diff --git a/app/app.go b/app/app.go
index a56db6b..84c600a 100644
--- a/app/app.go
+++ b/app/app.go
@@ -89,8 +89,8 @@ func New(db *db.DB) *App {
 
 	repoConfig := repo.PathPrefix("/config").Subrouter()
 
-	repoConfig.Handle("/", md.RequireAuth(a.DB)(http.HandlerFunc(a.RepoConfigHandler)))
-	repoConfig.Handle("/hackatime_project", md.RequireAuth(a.DB)(http.HandlerFunc(a.RepoConfigHackatimeProject)))
+	repoConfig.HandleFunc("/", a.RepoConfigHandler)
+	repoConfig.Handle("/hackatime_project", md.ValidateForm[repoUpdateHackatimeForm](http.HandlerFunc(a.RepoConfigHackatimeProject)))
 
 	repoConfig.Use(md.RequireAuth(a.DB))
 
diff --git a/app/repo-config.go b/app/repo-config.go
index 7101a57..143412b 100644
--- a/app/repo-config.go
+++ b/app/repo-config.go
@@ -3,7 +3,6 @@ package app
 import (
 	md "farga/app/middleware"
 	"farga/db/types"
-	"farga/lib"
 	"farga/lib/git"
 	hk "farga/lib/hackatime"
 	"net/http"
@@ -12,12 +11,6 @@ import (
 func (a *App) RepoConfigHandler(w http.ResponseWriter, r *http.Request) {
 	dbRepo := r.Context().Value(md.RepoKey).(types.Repo)
 
-	reqUser := r.Context().Value(lib.UserKey).(*types.User)
-	if reqUser.ID != *dbRepo.UserID {
-		http.Error(w, "Forbidden", http.StatusForbidden)
-		return
-	}
-
 	var err error
 	var projects []hk.Project
 	if dbRepo.User.HackatimeToken != "" && r.URL.Query().Get("err") != "WarnOffline" { // TODO: use a cookie instead.
@@ -42,10 +35,20 @@ func (a *App) RepoConfigHandler(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+type repoUpdateHackatimeForm struct {
+	ProjectName string `form:"name" validate:"required"`
+}
+
 func (a *App) RepoConfigHackatimeProject(w http.ResponseWriter, r *http.Request) {
+	dbRepo := r.Context().Value(md.RepoKey).(types.Repo)
 	switch r.Method {
 	case http.MethodPost:
-		a.DB.SetRepoHackatimeName(nil, "") // TODO
+		form, ok := md.GetForm[repoUpdateHackatimeForm](r)
+		if !ok {
+			http.Error(w, "Something went wrong on our end, and our middleware has failed. Please contact us.", http.StatusInternalServerError)
+			return
+		}
+		a.DB.SetRepoHackatimeName(&dbRepo.ID, form.ProjectName) // TODO
 	default:
 		http.NotFound(w, r)
 	}
diff --git a/views/repo/config.html b/views/repo/config.html
index 5a59fde..ff3d087 100644
--- a/views/repo/config.html
+++ b/views/repo/config.html
@@ -1,19 +1,23 @@
 {{define "content"}}
 <h2>Hackatime.</h2>
 {{if .user.HackatimeToken}}
-<form method="post" class="inline" action="hackatime_project">
-    <select name="project-name">
-    {{if .RepoHackatimeName}}
-        <option value="{{.Name}}">{{.RepoHackatimeName}}</option>
+    {{if .Projects}}
+    <form method="post" class="inline" action="hackatime_project">
+        <select name="project-name">
+        {{if .RepoHackatimeName}}
+            <option value="{{.Name}}">{{.RepoHackatimeName}}</option>
+        {{else}}
+            <option selected>-- Pick a project. --</option>
+        {{end}}
+        {{range .Projects}}
+            {{if ne . $.RepoHackatimeName}}<option value="{{.Name}}">{{.Name}}</option>{{end}}
+        {{end}}
+        </select>
+        <button type="input">Save</button>
+    </form>
     {{else}}
-        <option selected>-- Pick a project. --</option>
+    <p>Since we cannot reach the Hackatime API, we cannot allow you to configure your Hackatime project.</p>
     {{end}}
-    {{range .Projects}}
-        {{if ne . $.RepoHackatimeName}}<option value="{{.Name}}">{{.Name}}</option>{{end}}
-    {{end}}
-    </select>
-    <button type="input">Save</button>
-</form>
 {{else}}
 <p>You've got to <a href="/auth/hackatime">link your Hackatime</a> before you can link a repo to a project.</p>
 {{end}}