 	var err error
 
 	if r.Debug {
-		t, err = pongo2.FromFile(name)
+		t, err = pongo2.FromFile("templates/" + name)
 	} else {
 		t, err = r.TemplateSet.FromFile(name)
 	}
diff --git a/server.go b/server.go
index 84ea680..088c282 100644
--- a/server.go
+++ b/server.go
@@ -43,7 +43,9 @@ var OAuthScopes = []string{
 type Server struct {
 	logger      *slog.Logger
 	dir         identity.Directory
+	config      ServerConfig
 	store       *store.Store
+	echo        *echo.Echo
 	indexer     *indexer.Indexer
 	oauth       *oauth.ClientApp
 	cookieStore *sessions.CookieStore
@@ -53,6 +55,7 @@ type ServerConfig struct {
 	Directory           identity.Directory
 	Hostname            string
 	CookieSessionSecret []byte
+	DevMode             bool
 }
 
 func NewServer(db *pgx.Conn, config ServerConfig) (*Server, error) {
@@ -83,16 +86,16 @@ func NewServer(db *pgx.Conn, config ServerConfig) (*Server, error) {
 		)
 	}
 	/* TODO: confidential client config
-	   if cmd.String("client-secret-key") != "" && hostname != "" {
-	       priv, err := atcrypto.ParsePrivateMultibase(cmd.String("client-secret-key"))
-	       if err != nil {
-	           return err
-	       }
-	       if err := config.SetClientSecret(priv, cmd.String("client-secret-key-id")); err != nil {
-	           return err
-	       }
-	       slog.Info("configuring confidential OAuth client")
-	   }
+	if cmd.String("client-secret-key") != "" && hostname != "" {
+	    priv, err := atcrypto.ParsePrivateMultibase(cmd.String("client-secret-key"))
+	    if err != nil {
+	        return err
+	    }
+	    if err := config.SetClientSecret(priv, cmd.String("client-secret-key-id")); err != nil {
+	        return err
+	    }
+	    slog.Info("configuring confidential OAuth client")
+	}
 	*/
 
 	oauthClient := oauth.NewClientApp(&oauthConfig, st)
@@ -100,6 +103,7 @@ func NewServer(db *pgx.Conn, config ServerConfig) (*Server, error) {
 	return &Server{
 		logger:      slog.Default(),
 		dir:         config.Directory,
+		config:      config,
 		store:       st,
 		indexer:     idx,
 		oauth:       oauthClient,
@@ -129,7 +133,6 @@ func (srv *Server) startWithListener(listen net.Listener) error {
 	e.HideBanner = true
 	e.HidePort = true
 
-	// TODO: e.Use(slogecho.New(logger))
 	e.Use(middleware.LoggerWithConfig(middleware.DefaultLoggerConfig))
 	e.Use(middleware.Recover())
 	e.Use(middleware.BodyLimit("64M"))
@@ -149,12 +152,11 @@ func (srv *Server) startWithListener(listen net.Listener) error {
 		RedirectCode: http.StatusFound,
 	}))
 
-	e.Renderer = NewRenderer("templates/", &TemplateFS, false) // TODO: dev mode
+	e.Renderer = NewRenderer("templates/", &TemplateFS, srv.config.DevMode)
 	e.HTTPErrorHandler = srv.errorHandler
 
 	staticHandler := http.FileServer(func() http.FileSystem {
-		if false {
-			// TODO: if local dev mode
+		if srv.config.DevMode {
 			return http.FS(os.DirFS("static"))
 		}
 		fsys, err := fs.Sub(StaticFS, "static")
@@ -194,8 +196,8 @@ func (srv *Server) startWithListener(listen net.Listener) error {
 	// the Echo instance it's already got a port, and then use its StartServer
 	// method to re-use that listener.
 	e.Listener = listen
+	srv.echo = e
 	httpServer := &http.Server{}
-	// TODO: attach echo to Server, for shutdown?
 	return e.StartServer(httpServer)
 }
 
@@ -210,6 +212,6 @@ func (srv *Server) Shutdown() []error {
 	if err := srv.indexer.Shutdown(); err != nil {
 		errs = append(errs, err)
 	}
-	// TODO: stop echo
+	// TODO: how to stop echo?
 	return errs
 }
diff --git a/web.go b/web.go
index 59b98ff..352963a 100644
--- a/web.go
+++ b/web.go
@@ -89,9 +89,10 @@ func (srv *Server) WebOAuthCallback(c echo.Context) error {
 	ctx := c.Request().Context()
 
 	params := c.Request().URL.Query()
-	srv.logger.Info("received callback", "params", params) // TODO: reduce to debug
+	// logging this has security concerns
+	//srv.logger.Debug("received callback", "params", params)
 
-	sessData, err := srv.oauth.ProcessCallback(ctx, c.Request().URL.Query())
+	sessData, err := srv.oauth.ProcessCallback(ctx, params)
 	if err != nil {
 		srv.logger.Warn("oauth callback error", "err", err)
 		return c.String(http.StatusUnauthorized, "Login Failed")
@@ -105,7 +106,7 @@ func (srv *Server) WebOAuthCallback(c echo.Context) error {
 	atc := oauthSess.APIClient()
 	var resp struct {
 		Handle string `json:"handle"`
-		// TODO: more fields?
+		// more fields?
 	}
 	if err := atc.Get(ctx, "com.atproto.server.getSession", nil, &resp); err != nil {
 		return err
@@ -144,6 +145,6 @@ func (srv *Server) WebLogout(c echo.Context) error {
 		return err
 	}
 
-	srv.logger.Info("account logged out", "did", sess.DID) // TODO: lower log level
+	srv.logger.Debug("account logged out", "did", sess.DID)
 	return c.Redirect(http.StatusFound, "/")
 }