diff --git a/shared/challenges_markdown/three/part_one.md b/shared/challenges_markdown/three/part_one.md
index b519b15..2d04735 100644
--- a/shared/challenges_markdown/three/part_one.md
+++ b/shared/challenges_markdown/three/part_one.md
@@ -2,15 +2,24 @@ This will be explaing the car format and will have a download link to a car file
 We can create a new web handler like. /day/3/{did} and it downloads the car file.
 Inside the car export is just one record with the verficiation code
 
-TODO: detect not-logged-in and if not, don't render this button:
-
-<a id="download-car" href="#" class="btn btn-primary">Download your CAR file</a>
+<a id="download-car" href="" class="btn btn-primary btn-disabled">Loading (JS required) &hellip;</a>
 
 <script>
+(function() {
+  const button = document.getElementById('download-car');
   const carData = atob("{{car_base64}}");
+
+  if (carData.length === 0) {
+    button.textContent = 'Log in to download';
+    return;
+  }
+
+  button.classList.remove('btn-disabled');
+  button.textContent = 'Download your CAR file';
+
   const bytes = new Uint8Array(carData.length);
   for (let i = 0; i < carData.length; i++) bytes[i] = carData.charCodeAt(i);
-  document.getElementById('download-car').addEventListener('click', (e) => {
+  button.addEventListener('click', (e) => {
       e.preventDefault();
       const blob = new Blob([bytes], {type: 'application/vnd.ipld.car'});
       const url = URL.createObjectURL(blob);
@@ -18,4 +27,5 @@ TODO: detect not-logged-in and if not, don't render this button:
       a.href = url; a.download = 'day3.car'; a.click();
       URL.revokeObjectURL(url);
   });
+})();
 </script>