diff --git a/.golangci.yml b/.golangci.yml
index 5b6697f..116ab2d 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -7,8 +7,6 @@ linters:
     - depguard
     - err113
     - exhaustruct
-    - forbidigo
-    - forcetypeassert
     - gochecknoglobals
     - gochecknoinits
     - mnd
@@ -22,14 +20,17 @@ linters:
     - wsl
     - wsl_v5
   settings:
+    cyclop:
+      max-complexity: 11
     gosmopolitan:
       allow-time-local: true
     varnamelen:
       max-distance: 15
       ignore-decls:
-        - c *gin.Context
         - db *bbolt.DB
         - w *httptest.ResponseRecorder
+        - w http.ResponseWriter
+        - r *http.Request
   exclusions:
     generated: lax
     paths:
@@ -39,13 +40,14 @@ linters:
       - examples$
 formatters:
   enable:
-    - gci
-    - gofmt
     - gofumpt
-    - goimports
+    - golines
   exclusions:
     generated: lax
     paths:
       - third_party$
       - builtin$
       - examples$
+issues:
+  max-same-issues: 0
+  max-issues-per-linter: 0
diff --git a/config.go b/config.go
index f689fda..28212b8 100644
--- a/config.go
+++ b/config.go
@@ -1,28 +1,37 @@
 package main
 
 import (
-	"log"
 	"net/http"
+	"strconv"
 
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 )
 
-func config(c *gin.Context) {
+func configOld(w http.ResponseWriter, _ *http.Request) {
 	page := models.GetPage()
-	c.HTML(http.StatusOK, "config", page)
+	_ = templates.ExecuteTemplate(w, "config", page)
 }
 
-func setConfig(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user").(string)
-	config := models.Config{}
-	if err := c.Bind(&config); err != nil {
-		log.Println("failed to read config", err)
+func setConfig(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	user := session.User
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid data")
+		return
+	}
+	refresh, err := strconv.Atoi(r.FormValue("refresh"))
+	if err != nil {
+		refresh = 5
+	}
+	config := models.Config{
+		Theme:   r.FormValue("theme"),
+		Font:    r.FormValue("font"),
+		Refresh: refresh,
 	}
 	models.SetTheme(user, config.Theme)
 	models.SetFont(user, config.Font)
 	models.SetRefresh(user, config.Refresh)
-	displayMain(c)
+	page := models.GetUserPage(user)
+	w.Header().Set("Hx-Refresh", "true")
+	_ = templates.ExecuteTemplate(w, "layout", page)
 }
diff --git a/config_test.go b/config_test.go
new file mode 100644
index 0000000..e049962
--- /dev/null
+++ b/config_test.go
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+)
+
+func TestConfig(t *testing.T) {
+	createAdmin()
+	c := adminLogin()
+	if c == nil {
+		t.FailNow()
+	}
+	t.Run("get", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/config/", nil)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+	t.Run("update", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		body := bodyParams("theme", "red", "font", "tangerine", "refesh", "10")
+		r := httptest.NewRequest(http.MethodPost, "/config/", body)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+	t.Run("invalid refresh", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		body := bodyParams("theme", "red", "font", "tangerine", "refesh", "junk")
+		r := httptest.NewRequest(http.MethodPost, "/config/", body)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+}
diff --git a/database/project_test.go b/database/project_test.go
index 5cff0a5..81c2051 100644
--- a/database/project_test.go
+++ b/database/project_test.go
@@ -38,3 +38,42 @@ func TestGetProject(t *testing.T) {
 		should.BeEqual(t, project, models.Project{})
 	})
 }
+
+func TestGetAllProjects(t *testing.T) {
+	projects, err := GetAllProjects()
+	t.Log(projects, err)
+	should.BeNil(t, err)
+	should.NotBeEmpty(t, projects)
+}
+
+func TestDeleteProject(t *testing.T) {
+	err := SaveProject(&models.Project{
+		ID:      uuid.New(),
+		Name:    "toBeDeleted",
+		Active:  true,
+		Updated: time.Now(),
+	})
+	should.BeNil(t, err)
+	err = DeleteProject("tobeDeleted")
+	should.BeNil(t, err)
+}
+
+func TestGetActiveProject(t *testing.T) {
+	err := SaveProject(&models.Project{
+		ID:      uuid.New(),
+		Name:    "one",
+		Active:  true,
+		Updated: time.Now(),
+	})
+	should.BeNil(t, err)
+	should.BeNil(t, deleteAllRecords())
+	should.BeNil(t, createTestRecords())
+	t.Run("ok", func(t *testing.T) {
+		project := GetActiveProject("testUser")
+		should.BeEqual(t, project.Name, "one")
+	})
+	t.Run("none", func(t *testing.T) {
+		project := GetActiveProject("user1")
+		should.BeNil(t, project)
+	})
+}
diff --git a/database/records_test.go b/database/records_test.go
index 4eaaa92..766abbd 100644
--- a/database/records_test.go
+++ b/database/records_test.go
@@ -3,6 +3,10 @@ package database
 import (
 	"testing"
 	"time"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/timetraced/models"
+	"github.com/google/uuid"
 )
 
 func Test_truncateToStart(t *testing.T) {
@@ -56,3 +60,131 @@ func Test_truncateToEnd(t *testing.T) {
 		})
 	}
 }
+
+func TestSaveRecord(t *testing.T) {
+	should.BeNil(t, deleteAllRecords())
+	err := SaveRecord(&models.Record{
+		ID:      uuid.New(),
+		Project: "one",
+		User:    "testUser",
+		Start:   time.Now().Add(time.Hour * -1),
+		End:     time.Now(),
+	})
+	should.BeNil(t, err)
+}
+
+func TestGetRecord(t *testing.T) {
+	should.BeNil(t, deleteAllRecords())
+	should.BeNil(t, createTestRecords())
+	records, err := GetAllRecords()
+	should.BeNil(t, err)
+	should.BeEqual(t, len(records), 3)
+	record, err := GetRecord(records[0].ID)
+	should.BeNil(t, err)
+	should.BeEqual(t, record.User, records[0].User)
+}
+
+func TestGetTodaysRecords(t *testing.T) {
+	should.BeNil(t, deleteAllRecords())
+	should.BeNil(t, createTestRecords())
+	t.Run("all", func(t *testing.T) {
+		records, err := GetTodaysRecords()
+		should.BeNil(t, err)
+		should.BeEqual(t, len(records), 3)
+	})
+	t.Run("forUser", func(t *testing.T) {
+		records, err := GetTodaysRecordsForUser("testUser")
+		should.BeNil(t, err)
+		should.BeEqual(t, len(records), 2)
+	})
+}
+
+func TestGetReportRecords(t *testing.T) {
+	should.BeNil(t, deleteAllRecords())
+	should.BeNil(t, createTestRecords())
+	t.Run("today", func(t *testing.T) {
+		records, err := GetReportRecords(models.DatabaseReportRequest{
+			Start:   time.Now(),
+			End:     time.Now(),
+			Project: "one",
+			User:    "testUser",
+		})
+		should.BeNil(t, err)
+		should.BeEqual(t, len(records), 2)
+	})
+	t.Run("yesterday", func(t *testing.T) {
+		records, err := GetReportRecords(models.DatabaseReportRequest{
+			Start:   time.Now().Add(time.Hour * -24 * 7),
+			End:     time.Now().Add(time.Hour * -24),
+			Project: "one",
+			User:    "testUser",
+		})
+		should.BeNil(t, err)
+		should.BeEqual(t, len(records), 0)
+	})
+}
+
+func TestDeleteRecords(t *testing.T) {
+	should.BeNil(t, deleteAllRecords())
+	should.BeNil(t, createTestRecords())
+	records, err := GetAllRecords()
+	should.BeNil(t, err)
+	err = DeleteRecord(records[0].ID)
+	should.BeNil(t, err)
+	remainder, err := GetAllRecords()
+	should.BeNil(t, err)
+	should.BeLessThan(t, len(remainder), len(records))
+}
+
+func TestGetAllRecordsForUser(t *testing.T) {
+	should.BeNil(t, deleteAllRecords())
+	should.BeNil(t, createTestRecords())
+	records, err := GetAllRecordsForUser("testUser")
+	should.BeNil(t, err)
+	should.BeEqual(t, len(records), 2)
+}
+
+func createTestRecords() error {
+	records := []models.Record{
+		{
+			ID:      uuid.New(),
+			Project: "one",
+			User:    "testUser",
+			Start:   time.Now().Add(time.Hour * -1),
+			// End:     time.Now(),
+		},
+		{
+			ID:      uuid.New(),
+			Project: "one",
+			User:    "testUser",
+			Start:   time.Now().Add(time.Hour * -2),
+			End:     time.Now().Add(time.Hour * -1),
+		},
+		{
+			ID:      uuid.New(),
+			Project: "two",
+			User:    "user1",
+			Start:   time.Now().Add(time.Hour * -2),
+			End:     time.Now().Add(time.Hour * -1),
+		},
+	}
+	for _, record := range records {
+		if err := SaveRecord(&record); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func deleteAllRecords() error {
+	records, err := GetAllRecords()
+	if err != nil {
+		return err
+	}
+	for _, record := range records {
+		if err := DeleteRecord(record.ID); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/database/user_test.go b/database/user_test.go
new file mode 100644
index 0000000..bf81cca
--- /dev/null
+++ b/database/user_test.go
@@ -0,0 +1,106 @@
+package database
+
+import (
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/timetraced/models"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestSaveUser(t *testing.T) {
+	err := SaveUser(&models.User{
+		Username: "testUser",
+		Password: "don't care",
+	})
+	should.BeNil(t, err)
+	should.BeNil(t, deleteAllUsers())
+}
+
+func TestDeleteUser(t *testing.T) {
+	err := createTestUser(models.User{
+		Username: "testUser",
+		Password: "don't care",
+	})
+	should.BeNil(t, err)
+	err = DeleteUser("testUser")
+	should.BeNil(t, err)
+	err = DeleteUser("testUser") // deleting a non-exitent entry does not return error
+	should.BeNil(t, err)
+}
+
+func TestGetUsers(t *testing.T) {
+	should.BeNil(t, deleteAllUsers())
+	t.Run("no users", func(t *testing.T) {
+		user, err := GetUser("testUser")
+		should.NotBeNil(t, err)
+		should.BeEqual(t, user, models.User{})
+	})
+	t.Run("one user", func(t *testing.T) {
+		should.BeNil(t, createTestUser(models.User{
+			Username: "testUser",
+		}))
+		user, err := GetUser("testUser")
+		should.BeNil(t, err)
+		should.BeEqual(t, user.Username, "testUser")
+	})
+	t.Run("multiple users", func(t *testing.T) {
+		should.BeNil(t, createTestUser(models.User{
+			Username: "user2",
+		}))
+		user, err := GetUser("testUser")
+		should.BeNil(t, err)
+		should.BeEqual(t, user.Username, "testUser")
+	})
+}
+
+func TestGetAllUsers(t *testing.T) {
+	should.BeNil(t, deleteAllUsers())
+	t.Run("no users", func(t *testing.T) {
+		users, err := GetAllUsers()
+		should.BeNil(t, err)
+		should.BeEmpty(t, users)
+	})
+	t.Run("one user", func(t *testing.T) {
+		should.BeNil(t, createTestUser(models.User{
+			Username: "testUser",
+		}))
+		users, err := GetAllUsers()
+		should.BeNil(t, err)
+		should.BeEqual(t, len(users), 1)
+	})
+	t.Run("multiple users", func(t *testing.T) {
+		should.BeNil(t, createTestUser(models.User{
+			Username: "user2",
+		}))
+		users, err := GetAllUsers()
+		should.BeNil(t, err)
+		should.BeGreaterThan(t, len(users), 1)
+	})
+}
+
+func createTestUser(user models.User) error {
+	user.Password, _ = hashPassword(user.Password)
+	if err := SaveUser(&user); err != nil {
+		return err
+	}
+	return nil
+}
+
+func hashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), 4)
+	return string(bytes), err
+}
+
+func deleteAllUsers() error {
+	users, err := GetAllUsers()
+	if err != nil {
+		return nil
+	}
+	for _, user := range users {
+		if err := DeleteUser(user.Username); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/go.mod b/go.mod
index 4bca46d..dceec9a 100644
--- a/go.mod
+++ b/go.mod
@@ -3,47 +3,18 @@ module github.com/devilcove/timetraced
 go 1.24.0
 
 require (
-	github.com/Kairum-Labs/should v0.2.1
-	github.com/gin-contrib/sessions v1.0.4
-	github.com/gin-gonic/gin v1.11.0
+	github.com/Kairum-Labs/should v0.2.2
+	github.com/devilcove/mux v0.2.0
 	github.com/google/uuid v1.6.0
-	github.com/joho/godotenv v1.5.1
+	github.com/gorilla/sessions v1.4.0
+	github.com/mattkasun/tools v0.2.3
 	go.etcd.io/bbolt v1.4.3
-	golang.org/x/crypto v0.45.0
+	golang.org/x/crypto v0.42.0
 )
 
 require (
-	github.com/bytedance/sonic v1.14.0 // indirect
-	github.com/bytedance/sonic/loader v0.3.0 // indirect
-	github.com/cloudwego/base64x v0.1.6 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
-	github.com/gin-contrib/sse v1.1.0 // indirect
-	github.com/go-playground/locales v0.14.1 // indirect
-	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.27.0 // indirect
-	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/goccy/go-yaml v1.18.0 // indirect
-	github.com/gorilla/context v1.1.2 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/gorilla/sessions v1.4.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/quic-go/qpack v0.5.1 // indirect
-	github.com/quic-go/quic-go v0.54.1 // indirect
-	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.3.0 // indirect
-	go.uber.org/mock v0.5.0 // indirect
-	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/mod v0.29.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
-	google.golang.org/protobuf v1.36.9 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 62f7665..cee9b59 100644
--- a/go.sum
+++ b/go.sum
@@ -1,107 +1,30 @@
-github.com/Kairum-Labs/should v0.2.1 h1:20TZTcmvu9Mwskiqn1jmHo63343vejkhc7RGuDAwPs4=
-github.com/Kairum-Labs/should v0.2.1/go.mod h1:vP/ASEjUAKoWy/M7uIrAXq69p7/IUWOpEe5R+q/+K34=
-github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=
-github.com/bytedance/sonic v1.14.0/go.mod h1:WoEbx8WTcFJfzCe0hbmyTGrfjt8PzNEBdxlNUO24NhA=
-github.com/bytedance/sonic/loader v0.3.0 h1:dskwH8edlzNMctoruo8FPTJDF3vLtDT0sXZwvZJyqeA=
-github.com/bytedance/sonic/loader v0.3.0/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
-github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
-github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/Kairum-Labs/should v0.2.2 h1:bO1kaMGRYRSSpq8MHsmk2MqpA1taLPblPCZy9Jnpt+U=
+github.com/Kairum-Labs/should v0.2.2/go.mod h1:vP/ASEjUAKoWy/M7uIrAXq69p7/IUWOpEe5R+q/+K34=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
-github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
-github.com/gin-contrib/sessions v1.0.4 h1:ha6CNdpYiTOK/hTp05miJLbpTSNfOnFg5Jm2kbcqy8U=
-github.com/gin-contrib/sessions v1.0.4/go.mod h1:ccmkrb2z6iU2osiAHZG3x3J4suJK+OU27oqzlWOqQgs=
-github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
-github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
-github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
-github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
-github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
-github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
-github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
-github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
-github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/devilcove/mux v0.2.0 h1:U9bKQs0HhGJqIFUmH84nPt5pz67QJtmVtwT2f3RKgsk=
+github.com/devilcove/mux v0.2.0/go.mod h1:Q4ysJcjpLwW7rLNTOYSlYVst5OmwFh1uZxJSCPQ34U4=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
-github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
-github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
-github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
-github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/mattkasun/tools v0.2.3 h1:g3ciN2dtA+NpTGqJvcuMaHy4NRkPKWt8TY8ZnJw8kVc=
+github.com/mattkasun/tools v0.2.3/go.mod h1:WHhDjcX5n0ZAP0Z6XET1p2pCWqUgZDq8M5XEg+Pus9k=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
-github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.54.1 h1:4ZAWm0AhCb6+hE+l5Q1NAL0iRn/ZrMwqHRGQiFwj2eg=
-github.com/quic-go/quic-go v0.54.1/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
-github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA=
-github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
-golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
-golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
-golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
-golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
-google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
-google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/html/about.html b/html/about.html
index ace0dab..72a9eb5 100644
--- a/html/about.html
+++ b/html/about.html
@@ -6,8 +6,8 @@
             <h2>TimeTrace</h2>
             <small>Version {{ .Version }}</small>
             <h3>&copy; 2023-2024 Matthew R. Kasun</h3>
-            <small>built with <a href="https://github.com/gin-gonic/" target="_blank">gin</a> <a href="https://go.etcd.io/bbolt" target="_blank">bbolt</a>
-                 and <a href="https://htmx.org" target="_blank">htmx</a></small><br><br>
+            <small>built with <a href="https://go.etcd.io/bbolt" target="_blank">bbolt</a>
+                and <a href="https://htmx.org" target="_blank">htmx</a></small><br><br>
             <a href="mailto://mkasun@nusak.ca?subject=trimetraced" target="_blank">
                 <i class="fa fa-paper-plane w3-small"></i>
                 mkasun@nusak.ca</a><br>
@@ -15,7 +15,8 @@ <h3>&copy; 2023-2024 Matthew R. Kasun</h3>
                 <i class="fab fa-github"></i>
                 repo</a>
             <br><br>
-            <button type="submit" class="w3-button w3-block w3-padding" onclick="document.getElementById('About').style.display='none'">Close</button>
+            <button type="submit" class="w3-button w3-block w3-padding"
+                onclick="document.getElementById('About').style.display='none'">Close</button>
         </div>
     </div>
 </div>
diff --git a/html/configuration.html b/html/configuration.html
index 3e52c81..6128c1c 100644
--- a/html/configuration.html
+++ b/html/configuration.html
@@ -3,7 +3,7 @@
     <div class="w3-third"><br></div>
     <div class="w3-third">
         <h1>Configuration</h1>
-        <form hx-post="/config" hx-target="#main">
+        <form hx-post="/config/" hx-target="#main">
             <p><label>Theme</label>
                 <select name="theme">
                     <option>indigo</option>
diff --git a/html/content.html b/html/content.html
index 6846218..a897a6c 100644
--- a/html/content.html
+++ b/html/content.html
@@ -3,7 +3,8 @@
 {{if (eq .NeedsLogin true)}}
 {{template "login" .}}
 {{ else }}
-<div class="w3-container w3-center w3-padding-64" id="content" hx-get="/projects/status" hx-trigger="every {{.Refresh}}m">
+<div class="w3-container w3-center w3-padding-64" id="content" hx-get="/projects/status"
+    hx-trigger="every {{.Refresh}}m">
     <div class="w3-row">
         <div class="w3-third"><br></div>
         <div class="w3-third">
@@ -22,7 +23,7 @@
                 </tr>
             </table>
             {{ if .Tracking }}
-            <form hx-post="projects/stop" hx-target="#main">
+            <form hx-post="projects/stop/" hx-target="#main">
                 <button class="w3-button" type="submit"><i class="fa fa-stopwatch"></i> Stop</button>
             </form>
             {{end}}
diff --git a/html/footer.html b/html/footer.html
index 26fe092..0362327 100644
--- a/html/footer.html
+++ b/html/footer.html
@@ -1,6 +1,6 @@
 {{define "footer"}}
 <footer class="w3-center">
     &copy; 2023 Matthew R Kasun
-    <a hx-get="/logout" hx-target="#content" class="w3-circle w3-small w3-theme-d1">Logout</a>
+    <a href="/logout/" class="w3-circle w3-small w3-theme-d1">Logout</a>
 </footer>
 {{end}}
\ No newline at end of file
diff --git a/html/login.html b/html/login.html
index c36512c..0b9f8d2 100644
--- a/html/login.html
+++ b/html/login.html
@@ -1,18 +1,17 @@
 {{define "login"}}
 <div id="content">
-        <div class="w3-container w3-center w3-theme-dark">
-            <h1>Timetrace Login</h1>
-            <!-- <form action="/login" method="post"> -->
-            <form hx-post="/login" hx-target="#content" hx-target-error="#error">
-                <label for="username">Username</label><br>
-                <input type="text" placeholder="enter username" name="username" required><br>
-                <label for="pass">Password</label><br>
-                <input type="password" placeholder="enter password" name="password" required><br>
-                <button type="submit">Login</button>
-            </form>
-            <div class="w3-container w3-padding-32">
-                <a hx-get="/register" hx-target="#content">Don't have an Account? Register</a>
-            </div>
-        </div>
+    <div class="w3-container w3-center w3-theme-dark">
+        <h1>Timetrace Login</h1>
+        <!-- <form action="/login" method="post"> -->
+        <form hx-post="/login" hx-target="#content" hx-target-error="#error">
+            <label for="username">Username</label><br>
+            <input type="text" placeholder="enter username" name="username" required><br>
+            <label for="pass">Password</label><br>
+            <input type="password" placeholder="enter password" name="password" required><br>
+            <p></p>
+            <button type="submit">Login</button>
+        </form>
+    </div>
+</div>
 </div>
 {{end}}
\ No newline at end of file
diff --git a/html/navbar.html b/html/navbar.html
index ca72e7e..95ff251 100644
--- a/html/navbar.html
+++ b/html/navbar.html
@@ -11,26 +11,23 @@
                 <summary><i class="fa fa-home w3-xxxlarge"></i>Projects</summary>
                 <hr>
                 {{range .Projects }}
-                <button type="button" class="w3-button" 
-                    hx-post="/projects/{{.}}/start"
-                    hx-target="#main">{{.}}
+                <button type="button" class="w3-button" hx-post="/projects/start/{{.}}" hx-target="#main">{{.}}
                 </button><br>
                 {{end}}
                 <hr>
-                <form hx-get="/projects/add" hx-target="#content">
-                <button type="submit" class="w3-button"
-                    >New Project</button><br>
+                <form hx-get="/projects/add/" hx-target="#content">
+                    <button type="submit" class="w3-button">New Project</button><br>
                 </form>
-                <a href="/logout" class="w3-bar-item w3-button">Logout</a>
+                <a href="/logout/" class="w3-bar-item w3-button">Logout</a>
             </details>
         </div>
-        <button type="button" class="w3-bar-item w3-button" hx-get="/reports" hx-target="#content">
+        <button type="button" class="w3-bar-item w3-button" hx-get="/reports/" hx-target="#content">
             <i class="fa fa-file-alt w3-xxxlarge"></i>
             REPORTS</button>
-        <button type="button" class="w3-bar-item w3-button" hx-get="/users" hx-target="#content">
+        <button type="button" class="w3-bar-item w3-button" hx-get="/users/" hx-target="#content">
             <i class="fa fa-user w3-xxxlarge"></i>
             USERS</button>
-        <button type="button" class="w3-bar-item w3-button" hx-get="/config" hx-target="#content">
+        <button type="button" class="w3-bar-item w3-button" hx-get="/config/" hx-target="#content">
             <i class="fa fa-cog w3-xxxlarge"></i>
             SETTINGS</button>
         <button type="button" class="w3-bar-item w3-button"
@@ -49,11 +46,11 @@
                 <a href="/logout" class="w3-bar-item w3-button">Logout</a>
             </div>
         </div>
-        <button type="button" class="w3-bar-item w3-button" hx-get="/reports" hx-target="#content">
+        <button type="button" class="w3-bar-item w3-button" hx-get="/reports/" hx-target="#content">
             REPORTS</button>
-        <button type="button" class="w3-bar-item w3-button" hx-get="/configuration" hx-target="#content">
+        <button type="button" class="w3-bar-item w3-button" hx-get="/configuration/" hx-target="#content">
             CONFIGURATION</button>
-        <button type="button" class="w3-bar-item w3-button" hx-get="/users" hx-target="#content">
+        <button type="button" class="w3-bar-item w3-button" hx-get="/users/" hx-target="#content">
             USERS</button>
         <button type="button" class="w3-bar-item w3-button"
             onclick="document.getElementById('About').style.display='block'">
@@ -67,11 +64,13 @@
 <div id="addProject">
     <div class="w3-container w3-center w3-theme">
         <h1>Add New Project</h1>
-        <form hx-post="/projects" hx-target="#content" hx-target-error="#error">
+        <form hx-post="/projects/" hx-target="#main" hx-target-error="#error">
             <label for="Name">New Project</label><br>
-            <input type="text" placeholder="new project name" name="Name" required><br>
-            <p><button class="w3-button w3-theme-dark w3-padding large" type="button" hx-get="/" hx-target="#content">Cancel</button>
-            <button class="w3-button w3-theme-dark w3-padding large" type="submit">Submit</button></p>
+            <input type="text" placeholder="new project name" name="name" required><br>
+            <p><button class="w3-button w3-theme-dark w3-padding large" type="button" hx-get="/"
+                    hx-target="#main">Cancel</button>
+                <button class="w3-button w3-theme-dark w3-padding large" type="submit">Submit</button>
+            </p>
         </form>
     </div>
 </div>
diff --git a/html/register.html b/html/register.html
index 1541e7a..5a39843 100644
--- a/html/register.html
+++ b/html/register.html
@@ -1,17 +1,20 @@
 {{define "register"}}
-<div id="register" >
-        <div class="w3-container w3-center w3-theme-dark">
-            <h1>Timetrace Registration</h1>
-            <form hx-post="/register" hx-target="#content" hx-target-error="#error">
-                <label for="username">Username</label><br>
-                <input type="text" placeholder="enter username" name="username" required><br>
-                <label for="pass">Password</label><br>
-                <input type="password" placeholder="enter password" name="password" required><br>
-                <button type="submit">Register</button>
-            </form>
-            <div class="w3-container w3-padding-32">
-                <a hx-get="/login" hx-target="#content">Already have an Account? Login</a>
-            </div>
+<div id="register">
+    <div class="w3-container w3-center w3-theme-dark">
+        <h1>Timetrace Add User</h1>
+        <form hx-post="/users/register/" hx-target="#content" hx-target-error="#error">
+            <label for="username">Username</label><br>
+            <input type="text" placeholder="enter username" name="username" required><br>
+            <label for="pass">Password</label><br>
+            <input type="password" placeholder="enter password" name="password" required><br>
+            <label for="admin">IsAdmin</label><br>
+            <input type="checkbox" name="admin"><br>
+            <p></p>
+            <button type="submit">Add</button>
+        </form>
+        <div class="w3-container w3-padding-32">
+            <a hx-get="/" hx-target="#content">Cancel</a>
         </div>
+    </div>
 </div>
 {{end}}
\ No newline at end of file
diff --git a/html/report.html b/html/report.html
index 6cb484d..d65cbcd 100644
--- a/html/report.html
+++ b/html/report.html
@@ -3,7 +3,7 @@
     <div class="w3-third"><br></div>
     <div class="w3-third">
         <h1>Reports</h1>
-        <form class="w3-container" hx-post="/reports" hx-target="#content">
+        <form class="w3-container" hx-post="/reports/" hx-target="#content">
             <p><label>Start Date</label></p>
             <p><input type="date" name="start" value="{{.DefaultDate}}" required></p>
             <p><label>End Date</label></p>
@@ -38,7 +38,8 @@ <h2>Project {{.Project}}</h2>
         {{end}}
         <h2>{{.Total}}</h2>
         {{end}}
-        <button class="w3-button w3-theme-dark w3-padding large" hx-get="/" hx-target="#main" type="button">Close</button>
+        <button class="w3-button w3-theme-dark w3-padding large" hx-get="/" hx-target="#main"
+            type="button">Close</button>
     </div>
 </div>
 {{end}}
diff --git a/html/user.html b/html/user.html
index f9756da..c3a77e8 100644
--- a/html/user.html
+++ b/html/user.html
@@ -16,10 +16,14 @@ <h1>Users</h1>
                 <td>{{.Username}}</td>
                 <td>{{.IsAdmin}}</td>
                 <td><i class="fa fa-edit" hx-get="/users/{{.Username}}" hx-target="#content"></i></td>
-                <td><i class="fa fa-user-slash"></i></td>
+                <td><i class="fa fa-user-slash" hx-delete="/users/{{.Username}}" hx-target="#content"
+                        onsubmit="return confirm('delete user')"></i></td>
             </tr>
             {{end}}
         </table>
+        <div class="w3-center">
+            <p></p>New User &nbsp; <i class="fa fa-user" hx-get="/users/register/" hx-target="#content"></i></p>
+        </div>
     </div>
 </div>
 {{end}}
@@ -29,18 +33,24 @@ <h1>Users</h1>
     <div class="w3-third"><br></div>
     <div class="w3-third">
         <h1>Edit User</h1>
-        <h2>{{.Username}}</h2>
+        <h2>{{.Username}} {{.IsAdmin}}</h2>
         <form name="editUser" hx-post="/users/{{.Username}}" hx-target="#content" onsubmit="return valPass()">
             <label for="password">New Password: </label>
-            <input type="password" placeholder="new password" name="Password" required><br>
+            <input type="password" placeholder="new password" name="password" required><br>
             <label for="verify">Verify Password: </label>
             <input type="password" placeholder="new password" name="verify" required><br><br>
+            {{ if .AsAdmin }}
+            <label for="admin">Admin</label>
+            <input type="checkbox" name="admin" {{ if .IsAdmin}} checked {{end}}><br><br>
+            <button type="button" hx-get="/users/" hx-target="#content">Cancel</button>
+            {{else}}
             <button type="button" hx-get="/" hx-target="#main">Cancel</button>
+            {{end }}
             <button type="submit">Submit</button>
         </form>
         <script>
             function valPass() {
-                var x = document.forms["editUser"]["Password"].value;
+                var x = document.forms["editUser"]["password"].value;
                 var y = document.forms["editUser"]["verify"].value;
                 console.log(x, y)
                 if (x != y) {
diff --git a/main.go b/main.go
index 90e2ca0..eac3420 100644
--- a/main.go
+++ b/main.go
@@ -22,33 +22,31 @@ limitations under the License.
 package main
 
 import (
-	"log"
-	"log/slog"
 	"os"
-	"path/filepath"
+	"time"
 
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/joho/godotenv"
+	"github.com/mattkasun/tools/logging"
 )
 
 func main() {
-	setLogging()
-	if err := godotenv.Load(); err != nil {
-		slog.Error("read environment", "error", err)
-	}
+	logger := logging.TextLogger(logging.TruncateSource(), logging.TimeFormat(time.DateTime))
 	port, ok := os.LookupEnv("PORT")
 	if !ok {
 		port = "8080"
 	}
+
 	if err := database.InitializeDatabase(); err != nil {
-		log.Fatal(err)
+		logger.Error("database init", "err", err)
+		os.Exit(1)
 	}
 	defer database.Close()
 	checkDefaultUser()
 	users, err := database.GetAllUsers()
 	if err != nil {
-		log.Fatal("get users", err) //nolint:gocritic
+		logger.Error("get users", "err", err)
+		os.Exit(1) //nolint:gocritic
 	}
 	for _, user := range users {
 		project := database.GetActiveProject(user.Username)
@@ -58,33 +56,6 @@ func main() {
 			models.TrackingInactive(user.Username)
 		}
 	}
-	router := setupRouter()
-	// router.Use(sloggin.New(logger))
-	if err := router.Run(":" + port); err != nil {
-		log.Fatal(err)
-	}
-}
-
-func setLogging() {
-	logLevel := &slog.LevelVar{}
-	replace := func(_ []string, a slog.Attr) slog.Attr {
-		if a.Key == slog.SourceKey {
-			source, ok := a.Value.Any().(*slog.Source)
-			if ok {
-				source.File = filepath.Base(source.File)
-				source.Function = filepath.Base(source.Function)
-			}
-		}
-		return a
-	}
-	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{
-		AddSource:   true,
-		ReplaceAttr: replace,
-		Level:       logLevel,
-	}))
-	// logger := slog.New(slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{AddSource: true, Level: logLevel}))
-	slog.SetDefault(logger)
-	if os.Getenv("DEBUG") == "true" {
-		logLevel.Set(slog.LevelDebug)
-	}
+	router := setupRouter(logger.Logger)
+	router.Run(":" + port)
 }
diff --git a/middleware.go b/middleware.go
new file mode 100644
index 0000000..28c5ca0
--- /dev/null
+++ b/middleware.go
@@ -0,0 +1,59 @@
+package main
+
+import (
+	"net/http"
+
+	"github.com/gorilla/sessions"
+)
+
+// Session represents a user session.
+type Session struct {
+	User     string
+	LoggedIn bool
+	Admin    bool
+	Session  *sessions.Session
+}
+
+func auth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		session := sessionData(r)
+		if session == nil {
+			logger.Error("nil session data")
+			http.Redirect(w, r, "/login/", http.StatusSeeOther)
+			return
+		}
+		logger.Debug("auth", "session", session)
+		if !session.LoggedIn {
+			logger.Error("not logged in")
+			http.Redirect(w, r, "/login/", http.StatusSeeOther)
+			return
+		}
+		if err := session.Session.Save(r, w); err != nil {
+			logger.Error("save session", "error", err)
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func sessionData(r *http.Request) *Session {
+	sess := &Session{}
+	session, err := store.Get(r, "devilcove-time")
+	if err != nil {
+		logger.Error("session err", "error", err)
+		return nil
+	}
+	user := session.Values["user"]
+	loggedIn := session.Values["loggedIn"]
+	admin := session.Values["admin"]
+	if x, ok := loggedIn.(bool); ok {
+		sess.LoggedIn = x
+	}
+	if u, ok := user.(string); ok {
+		sess.User = u
+	}
+	if a, ok := admin.(bool); ok {
+		sess.Admin = a
+	}
+	sess.Session = session
+	return sess
+}
diff --git a/middleware_test.go b/middleware_test.go
new file mode 100644
index 0000000..17acb6e
--- /dev/null
+++ b/middleware_test.go
@@ -0,0 +1,27 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+)
+
+func TestAuth(t *testing.T) {
+	t.Run("unauthorized", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/users/", nil)
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusSeeOther)
+		should.BeEqual(t, w.Result().Header.Get("Location"), "/login/")
+	})
+	t.Run("authorized", func(t *testing.T) {
+		createAdmin()
+		r := httptest.NewRequest(http.MethodGet, "/users/", nil)
+		r.AddCookie(adminLogin())
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+}
diff --git a/models/errors.go b/models/errors.go
deleted file mode 100644
index 7ca4ac3..0000000
--- a/models/errors.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package models
-
-import (
-	"log/slog"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-)
-
-// ErrorMessage represents an error message to be return to UI.
-type ErrorMessage struct {
-	Status  string
-	Message string
-}
-
-// Process returns an error message to UI.
-func (e *ErrorMessage) Process(c *gin.Context) {
-	slog.Error(e.Message, "status", e.Status)
-	c.HTML(http.StatusOK, "error", e)
-	c.Abort()
-}
diff --git a/models/page.go b/models/page.go
index 42578d2..0a462ba 100644
--- a/models/page.go
+++ b/models/page.go
@@ -1,7 +1,7 @@
 package models
 
 import (
-	"log"
+	"log/slog"
 	"runtime/debug"
 	"time"
 )
@@ -60,7 +60,7 @@ func GetUserPage(u string) Page {
 	if page, ok := pages[u]; ok {
 		return page
 	}
-	log.Println("user page not set, using default")
+	slog.Info("user page not set, using default")
 	pages[u] = initialize()
 	return pages[u]
 }
@@ -75,7 +75,7 @@ func SetTheme(user, theme string) {
 	pages[user] = page
 }
 
-// SetFont sets the page font for a user.
+// SetFont sets the page font for a useruser page.
 func SetFont(user, font string) {
 	page, ok := pages[user]
 	if !ok {
diff --git a/models/page_test.go b/models/page_test.go
new file mode 100644
index 0000000..742a431
--- /dev/null
+++ b/models/page_test.go
@@ -0,0 +1,99 @@
+package models
+
+import (
+	"testing"
+	"time"
+
+	"github.com/Kairum-Labs/should"
+)
+
+func TestGetPage(t *testing.T) {
+	page := GetPage()
+	should.BeEqual(t, page.Theme, "indigo")
+	should.BeEqual(t, page.Font, "Roboto")
+	should.BeEqual(t, page.Refresh, 5)
+}
+
+func TestGetUserPage(t *testing.T) {
+	t.Run("existing", func(t *testing.T) {
+		page := GetUserPage("tester")
+		page2 := GetUserPage("tester")
+		should.BeEqual(t, page, page2)
+	})
+	t.Run("empty", func(t *testing.T) {
+		page := GetUserPage("")
+		should.BeEqual(t, page.Theme, "indigo")
+	})
+}
+
+func TestSetTheme(t *testing.T) {
+	t.Run("existing", func(t *testing.T) {
+		page := GetUserPage("tester")
+		SetTheme("tester", "red")
+		page2 := GetUserPage("tester")
+		should.NotBeEqual(t, page, page2)
+		should.BeEqual(t, page2.Theme, "red")
+	})
+	t.Run("new", func(t *testing.T) {
+		SetTheme("tester2", "pink")
+		page := GetUserPage("tester2")
+		should.BeEqual(t, page.Theme, "pink")
+	})
+}
+
+func TestSetFont(t *testing.T) {
+	t.Run("existing", func(t *testing.T) {
+		page := GetUserPage("tester")
+		SetFont("tester", "tangerine")
+		page2 := GetUserPage("tester")
+		should.NotBeEqual(t, page, page2)
+		should.BeEqual(t, page2.Font, "tangerine")
+	})
+	t.Run("new", func(t *testing.T) {
+		SetFont("tester3", "tangerine")
+		page := GetUserPage("tester3")
+		should.BeEqual(t, page.Font, "tangerine")
+	})
+}
+
+func TestSetRefresh(t *testing.T) {
+	t.Run("existing", func(t *testing.T) {
+		page := GetUserPage("tester")
+		SetRefresh("tester", 10)
+		page2 := GetUserPage("tester")
+		should.NotBeEqual(t, page, page2)
+		should.BeEqual(t, page2.Refresh, 10)
+	})
+	t.Run("new", func(t *testing.T) {
+		SetRefresh("tester4", 12)
+		page := GetUserPage("tester4")
+		should.BeEqual(t, page.Refresh, 12)
+	})
+}
+
+func TestTracking(t *testing.T) {
+	tracking := IsTrackingActive("tester")
+	should.BeFalse(t, tracking)
+	project := Tracked("tester")
+	should.BeEqual(t, project, "")
+	TrackingActive("tester", Project{Name: "project"})
+	tracking = IsTrackingActive("tester")
+	should.BeTrue(t, tracking)
+	project = Tracked("tester")
+	should.BeEqual(t, project, "project")
+	TrackingInactive("tester")
+	tracking = IsTrackingActive("tester")
+	should.BeFalse(t, tracking)
+}
+
+func TestRecords(t *testing.T) {
+	s := FmtDuration(time.Minute * 57)
+	should.BeEqual(t, s, "00:57 ( 1.0 Hours)")
+	record := Record{
+		End:   time.Now(),
+		Start: time.Now().Add(time.Hour * -1),
+	}
+	expected := record.End.Sub(record.Start)
+	dur := record.Duration()
+	should.BeEqual(t, dur, expected)
+}
diff --git a/models/user.go b/models/user.go
index 0ada887..3503359 100644
--- a/models/user.go
+++ b/models/user.go
@@ -11,3 +11,10 @@ type User struct {
 	IsAdmin  bool
 	Updated  time.Time
 }
+
+// Editor represents the an editor of a user.
+type Editor struct {
+	User
+
+	AsAdmin bool
+}
diff --git a/page.go b/page.go
index 87d01cc..a597a2a 100644
--- a/page.go
+++ b/page.go
@@ -8,38 +8,41 @@ import (
 
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 )
 
-func displayMain(c *gin.Context) {
-	var page models.Page
-	session := sessions.Default(c)
-	user := session.Get("user")
-	loggedIn := session.Get("loggedin")
-	slog.Debug("displaying status for", "user", user, "loggedIn", loggedIn)
-	if user == nil {
-		page = populatePage("")
-	} else {
-		page = populatePage(user.(string))
-	}
-	if loggedIn == nil {
-		page.NeedsLogin = true
+func displayMain(w http.ResponseWriter, r *http.Request) {
+	page := models.GetPage()
+	session := sessionData(r)
+	page.NeedsLogin = true
+	if session != nil {
+		logger.Debug("displaying status for", "user", session.User, "loggedIn", session.LoggedIn)
+		page = populatePage(session.User)
+		if !session.LoggedIn {
+			page.NeedsLogin = true
+		}
 	}
-	slog.Debug("displaystatus", "page", page.NeedsLogin, "refresh", page.Refresh)
-	c.HTML(http.StatusOK, "layout", page)
+	logger.Debug(
+		"displaystatus",
+		"page",
+		page.NeedsLogin,
+		"refresh",
+		page.Refresh,
+		"theme",
+		page.Theme,
+	)
+	_ = templates.ExecuteTemplate(w, "layout", page)
 }
 
-func displayStatus(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user")
-	loggedIn := session.Get("loggedin")
-	if user == nil || loggedIn == nil {
-		displayMain(c)
+func displayStatus(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	user := session.User
+	loggedIn := session.LoggedIn
+	if user == "" || !loggedIn {
+		displayMain(w, r)
 		return
 	}
-	page := populatePage(user.(string))
-	c.HTML(http.StatusOK, "content", page)
+	page := populatePage(user)
+	_ = templates.ExecuteTemplate(w, "content", page)
 }
 
 func populatePage(user string) models.Page {
diff --git a/projects.go b/projects.go
index 7e34aec..f7a3a57 100644
--- a/projects.go
+++ b/projects.go
@@ -9,80 +9,63 @@ import (
 
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
-func getProjects(c *gin.Context) {
-	projects, err := database.GetAllProjects()
-	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
-		return
-	}
-	c.JSON(http.StatusOK, projects)
-}
-
-func displayProjectForm(c *gin.Context) {
-	c.HTML(http.StatusOK, "addProject", "")
+func displayProjectForm(w http.ResponseWriter, _ *http.Request) {
+	_ = templates.ExecuteTemplate(w, "addProject", nil)
 }
 
-func addProject(c *gin.Context) {
-	var project models.Project
-	if err := c.Bind(&project); err != nil {
-		processError(c, http.StatusBadRequest, "could not decode request into json "+err.Error())
-		return
+func addProject(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid data sent")
+	}
+	project := models.Project{
+		Name: r.FormValue("name"),
 	}
 	if regexp.MustCompile(`\s+`).MatchString(project.Name) || project.Name == "" {
-		processError(c, http.StatusBadRequest, "invalid project name")
+		processError(w, http.StatusBadRequest, "invalid project name")
 		return
 	}
 	existing, err := database.GetProject(project.Name)
 	if err != nil && err.Error() != "no such project" {
-		slog.Error("add project", "error", err)
-		processError(c, http.StatusInternalServerError, "database error")
+		processError(w, http.StatusInternalServerError, "database error")
 		return
 	}
 	if existing.Name == project.Name {
-		processError(c, http.StatusBadRequest, "project exists")
+		processError(w, http.StatusBadRequest, "project exists")
 		return
 	}
 	project.ID = uuid.New()
 	project.Active = true
 	project.Updated = time.Now()
 	if err := database.SaveProject(&project); err != nil {
-		processError(c, http.StatusInternalServerError, "error saving project "+err.Error())
+		processError(w, http.StatusInternalServerError, "error saving project "+err.Error())
 		return
 	}
-	displayStatus(c)
+	displayMain(w, r)
 }
 
-func getProject(c *gin.Context) {
-	p := c.Param("name")
-	project, err := database.GetProject(p)
-	if err != nil {
-		processError(c, http.StatusBadRequest, "could not retrieve project "+err.Error())
+func start(w http.ResponseWriter, r *http.Request) {
+	proj := r.PathValue("name")
+	session := sessionData(r)
+	if session == nil {
+		displayMain(w, r)
 		return
 	}
-	c.JSON(http.StatusOK, project)
-}
-
-func start(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user").(string)
-	proj := c.Param("name")
+	user := session.User
 	project, err := database.GetProject(proj)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, "error reading project "+err.Error())
+		processError(w, http.StatusBadRequest, "error reading project "+err.Error())
 		return
 	}
 	if !project.Active {
-		processError(c, http.StatusBadRequest, "project is not active")
+		processError(w, http.StatusBadRequest, "project is not active")
 		return
 	}
 	if models.IsTrackingActive(user) {
 		if err := stopE(user); err != nil {
-			processError(c, http.StatusInternalServerError, err.Error())
+			processError(w, http.StatusInternalServerError, err.Error())
 			return
 		}
 	}
@@ -93,12 +76,12 @@ func start(c *gin.Context) {
 		Start:   time.Now(),
 	}
 	if err := database.SaveRecord(&record); err != nil {
-		processError(c, http.StatusInternalServerError, "failed to save record "+err.Error())
+		processError(w, http.StatusInternalServerError, "failed to save record "+err.Error())
 		return
 	}
 	models.TrackingActive(user, project)
 	slog.Info("tracking started", "project", project.Name)
-	displayMain(c)
+	displayMain(w, r)
 }
 
 func stopE(user string) error {
@@ -119,12 +102,12 @@ func stopE(user string) error {
 	return nil
 }
 
-func stop(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user").(string)
+func stop(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	user := session.User
 	if err := stopE(user); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	displayMain(c)
+	displayMain(w, r)
 }
diff --git a/projects_test.go b/projects_test.go
index a4edf02..4149a17 100644
--- a/projects_test.go
+++ b/projects_test.go
@@ -17,61 +17,51 @@ import (
 
 func TestAddProject(t *testing.T) {
 	deleteAllProjects()
-	err := createTestUser(models.User{Username: "admin", Password: "password", IsAdmin: true})
-	should.BeNil(t, err)
-
-	t.Run("new project", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
+	createAdmin()
 
+	t.Run("displayForm", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		project := models.Project{
-			Name: "test",
-		}
-		payload, err := json.Marshal(&project)
-		should.BeNil(t, err)
-		t.Log(string(payload))
-		req, err := http.NewRequest(http.MethodPost, "/projects", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
-		b, err := io.ReadAll(req.Body)
+		r := httptest.NewRequest(http.MethodGet, "/projects/add/", nil)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
-		t.Log(string(b))
+		should.ContainSubstring(t, string(body), "Add New Project")
+	})
+	t.Run("new", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		payload := bodyParams("name", "test")
+		req := httptest.NewRequest(http.MethodPost, "/projects/", payload)
+		req.AddCookie(adminLogin())
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusBadRequest)
-		body, err := io.ReadAll(w.Result().Body)
+		should.BeEqual(t, w.Code, http.StatusOK)
+		projects, err := database.GetAllProjects()
 		should.BeNil(t, err)
-		t.Log(string(body))
-		should.ContainSubstring(t, string(body), "")
+		should.BeEqual(t, len(projects), 1)
 	})
 
-	t.Run("invalid data", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
+	t.Run("empty", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodPost, "/projects", nil)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		req := httptest.NewRequest(http.MethodPost, "/projects/", nil)
+		req.AddCookie(adminLogin())
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "could not decode request")
+		should.ContainSubstring(t, string(body), "invalid project name")
 	})
 
-	t.Run("invalid data2", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
+	t.Run("invalidData", func(t *testing.T) {
 		w := httptest.NewRecorder()
 		payload, err := json.Marshal(models.Project{
 			Name: "test name",
 		})
 		should.BeNil(t, err)
-		req, _ := http.NewRequest(http.MethodPost, "/projects", bytes.NewBuffer(payload))
-		req.AddCookie(cookie)
+		req, _ := http.NewRequest(http.MethodPost, "/projects/", bytes.NewBuffer(payload))
+		req.AddCookie(adminLogin())
 		req.Header.Set("Content-Type", "application/json")
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
@@ -80,19 +70,13 @@ func TestAddProject(t *testing.T) {
 		should.ContainSubstring(t, string(body), "invalid project name")
 	})
 
-	t.Run("project exists", func(t *testing.T) {
+	t.Run("exists", func(t *testing.T) {
 		createTestProjects()
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
 		w := httptest.NewRecorder()
-		payload, err := json.Marshal(models.Project{
-			Name: "test",
-		})
-		should.BeNil(t, err)
-		req, _ := http.NewRequest(http.MethodPost, "/projects", bytes.NewBuffer(payload))
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "test")
+		req := httptest.NewRequest(http.MethodPost, "/projects/", payload)
+		req.AddCookie(adminLogin())
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Result().Body)
@@ -101,110 +85,72 @@ func TestAddProject(t *testing.T) {
 	})
 }
 
-func TestGetProjects(t *testing.T) {
+func TestStartStopProject(t *testing.T) {
+	deleteAllRecords()
 	deleteAllProjects()
 	createTestProjects()
-	err := createTestUser(models.User{Username: "test", Password: "test", IsAdmin: false})
-	should.BeNil(t, err)
-
-	t.Run("existing project", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "test", Password: "test"})
-		should.NotBeNil(t, cookie)
-
+	deleteAllUsers()
+	createAdmin()
+	t.Run("non-existent", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodGet, "/projects/test", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/projects/start/junk", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusOK)
+		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
-		msg := models.Project{}
-		err = json.Unmarshal(body, &msg)
-		should.BeNil(t, err)
-		should.BeEqual(t, msg.Name, "test")
+		should.ContainSubstring(t, string(body), "no such project")
 	})
-
-	t.Run("wrong project", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
+	t.Run("inactive", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodGet, "/projects/missing", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/projects/start/inactive", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "could not retrieve project no such project")
+		should.ContainSubstring(t, string(body), "project is not active")
 	})
-
-	t.Run("get all", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
+	t.Run("active", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodGet, "/projects", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/projects/start/test", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
-		body, err := io.ReadAll(w.Result().Body)
+		records, err := database.GetAllRecords()
 		should.BeNil(t, err)
-		msg := []models.Project{}
-		err = json.Unmarshal(body, &msg)
-		should.BeNil(t, err)
-		should.BeEqual(t, len(msg), 5)
+		should.BeEqual(t, len(records), 1)
+		should.BeEqual(t, records[0].End.IsZero(), true)
 	})
-	t.Run("get all when empty", func(t *testing.T) {
-		deleteAllProjects()
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
+	t.Run("startdifferent", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodGet, "/projects", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/projects/start/test2", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
-		body, err := io.ReadAll(w.Result().Body)
-		should.BeNil(t, err)
-		msg := []models.StatusResponse{}
-		err = json.Unmarshal(body, &msg)
-		should.BeNil(t, err)
-		should.BeEqual(t, len(msg), 0)
+		records, err := database.GetAllRecords()
+		should.BeNil(t, err)
+		should.BeEqual(t, len(records), 2)
+		for _, record := range records {
+			if record.Project == "test" {
+				should.BeEqual(t, record.End.IsZero(), false)
+			}
+			if record.Project == "test2" {
+				should.BeEqual(t, record.End.IsZero(), true)
+			}
+		}
 	})
-}
-
-func TestGetStatus(t *testing.T) {
-	createTestRecords()
-	err := createTestUser(models.User{Username: "test", Password: "test", IsAdmin: false})
-	should.BeNil(t, err)
-	cookie := testLogin(models.User{Username: "test", Password: "test"})
-	should.NotBeNil(t, cookie)
-
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest(http.MethodGet, "/projects/status", nil)
-	req.AddCookie(cookie)
-	router.ServeHTTP(w, req)
-	should.BeEqual(t, w.Code, http.StatusOK)
-	body, err := io.ReadAll(w.Result().Body)
-	should.BeNil(t, err)
-	should.ContainSubstring(t, string(body), "<b>Current Project: </b>")
-}
-
-func TestStartStopProject(t *testing.T) {
-	deleteAllProjects()
-	createTestProjects()
-	t.Run("non-existent Project", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
+	t.Run("stop", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodPost, "/projects/junk/start", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/projects/stop/", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusInternalServerError)
-		body, err := io.ReadAll(w.Result().Body)
+		should.BeEqual(t, w.Code, http.StatusOK)
+		records, err := database.GetAllRecords()
 		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "no such project")
+		should.BeEqual(t, len(records), 2)
+		should.BeEqual(t, records[0].End.IsZero(), false)
+		should.BeEqual(t, records[1].End.IsZero(), false)
 	})
 }
 
diff --git a/records.go b/records.go
index e3eaad5..573be8e 100644
--- a/records.go
+++ b/records.go
@@ -6,7 +6,6 @@ import (
 
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
@@ -45,45 +44,50 @@ func getStatus(user string) (models.StatusResponse, error) {
 	return response, nil
 }
 
-func getRecord(c *gin.Context) {
-	id, err := uuid.Parse(c.Param("id"))
+func getRecord(w http.ResponseWriter, r *http.Request) {
+	id, err := uuid.Parse(r.PathValue("id"))
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	record, err := database.GetRecord(id)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	c.HTML(http.StatusOK, "editRecord", record)
+	_ = templates.ExecuteTemplate(w, "editRecord", record)
 }
 
-func editRecord(c *gin.Context) {
-	var err error
-	edit := models.EditRecord{}
-	if err := c.Bind(&edit); err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
-		return
+func editRecord(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid data")
+	}
+
+	edit := models.EditRecord{
+		ID:        r.PathValue("id"),
+		Start:     r.FormValue("Start"),
+		StartTime: r.FormValue("StartTime"),
+		End:       r.FormValue("End"),
+		EndTime:   r.FormValue("EndTime"),
 	}
 	record, err := database.GetRecord(uuid.MustParse(edit.ID))
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	record.End, err = time.Parse("2006-01-0215:04", edit.End+edit.EndTime)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	record.Start, err = time.Parse("2006-01-0215:04", edit.Start+edit.StartTime)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	if err := database.SaveRecord(&record); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	displayStatus(c)
+	displayStatus(w, r)
 }
diff --git a/records_test.go b/records_test.go
new file mode 100644
index 0000000..93dd87e
--- /dev/null
+++ b/records_test.go
@@ -0,0 +1,133 @@
+package main
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/timetraced/database"
+)
+
+func TestRecords(t *testing.T) {
+	deleteAllRecords()
+	createTestRecords()
+	deleteAllUsers()
+	createAdmin()
+	records, err := database.GetAllRecords()
+	should.BeNil(t, err)
+	ID := records[0].ID.String()
+	url := "/records/" + ID
+	t.Run("get", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, url, nil)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "Edit Record")
+	})
+	t.Run("invalidID", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/records/notUUID", nil)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "invalid UUID")
+	})
+	t.Run("edit", func(t *testing.T) {
+		start := time.Now().Add(time.Hour - 1)
+		end := time.Now()
+		w := httptest.NewRecorder()
+		payload := bodyParams(
+			"ID", ID,
+			"Start", start.Format(time.DateOnly),
+			"StartTime", formatTimeOnly(start),
+			"End", end.Format(time.DateOnly),
+			"EndTime", formatTimeOnly(end),
+		)
+		r := httptest.NewRequest(http.MethodPost, url, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		record, err := database.GetRecord(records[0].ID)
+		t.Log("record", record.Start, "start", start)
+		should.BeNil(t, err)
+		should.BeEqual(t, record.Start.Format(time.DateOnly), start.Format(time.DateOnly))
+		should.BeEqual(t, record.End.Format(time.DateOnly), end.Format(time.DateOnly))
+	})
+	t.Run("editBadID", func(t *testing.T) {
+		start := time.Now().Add(time.Hour - 1)
+		end := time.Now()
+		w := httptest.NewRecorder()
+		payload := bodyParams(
+			"ID", "notUUID",
+			"Start", start.Format(time.DateOnly),
+			"StartTime", formatTimeOnly(start),
+			"End", end.Format(time.DateOnly),
+			"EndTime", formatTimeOnly(end),
+		)
+		r := httptest.NewRequest(http.MethodPost, "/records/notUUID", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(adminLogin())
+		should.Panic(t, func() {
+			router.ServeHTTP(w, r)
+		})
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+
+	t.Run("badStartTime", func(t *testing.T) {
+		start := time.Now().Add(time.Hour - 1)
+		end := time.Now()
+		w := httptest.NewRecorder()
+		payload := bodyParams(
+			"ID", ID,
+			"Start", start.Format(time.DateOnly),
+			"StartTime", start.Format(time.TimeOnly),
+			"End", end.Format(time.DateOnly),
+			"EndTime", formatTimeOnly(end),
+		)
+		r := httptest.NewRequest(http.MethodPost, url, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "parsing time")
+	})
+
+	t.Run("badEndTime", func(t *testing.T) {
+		start := time.Now().Add(time.Hour - 1)
+		end := time.Now()
+		w := httptest.NewRecorder()
+		payload := bodyParams(
+			"ID", ID,
+			"Start", start.Format(time.DateOnly),
+			"StartTime", formatTimeOnly(start),
+			"End", end.Format(time.DateOnly),
+			"EndTime", end.Format(time.TimeOnly),
+		)
+		r := httptest.NewRequest(http.MethodPost, url, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "parsing time")
+	})
+}
+
+func formatTimeOnly(t time.Time) string {
+	s := t.Format(time.TimeOnly)
+	index := strings.LastIndex(s, ":")
+	return s[:index]
+}
diff --git a/reports.go b/reports.go
index 3acb346..79b3f6a 100644
--- a/reports.go
+++ b/reports.go
@@ -1,48 +1,43 @@
 package main
 
 import (
-	"io"
 	"log/slog"
 	"net/http"
 	"time"
 
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 )
 
-func getReport(c *gin.Context) { //nolint:cyclop,funlen
+func getReport(w http.ResponseWriter, r *http.Request) { //nolint:funlen
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid data")
+	}
 	var err error
 	projectsToQuery := []string{}
-	session := sessions.Default(c)
+	session := sessionData(r)
 	dbRequest := models.DatabaseReportRequest{
-		User: session.Get("user").(string),
+		User: session.User,
 	}
-	reportRequest := models.ReportRequest{}
-	if err := c.Bind(&reportRequest); err != nil {
-		slog.Error("unable to bind", "error", err)
-		processError(c, http.StatusBadRequest, "could not decode request")
-		if c.Request.Body != nil {
-			body, _ := io.ReadAll(c.Request.Body)
-			slog.Info(string(body))
-		}
-		return
+	reportRequest := models.ReportRequest{
+		Start:   r.FormValue("start"),
+		End:     r.FormValue("end"),
+		Project: r.FormValue("project"),
 	}
 	dbRequest.Start, err = time.Parse("2006-01-02", reportRequest.Start)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	dbRequest.End, err = time.Parse("2006-01-02", reportRequest.End)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	if reportRequest.Project == "" {
 		allProjects, err := database.GetAllProjects()
 		if err != nil {
-			processError(c, http.StatusInternalServerError, err.Error())
+			processError(w, http.StatusInternalServerError, err.Error())
 			return
 		}
 		for _, project := range allProjects {
@@ -59,7 +54,7 @@ func getReport(c *gin.Context) { //nolint:cyclop,funlen
 		dbRequest.Project = project
 		data, err := database.GetReportRecords(dbRequest)
 		if err != nil {
-			processError(c, http.StatusInternalServerError, err.Error())
+			processError(w, http.StatusInternalServerError, err.Error())
 			return
 		}
 		var total time.Duration
@@ -78,12 +73,16 @@ func getReport(c *gin.Context) { //nolint:cyclop,funlen
 			displayRecords = append(displayRecords, displayRecord)
 		}
 	}
-	c.HTML(http.StatusOK, "results", displayRecords)
+	_ = templates.ExecuteTemplate(w, "results", displayRecords)
 }
 
-func report(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user").(string)
+func report(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session == nil {
+		processError(w, http.StatusBadRequest, "invalid data")
+		return
+	}
+	user := session.User
 	page := populatePage(user)
 	projects, err := database.GetAllProjects()
 	if err != nil {
@@ -93,5 +92,5 @@ func report(c *gin.Context) {
 			page.Projects = append(page.Projects, project.Name)
 		}
 	}
-	c.HTML(http.StatusOK, "report", page)
+	_ = templates.ExecuteTemplate(w, "report", page)
 }
diff --git a/reports_test.go b/reports_test.go
index a6a3f4f..2a1d3b8 100644
--- a/reports_test.go
+++ b/reports_test.go
@@ -1,8 +1,6 @@
 package main
 
 import (
-	"bytes"
-	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -19,32 +17,42 @@ import (
 func TestGetReport(t *testing.T) {
 	deleteAllUsers()
 	deleteAllRecords()
+	createAdmin()
 	err := createTestUser(models.User{Username: "test", Password: "testing"})
 	should.BeNil(t, err)
 	cookie := testLogin(models.User{Username: "test", Password: "testing"})
 	should.NotBeNil(t, cookie)
+
+	t.Run("get", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/reports/", nil)
+		r.AddCookie(adminLogin())
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "Reports")
+	})
 	t.Run("no request", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodPost, "/reports", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/reports/", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
-		should.ContainSubstring(t, string(body), "could not decode request")
+		should.ContainSubstring(t, string(body), "parsing time")
 	})
 	t.Run("no records", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		request := models.ReportRequest{
-			Start:   time.Now().Add(-24 * time.Hour).Format("2006-01-02"),
-			End:     time.Now().Format("2006-01-02"),
-			Project: "nilProject",
-		}
-		payload, err := json.Marshal(&request)
-		should.BeNil(t, err)
-		req, _ := http.NewRequest(http.MethodPost, "/reports", bytes.NewBuffer(payload))
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams(
+			"start", time.Now().Add(-24*time.Hour).Format("2006-01-02"),
+			"end", time.Now().Format("2006-01-02"),
+			"project", "nilProject",
+		)
+		req := httptest.NewRequest(http.MethodPost, "/reports/", payload)
+		req.AddCookie(adminLogin())
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
 		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
@@ -55,46 +63,41 @@ func TestGetReport(t *testing.T) {
 		}
 	})
 
-	t.Run("one user/one project", func(t *testing.T) {
+	t.Run("nilproject", func(t *testing.T) {
 		createTestRecords()
 		w := httptest.NewRecorder()
-		data := models.ReportRequest{
-			Start:   time.Now().Add(-24 * time.Hour).Format("2006-01-02"),
-			End:     time.Now().Format("2006-01-02"),
-			Project: "timetrace",
-		}
-		payload, err := json.Marshal(data)
-		should.BeNil(t, err)
-		req, _ := http.NewRequest(http.MethodPost, "/reports", bytes.NewBuffer(payload))
+		payload := bodyParams(
+			"start", time.Now().Add(-24*time.Hour).Format("2006-01-02"),
+			"end", time.Now().Format("2006-01-02"),
+			"project", "nilProject",
+		)
+		req := httptest.NewRequest(http.MethodPost, "/reports/", payload)
 		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
 		body, _ := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
 		should.BeEqual(t, w.Code, http.StatusOK)
-		should.ContainSubstring(t, string(body), "<h2>Project timetrace")
+		should.ContainSubstring(t, string(body), "<h1>TimeTrace Report")
 	})
 
-	t.Run("all records", func(t *testing.T) {
+	t.Run("allRecords", func(t *testing.T) {
 		createTestRecords()
 		createTestProjects()
 
 		w := httptest.NewRecorder()
-		data := models.ReportRequest{
-			Start:   time.Now().Add(-72 * time.Hour).Format("2006-01-02"),
-			End:     time.Now().Format("2006-01-02"),
-			Project: "",
-		}
-		payload, err := json.Marshal(data)
-		should.BeNil(t, err)
-		req, _ := http.NewRequest(http.MethodPost, "/reports", bytes.NewBuffer(payload))
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams(
+			"start", time.Now().Add(-24*time.Hour*14).Format("2006-01-02"),
+			"end", time.Now().Format("2006-01-02"),
+		)
+		req := httptest.NewRequest(http.MethodPost, "/reports/", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		router.ServeHTTP(w, req)
 		body, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
 		should.BeEqual(t, w.Code, http.StatusOK)
-		should.ContainSubstring(t, string(body), "<button hx-get=\"/records")
+		should.ContainSubstring(t, string(body), "TimeTrace Report")
 	})
 }
 
diff --git a/router.go b/router.go
index 142c9d1..e9f7331 100644
--- a/router.go
+++ b/router.go
@@ -1,103 +1,87 @@
 package main
 
 import (
-	"embed"
-	"fmt"
+	"bytes"
+	"crypto/rand"
+	"html/template"
 	"log"
 	"log/slog"
 	"net/http"
 	"os"
-	"path/filepath"
-	"runtime"
 	"time"
 
+	"github.com/devilcove/mux"
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-contrib/sessions/cookie"
-	"github.com/gin-gonic/gin"
+	"github.com/gorilla/sessions"
 )
 
-//go:embed images/favicon.ico
-var icon embed.FS
+const (
+	sessionBytes = 32
+	cookieAge    = 300
+)
+
+var (
+	store     *sessions.CookieStore
+	templates *template.Template
+	logger    *slog.Logger
+)
+
+// //go:embed images/favicon.ico
+// var icon embed.FS
+
+func setupRouter(l *slog.Logger) *mux.Router {
+	store = sessions.NewCookieStore(randBytes(sessionBytes))
+	store.MaxAge(cookieAge)
+	store.Options.HttpOnly = true
+	store.Options.SameSite = http.SameSiteStrictMode
+
+	router := mux.NewRouter(l, mux.Logger)
+	logger = l
+
+	router.Static("/images/", "./images")
+	router.Static("/assets/", "./assets")
+	router.ServeFile("/favicon.ico", "images/favicon.ico")
+	templates = template.Must(template.ParseGlob("html/*"))
+
+	router.Post("/login", login)
+	router.Get("/logout/", logout)
+	router.Get("/{$}", displayMain)
 
-func setupRouter() *gin.Engine { //nolint:funlen
-	secret, ok := os.LookupEnv("SESSION_SECRET")
-	if !ok {
-		secret = "secret"
-	}
-	store := cookie.NewStore([]byte(secret))
-	session := sessions.Sessions("time", store)
-	router := gin.Default()
-	router.LoadHTMLGlob("html/*.html")
-	router.Static("images", "./images")
-	router.Static("assets", "./assets")
-	router.StaticFS("/favicon.ico", http.FS(icon))
-	// router.SetHTMLTemplate(template.Must(template.New("").Parse("html/*")))
-	_ = router.SetTrustedProxies(nil)
-	router.Use(gin.Recovery(), session)
 	users := router.Group("/users", auth)
-	{
-		users.GET("", getUsers)
-		users.GET("current", getUser)
-		users.POST("", addUser)
-		users.POST(":name", editUser)
-		users.DELETE(":name", deleteUser)
-		users.GET(":name", getUser)
-	}
-	router.GET("/login", displayLogin)
-	router.POST("/login", login)
-	router.GET("/logout", logout)
-	router.GET("/register", register)
-	router.GET("/", displayMain)
-	router.POST("/register", regUser)
+	users.Get("/{$}", getUsers)
+	users.Get("/register/", register)
+	users.Post("/register/", registerUser)
+	users.Post("/{name}", editUser)
+	users.Delete("/{name}", deleteUser)
+	users.Get("/{name}", getUser)
+
 	projects := router.Group("/projects", auth)
-	{
-		projects.GET("", getProjects)
-		projects.GET("/add", displayProjectForm)
-		projects.POST("", addProject)
-		projects.GET("/:name", getProject)
-		projects.POST("/:name/start", start)
-		projects.POST("/stop", stop)
-		projects.GET("/status", displayStatus)
-	}
+	projects.Get("/add/", displayProjectForm)
+	projects.Post("/{$}", addProject)
+	projects.Post("/stop/", stop)
+	projects.Post("/start/{name}", start)
+
 	reports := router.Group("/reports", auth)
-	{
-		reports.GET("", report)
-		reports.POST("", getReport)
-	}
-	records := router.Group("records", auth)
-	{
-		records.GET("/:id", getRecord)
-		records.POST("/:id", editRecord)
-	}
+	reports.Get("/{$}", report)
+	reports.Post("/{$}", getReport)
+
+	records := router.Group("/records", auth)
+	records.Get("/{id}", getRecord)
+	records.Post("/{id}", editRecord)
+
 	configuration := router.Group("/config", auth)
-	{
-		configuration.GET("/", config)
-		configuration.POST("/", setConfig)
-	}
+	configuration.Get("/{$}", configOld)
+	configuration.Post("/{$}", setConfig)
 	return router
 }
 
-func processError(c *gin.Context, status int, message string) {
-	pc, fn, line, _ := runtime.Caller(1)
-	source := fmt.Sprintf("%s[%s:%d]", runtime.FuncForPC(pc).Name(), filepath.Base(fn), line)
-	slog.Error(message, "status", status, "source", source)
-	c.HTML(status, "error", message)
-	c.Abort()
-}
-
-func auth(c *gin.Context) {
-	session := sessions.Default(c)
-	loggedIn := session.Get("loggedin")
-	if loggedIn == nil {
-		slog.Info("not logged in display login page")
-		page := models.GetPage()
-		page.NeedsLogin = true
-		c.HTML(http.StatusOK, "login", page)
-		c.Abort()
-		return
-	}
+func processError(w http.ResponseWriter, status int, message string) {
+	buf := bytes.Buffer{}
+	l := log.New(&buf, "ERROR: ", log.Lshortfile)
+	_ = l.Output(2, message)
+	logger.Error(buf.String())
+	http.Error(w, message, status)
 }
 
 func checkDefaultUser() {
@@ -107,8 +91,8 @@ func checkDefaultUser() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	if len(users) > 1 {
-		slog.Debug("user exists")
+	if len(users) > 0 {
+		slog.Debug("user exists", "user", users[0].Username)
 		return
 	}
 	if user == "" {
@@ -127,5 +111,22 @@ func checkDefaultUser() {
 		IsAdmin:  true,
 		Updated:  time.Now(),
 	})
-	slog.Info("default user created")
+	logger.Info(
+		"default user created",
+		"user",
+		user,
+		"env user",
+		os.Getenv("USER"),
+		"env pass",
+		os.Getenv("PASS"),
+	)
+}
+
+func randBytes(l int) []byte {
+	bytes := make([]byte, l)
+	_, err := rand.Read(bytes)
+	if err != nil {
+		panic(err)
+	}
+	return bytes
 }
diff --git a/router_test.go b/router_test.go
new file mode 100644
index 0000000..e49aef9
--- /dev/null
+++ b/router_test.go
@@ -0,0 +1,24 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/timetraced/database"
+)
+
+func TestDefaultUser(t *testing.T) {
+	deleteAllUsers()
+	users, err := database.GetAllUsers()
+	should.BeNil(t, err)
+	checkDefaultUser()
+	users, err = database.GetAllUsers()
+	should.BeNil(t, err)
+	should.BeEqual(t, len(users), 1)
+	should.BeEqual(t, users[0].Username, "admin")
+	checkDefaultUser() // run second time
+	users, err = database.GetAllUsers()
+	should.BeNil(t, err)
+	should.BeEqual(t, len(users), 1)
+	should.BeEqual(t, users[0].Username, "admin")
+}
diff --git a/user_test.go b/user_test.go
index e183e3e..0fcee34 100644
--- a/user_test.go
+++ b/user_test.go
@@ -6,27 +6,32 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"os"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/mux"
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-gonic/gin"
+	"github.com/mattkasun/tools/logging"
 )
 
 var (
-	router *gin.Engine
+	router *mux.Router
 	w      *httptest.ResponseRecorder
 )
 
 func TestMain(m *testing.M) {
-	setLogging()
+	log := logging.TextLogger(logging.TruncateSource(), logging.TimeFormat(time.DateTime))
+	os.Setenv("USER", "")
+	os.Setenv("PASS", "")
 	os.Setenv("DB_FILE", "test.db") //nolint:errcheck,gosec
 	_ = database.InitializeDatabase()
 	defer database.Close()
-	checkDefaultUser()
-	router = setupRouter()
+	router = setupRouter(log.Logger)
 	w = httptest.NewRecorder()
 	os.Exit(m.Run())
 }
@@ -38,54 +43,83 @@ func TestDisplayLogin(t *testing.T) {
 	should.BeEqual(t, w.Code, http.StatusOK)
 }
 
+func TestGetAllUsers(t *testing.T) {
+	deleteAllUsers()
+	createAdmin()
+	createTestUser(models.User{Username: "test", Password: "pass"})
+	t.Run("admin", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/users/", nil)
+		req.AddCookie(adminLogin())
+		router.ServeHTTP(w, req)
+		should.BeEqual(t, w.Code, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Users</h1>")
+	})
+	t.Run("normalUser", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/users/", nil)
+		r.AddCookie(testLogin(models.User{Username: "test", Password: "pass"}))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.BeNil(t, err)
+		should.ContainSubstring(t, string(body), "function valPass")
+	})
+}
+
 func TestRegister(t *testing.T) {
-	req, err := http.NewRequest(http.MethodGet, "/register", nil)
-	should.BeNil(t, err)
+	deleteAllUsers()
+	createAdmin()
+	req := httptest.NewRequest(http.MethodGet, "/users/register/", nil)
+	req.AddCookie(adminLogin())
+	w := httptest.NewRecorder()
 	router.ServeHTTP(w, req)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	t.Run("existing", func(t *testing.T) {
 		err := createTestUser(models.User{Username: "tester", Password: "testing"})
 		should.BeNil(t, err)
 		w := httptest.NewRecorder()
-		user := models.User{Username: "tester", Password: "testing"}
-		payload, err := json.Marshal(&user)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/register", bytes.NewBuffer(payload))
+		body := bodyParams("username", "tester", "password", "testing")
+		req := httptest.NewRequest(http.MethodPost, "/users/register/", body)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.AddCookie(adminLogin())
+		router.ServeHTTP(w, req)
+		should.BeEqual(t, w.Code, http.StatusBadRequest)
+		b, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		should.ContainSubstring(t, string(b), "user exists")
+	})
+	t.Run("blankPass", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		body := bodyParams("username", "tester3", "password", "")
+		req := httptest.NewRequest(http.MethodPost, "/users/register/", body)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
-		body, err := io.ReadAll(w.Result().Body)
+		b, err := io.ReadAll(w.Result().Body)
 		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "user exists")
+		should.ContainSubstring(t, string(b), "password cannot be blank")
 	})
 	t.Run("new", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		user := models.User{Username: "tester3", Password: ""}
-		payload, err := json.Marshal(&user)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/register", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		body := bodyParams("username", "tester3", "password", "pass")
+		req := httptest.NewRequest(http.MethodPost, "/users/register/", body)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusBadRequest)
-		body, err := io.ReadAll(w.Result().Body)
+		should.BeEqual(t, w.Code, http.StatusFound)
+		users, err := database.GetAllUsers()
 		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "password cannot be blank")
+		should.BeEqual(t, len(users), 3)
 	})
 }
 
 func TestAdminLogin(t *testing.T) {
-	data := struct {
-		Username string
-		Password string
-	}{
-		Username: "admin",
-		Password: "password",
-	}
-	body, _ := json.Marshal(data)
-	req, _ := http.NewRequest(http.MethodPost, "/login", bytes.NewBuffer(body))
-	req.Header.Set("Content-Type", "application/json")
+	body := bodyParams("username", "admin", "password", "password")
+	req := httptest.NewRequest(http.MethodPost, "/login", body)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	router.ServeHTTP(w, req)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	should.NotBeNil(t, w.Result().Cookies())
@@ -113,15 +147,9 @@ func TestNonAdminLogin(t *testing.T) {
 func TestBadLogin(t *testing.T) {
 	t.Run("bad pass", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		data := struct {
-			Username string
-			Password string
-		}{
-			Username: "admin",
-			Password: "helloworld",
-		}
-		body, _ := json.Marshal(data)
-		req, _ := http.NewRequest(http.MethodPost, "/login", bytes.NewBuffer(body))
+		payload := bodyParams("username", "admin", "password", "wrong")
+		req := httptest.NewRequest(http.MethodPost, "/login", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		should.BeEqual(t, w.Result().Cookies(), []*http.Cookie{})
@@ -131,16 +159,15 @@ func TestBadLogin(t *testing.T) {
 	})
 	t.Run("invalid data", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodPost, "/login", nil)
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		should.BeEqual(t, w.Result().Cookies(), []*http.Cookie{})
 	})
 	t.Run("invalid user", func(t *testing.T) {
 		w := httptest.NewRecorder()
-		data := models.User{Username: "nosuchuser", Password: "testing"}
-		payload, _ := json.Marshal(data)
-		req, _ := http.NewRequest(http.MethodPost, "/login", bytes.NewBuffer(payload))
+		payload := bodyParams("username", "nosuchuser", "passowd", "testing")
+		req := httptest.NewRequest(http.MethodPost, "/login", payload)
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		should.BeEqual(t, w.Result().Cookies(), []*http.Cookie{})
@@ -151,29 +178,15 @@ func TestBadLogin(t *testing.T) {
 
 func TestLogout(t *testing.T) {
 	w := httptest.NewRecorder()
-	req, _ := http.NewRequest(http.MethodGet, "/logout", nil)
+	req, _ := http.NewRequest(http.MethodGet, "/logout/", nil)
 	router.ServeHTTP(w, req)
-	should.BeEqual(t, w.Code, http.StatusOK)
-	should.BeEqual(t, w.Result().Cookies(), []*http.Cookie{})
-}
-
-func TestGetAllUsers(t *testing.T) {
-	t.Run("admin", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		w := httptest.NewRecorder()
-		req, err := http.NewRequest(http.MethodGet, "/users", nil)
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusOK)
-		body, err := io.ReadAll(w.Result().Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "<td>Admin</td>")
-	})
+	should.BeEqual(t, w.Code, http.StatusFound)
+	should.BeEqual(t, w.Result().Cookies()[0].MaxAge, -1)
 }
 
 func TestDeleteUser(t *testing.T) {
 	deleteAllUsers()
+	createAdmin()
 	err := createTestUser(models.User{Username: "tester", Password: "testing", IsAdmin: false})
 	should.BeNil(t, err)
 	err = createTestUser(models.User{Username: "tester2", Password: "testing", IsAdmin: false})
@@ -182,7 +195,7 @@ func TestDeleteUser(t *testing.T) {
 		cookie := testLogin(models.User{Username: "tester", Password: "testing"})
 		should.NotBeNil(t, cookie)
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodDelete, "/users/tester2", nil)
+		req := httptest.NewRequest(http.MethodDelete, "/users/tester2", nil)
 		req.AddCookie(cookie)
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusUnauthorized)
@@ -191,20 +204,16 @@ func TestDeleteUser(t *testing.T) {
 		should.ContainSubstring(t, string(body), "not authorized to delete this user")
 	})
 	t.Run("admin delete", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodDelete, "/users/tester", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodDelete, "/users/tester", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusNoContent)
+		should.BeEqual(t, w.Code, http.StatusOK)
 	})
 	t.Run("delete non-existent user", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodDelete, "/users/tester", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodDelete, "/users/tester3", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		response, err := io.ReadAll(w.Body)
@@ -219,13 +228,12 @@ func TestEditUser(t *testing.T) {
 	should.BeNil(t, err)
 	err = createTestUser(models.User{Username: "tester2", Password: "testing", IsAdmin: false})
 	should.BeNil(t, err)
+	createAdmin()
 
 	t.Run("adminGetUser", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-		req, err := http.NewRequest(http.MethodGet, "/users/tester", nil)
+		req := httptest.NewRequest(http.MethodGet, "/users/tester", nil)
 		should.BeNil(t, err)
-		req.AddCookie(cookie)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
 	})
@@ -233,7 +241,7 @@ func TestEditUser(t *testing.T) {
 	t.Run("GetSelf", func(t *testing.T) {
 		cookie := testLogin(models.User{Username: "tester", Password: "testing"})
 		should.NotBeNil(t, cookie)
-		req, err := http.NewRequest(http.MethodGet, "/users/tester", nil)
+		req := httptest.NewRequest(http.MethodGet, "/users/tester", nil)
 		should.BeNil(t, err)
 		req.AddCookie(cookie)
 		router.ServeHTTP(w, req)
@@ -244,8 +252,7 @@ func TestEditUser(t *testing.T) {
 		w := httptest.NewRecorder()
 		cookie := testLogin(models.User{Username: "tester", Password: "testing"})
 		should.NotBeNil(t, cookie)
-		req, err := http.NewRequest(http.MethodGet, "/users/tester2", nil)
-		should.BeNil(t, err)
+		req := httptest.NewRequest(http.MethodGet, "/users/tester2", nil)
 		req.AddCookie(cookie)
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
@@ -258,9 +265,10 @@ func TestEditUser(t *testing.T) {
 		cookie := testLogin(models.User{Username: "tester", Password: "testing"})
 		should.NotBeNil(t, cookie)
 		w := httptest.NewRecorder()
-		body, _ := json.Marshal(models.User{Username: "tester2", Password: "newPassword"})
-		req, _ := http.NewRequest(http.MethodPost, "/users/tester2", bytes.NewBuffer(body))
+		body := bodyParams("password", "newPassword")
+		req := httptest.NewRequest(http.MethodPost, "/users/tester2", body)
 		req.AddCookie(cookie)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusUnauthorized)
 		response, err := io.ReadAll(w.Body)
@@ -268,16 +276,14 @@ func TestEditUser(t *testing.T) {
 		should.ContainSubstring(t, string(response), "not authorized to edit this user")
 	})
 	t.Run("edit user by admin", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
 		w := httptest.NewRecorder()
-		body, _ := json.Marshal(models.User{Username: "tester2", Password: "newPassword"})
-		req, _ := http.NewRequest(http.MethodPost, "/users/tester2", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.AddCookie(cookie)
+		body := bodyParams("username", "tester2", "password", "newPassword", "admin", "on")
+		req := httptest.NewRequest(http.MethodPost, "/users/tester2", body)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusOK)
-		cookie = testLogin(models.User{Username: "tester2", Password: "newPassword"})
+		should.BeEqual(t, w.Code, http.StatusFound)
+		cookie := testLogin(models.User{Username: "tester2", Password: "newPassword"})
 		should.NotBeNil(t, cookie)
 	})
 	t.Run("edit user by self", func(t *testing.T) {
@@ -285,35 +291,30 @@ func TestEditUser(t *testing.T) {
 		should.NotBeNil(t, cookie)
 
 		w := httptest.NewRecorder()
-		body, _ := json.Marshal(models.User{Username: "tester", Password: "newPassword"})
-		req, _ := http.NewRequest(http.MethodPost, "/users/tester", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
+		body := bodyParams("password", "newPassword")
+		req := httptest.NewRequest(http.MethodPost, "/users/tester", body)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusOK)
+		should.BeEqual(t, w.Code, http.StatusFound)
 		cookie = testLogin(models.User{Username: "tester", Password: "newPassword"})
 		should.NotBeNil(t, cookie)
 	})
 	t.Run("incomplete data", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
 		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodPost, "/users/tester", nil)
-		req.AddCookie(cookie)
+		req := httptest.NewRequest(http.MethodPost, "/users/tester", nil)
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, _ := io.ReadAll(w.Result().Body)
-		should.ContainSubstring(t, string(body), "could not decode request into json")
+		should.ContainSubstring(t, string(body), "password cannot be blank")
 	})
 	t.Run("user does not exist", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
 		w := httptest.NewRecorder()
-		payload, _ := json.Marshal(models.User{Username: "nosuchuser", Password: "newPassword"})
-		req, _ := http.NewRequest(http.MethodPost, "/users/nosuchuser", bytes.NewBuffer(payload))
-		req.AddCookie(cookie)
+		payload := bodyParams("password", "newPassword")
+		req := httptest.NewRequest(http.MethodPost, "/users/nosuchuser", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.AddCookie(adminLogin())
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, _ := io.ReadAll(w.Result().Body)
@@ -321,78 +322,14 @@ func TestEditUser(t *testing.T) {
 	})
 }
 
-func TestAddUser(t *testing.T) {
-	deleteAllUsers()
-	t.Run("add user by admin", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
-		w := httptest.NewRecorder()
-		body, _ := json.Marshal(models.User{Username: "new", Password: "newPassword"})
-		req, _ := http.NewRequest(http.MethodPost, "/users", bytes.NewBuffer(body))
-		req.AddCookie(cookie)
-		router.ServeHTTP(w, req)
-		if w.Code == http.StatusNoContent {
-			cookie = testLogin(models.User{Username: "new", Password: "newPassword"})
-			should.NotBeNil(t, cookie)
-		} else {
-			body, _ := io.ReadAll(w.Result().Body)
-			t.Log(w.Code, string(body))
-		}
-	})
-	t.Run("add user by non-admin", func(t *testing.T) {
-		err := createTestUser(models.User{Username: "tester", Password: "newPassword"})
-		should.BeNil(t, err)
-		cookie := testLogin(models.User{Username: "tester", Password: "newPassword"})
-		should.NotBeNil(t, cookie)
-
-		w := httptest.NewRecorder()
-		body, _ := json.Marshal(models.User{Username: "new", Password: "newPassword"})
-		req, _ := http.NewRequest(http.MethodPost, "/users", bytes.NewBuffer(body))
-		req.AddCookie(cookie)
-		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusUnauthorized)
-		body, _ = io.ReadAll(w.Body)
-		should.ContainSubstring(t, string(body), "only admins can create new users")
-	})
-
-	t.Run("empty password", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
-		w := httptest.NewRecorder()
-		body, _ := json.Marshal(models.User{Username: "emptypass", Password: ""})
-		req, _ := http.NewRequest(http.MethodPost, "/users", bytes.NewBuffer(body))
-		req.AddCookie(cookie)
-		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusBadRequest)
-		body, _ = io.ReadAll(w.Result().Body)
-		should.ContainSubstring(t, string(body), "username or password cannot be blank")
-	})
-
-	t.Run("incomplete data", func(t *testing.T) {
-		cookie := testLogin(models.User{Username: "admin", Password: "password"})
-		should.NotBeNil(t, cookie)
-
-		w := httptest.NewRecorder()
-		// body, _ := json.Marshal(struct{ InvaildData string }{InvaildData: "emptypass"})
-		req, _ := http.NewRequest(http.MethodPost, "/users", nil)
-		req.AddCookie(cookie)
-		router.ServeHTTP(w, req)
-		should.BeEqual(t, w.Code, http.StatusBadRequest)
-		body, _ := io.ReadAll(w.Result().Body)
-		should.ContainSubstring(t, string(body), "could not decode request into json")
-	})
-}
-
 func testLogin(data models.User) *http.Cookie {
 	w := httptest.NewRecorder()
-	body, _ := json.Marshal(data)
-	req, _ := http.NewRequest(http.MethodPost, "/login", bytes.NewBuffer(body))
-	req.Header.Set("Content-Type", "application/json")
+	body := bodyParams("username", data.Username, "password", data.Password)
+	req := httptest.NewRequest(http.MethodPost, "/login", body)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	router.ServeHTTP(w, req)
 	for _, cookie := range w.Result().Cookies() {
-		if cookie.Name == "time" {
+		if cookie.Name == "devilcove-time" {
 			return cookie
 		}
 	}
@@ -410,8 +347,33 @@ func createTestUser(user models.User) error {
 func deleteAllUsers() {
 	users, _ := database.GetAllUsers()
 	for _, user := range users {
-		if user.Username != "admin" {
-			_ = database.DeleteUser(user.Username)
+		_ = database.DeleteUser(user.Username)
+	}
+}
+
+func createAdmin() {
+	createTestUser(models.User{Username: "admin", Password: "password", IsAdmin: true})
+}
+
+func bodyParams(params ...string) io.Reader {
+	body := url.Values{}
+	for i := 0; i < len(params)-1; i = i + 2 {
+		body.Set(params[i], params[i+1])
+	}
+	return strings.NewReader(body.Encode())
+}
+
+func adminLogin() *http.Cookie {
+	w := httptest.NewRecorder()
+	body := bodyParams("username", "admin", "password", "password")
+	r := httptest.NewRequest(http.MethodPost, "/login", body)
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	router.ServeHTTP(w, r)
+	cookies := w.Result().Cookies()
+	for _, cookie := range cookies {
+		if cookie.Name == "devilcove-time" {
+			return cookie
 		}
 	}
+	return nil
 }
diff --git a/users.go b/users.go
index e9b1ef0..de12592 100644
--- a/users.go
+++ b/users.go
@@ -1,47 +1,43 @@
 package main
 
 import (
-	"fmt"
 	"log/slog"
 	"net/http"
 	"time"
 
 	"github.com/devilcove/timetraced/database"
 	"github.com/devilcove/timetraced/models"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
+	"github.com/gorilla/sessions"
 	"golang.org/x/crypto/bcrypt"
 )
 
 const SessionAge = 60 * 60 * 8 // 8 hours in seconds
 
-func displayLogin(c *gin.Context) {
-	page := populatePage("")
-	page.NeedsLogin = true
-	c.HTML(http.StatusOK, "login", page)
-}
-
-func login(c *gin.Context) {
-	session := sessions.Default(c)
+func login(w http.ResponseWriter, r *http.Request) {
 	var user models.User
-	if err := c.Bind(&user); err != nil {
-		processError(c, http.StatusBadRequest, "invalid user")
-		slog.Error("bind err", "error", err)
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid user form")
 		return
 	}
-	slog.Debug("login by", "user", user)
+	user.Username = r.FormValue("username")
+	user.Password = r.FormValue("password")
 	if !validateUser(&user) {
-		session.Clear()
-		_ = session.Save()
-		processError(c, http.StatusBadRequest, "invalid user")
-		slog.Warn("validation error", "user", user.Username)
+		logger.Debug("validation error", "user", user.Username, "pass", user.Password)
+		processError(w, http.StatusBadRequest, "invalid user")
 		return
 	}
-	session.Set("loggedin", true)
-	session.Set("user", user.Username)
-	session.Set("admin", user.IsAdmin)
-	session.Options(sessions.Options{MaxAge: SessionAge, Secure: false, SameSite: http.SameSiteLaxMode})
-	_ = session.Save()
+	session := sessions.NewSession(store, "devilcove-time")
+	session.Values["user"] = user.Username
+	session.Values["loggedIn"] = true
+	session.Values["admin"] = user.IsAdmin
+	session.Options = &sessions.Options{
+		MaxAge:   SessionAge,
+		Secure:   false,
+		SameSite: http.SameSiteLaxMode,
+	}
+	if err := session.Save(r, w); err != nil {
+		logger.Error("session save", "error", err)
+	}
 	user.Password = ""
 	slog.Debug("login", "user", user.Username)
 	page := populatePage(user.Username)
@@ -54,20 +50,21 @@ func login(c *gin.Context) {
 			page.Projects = append(page.Projects, project.Name)
 		}
 	}
-	c.HTML(http.StatusOK, "content", page)
+	_ = templates.ExecuteTemplate(w, "content", page)
 }
 
 func validateUser(visitor *models.User) bool {
 	user, err := database.GetUser(visitor.Username)
 	if err != nil {
-		slog.Error("no such user", "user", visitor.Username, "error", err)
+		logger.Error("no such user", "user", visitor.Username, "error", err)
 		return false
 	}
-	fmt.Println(visitor.Username, user.Username)
+	// fmt.Println(visitor.Username, user.Username)
 	if visitor.Username == user.Username && checkPassword(visitor, &user) {
 		visitor.IsAdmin = user.IsAdmin
 		return true
 	}
+	logger.Error("validation failed")
 	return false
 }
 
@@ -79,158 +76,140 @@ func checkPassword(plain, hash *models.User) bool {
 	return err == nil
 }
 
-func logout(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user")
-	if user != nil {
-		if err := stopE(user.(string)); err != nil {
-			slog.Error("failed to stop tracking for user on logout", "error", err)
+func logout(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session != nil {
+		if err := stopE(session.User); err != nil {
+			logger.Error("failed to stop tracking for user on logout", "error", err)
 		}
+		session.Session.Options.MaxAge = -1
+		_ = session.Session.Save(r, w)
 	}
-	slog.Info("logout", "user", session.Get("user"))
-	// delete cookie
-	session.Clear()
-	_ = session.Save()
-	c.HTML(http.StatusOK, "login", "")
+	http.Redirect(w, r, "/", http.StatusFound)
 }
 
-func register(c *gin.Context) {
+func register(w http.ResponseWriter, _ *http.Request) {
 	page := models.GetPage()
-	c.HTML(http.StatusOK, "register", page)
+	_ = templates.ExecuteTemplate(w, "register", page)
 }
 
-func regUser(c *gin.Context) {
+func registerUser(w http.ResponseWriter, r *http.Request) {
 	var user models.User
-	var err error
-	if err := c.Bind(&user); err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid user")
 		return
 	}
+	user.Username = r.FormValue("username")
+	user.Password = r.FormValue("password")
 	if _, err := database.GetUser(user.Username); err == nil {
-		processError(c, http.StatusBadRequest, "user exists")
+		processError(w, http.StatusBadRequest, "user exists")
 		return
 	}
 	if user.Password == "" {
-		processError(c, http.StatusBadRequest, "password cannot be blank")
+		processError(w, http.StatusBadRequest, "password cannot be blank")
 		return
 	}
+	var err error
 	user.Password, err = hashPassword(user.Password)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	if err := database.SaveUser(&user); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	slog.Info("new user added", "user", user.Username)
-	displayStatus(c)
+	http.Redirect(w, r, "/users/", http.StatusFound)
 }
 
-func addUser(c *gin.Context) {
-	var user models.User
-	var err error
-	session := sessions.Default(c)
-	admin := session.Get("admin")
-	if !admin.(bool) {
-		processError(c, http.StatusUnauthorized, "only admins can create new users")
+func editUser(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session == nil {
+		displayMain(w, r)
 		return
 	}
-	if err := c.BindJSON(&user); err != nil {
-		processError(c, http.StatusBadRequest, "could not decode request into json")
+	if err := r.ParseForm(); err != nil {
+		processError(w, http.StatusBadRequest, "invalid data")
 		return
 	}
-	if _, err := database.GetUser(user.Username); err == nil {
-		processError(c, http.StatusBadRequest, "user exists")
-		return
-	}
-	if user.Username == "" || user.Password == "" {
-		processError(c, http.StatusBadRequest, "username or password cannot be blank")
-		return
-	}
-	user.Password, err = hashPassword(user.Password)
-	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
-		return
+	user := models.User{
+		Username: r.PathValue("name"),
+		Password: r.FormValue("password"),
 	}
-	if err := database.SaveUser(&user); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+	if user.Password == "" {
+		processError(w, http.StatusBadRequest, "password cannot be blank")
 		return
 	}
-	slog.Info("new user added", "user", user.Username)
-	c.JSON(http.StatusNoContent, nil)
-}
-
-func editUser(c *gin.Context) {
-	var user struct {
-		Password string
-		Verify   string
-	}
-	var err error
-	username := c.Param("name")
-	session := sessions.Default(c)
-	admin := session.Get("admin")
-	visitor := session.Get("user").(string)
-	if err := c.Bind(&user); err != nil {
-		processError(c, http.StatusBadRequest, "could not decode request into json")
-		return
+	if r.FormValue("admin") != "" {
+		user.IsAdmin = true
 	}
-	if username != visitor && !admin.(bool) {
-		processError(c, http.StatusUnauthorized, "you are not authorized to edit this user")
+	logger.Debug("edit user", "new", user)
+	visitor := session.User
+	if user.Username != visitor && !session.Admin {
+		processError(w, http.StatusUnauthorized, "you are not authorized to edit this user")
 		return
 	}
-	updatedUser, err := database.GetUser(username)
+	updatedUser, err := database.GetUser(user.Username)
 	if err != nil {
-		processError(c, http.StatusBadRequest, "user does not exist")
+		processError(w, http.StatusBadRequest, "user does not exist"+user.Username)
 		return
 	}
 	updatedUser.Password, err = hashPassword(user.Password)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	if !admin.(bool) {
+	updatedUser.IsAdmin = user.IsAdmin
+	if !session.Admin {
 		updatedUser.IsAdmin = false
 	}
 	updatedUser.Updated = time.Now()
+	logger.Debug("updating user", "old", user, "new", updatedUser)
 	if err := database.SaveUser(&updatedUser); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	slog.Info("user updated", "user", updatedUser.Username)
-	displayStatus(c)
+	logger.Info("user updated", "user", updatedUser.Username)
+	http.Redirect(w, r, "/users/", http.StatusFound)
 }
 
-func deleteUser(c *gin.Context) {
-	session := sessions.Default(c)
-	admin := session.Get("admin")
-	user := c.Param("name")
-	if !admin.(bool) {
-		processError(c, http.StatusUnauthorized, "you are not authorized to delete this user")
+func deleteUser(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session == nil {
+		displayMain(w, r)
+		return
+	}
+	user := r.PathValue("name")
+	if !session.Admin {
+		processError(w, http.StatusUnauthorized, "you are not authorized to delete this user")
 		return
 	}
 	if _, err := database.GetUser(user); err != nil {
-		processError(c, http.StatusBadRequest, "user does not exist")
+		processError(w, http.StatusBadRequest, "user does not exist")
 		return
 	}
 	if err := database.DeleteUser(user); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	slog.Info("deleted", "user", user)
-	c.JSON(http.StatusNoContent, nil)
+	logger.Info("deleted", "user", user)
+	getUsers(w, r)
 }
 
-func getUsers(c *gin.Context) {
-	session := sessions.Default(c)
-	admin := session.Get("admin").(bool)
-	if !admin {
-		getCurrentUser(c)
+func getUsers(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session == nil {
+		processError(w, http.StatusBadRequest, "no session")
+		return
+	}
+	if !session.Admin {
+		getCurrentUser(w, r)
 		return
 	}
 	users, err := database.GetAllUsers()
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	returnedUser := []models.User{}
@@ -238,33 +217,44 @@ func getUsers(c *gin.Context) {
 		user.Password = ""
 		returnedUser = append(returnedUser, user)
 	}
-	c.HTML(http.StatusOK, "user", returnedUser)
+	logger.Info("getusers", "users", returnedUser, "session", session)
+	_ = templates.ExecuteTemplate(w, "user", returnedUser)
+	// c.HTML(http.StatusOK, "user", returnedUser)
 }
 
-func getUser(c *gin.Context) {
-	session := sessions.Default(c)
-	editUser := c.Param("name")
-	if !session.Get("admin").(bool) && editUser != session.Get("user").(string) {
-		processError(c, http.StatusBadRequest, "non-admin cannot edit other users")
+func getUser(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session == nil {
+		processError(w, http.StatusBadRequest, "no session")
+		return
+	}
+	editUser := r.PathValue("name")
+	if !session.Admin && editUser != session.User {
+		processError(w, http.StatusBadRequest, "non-admin cannot edit other users")
 		return
 	}
 	user, err := database.GetUser(editUser)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	c.HTML(http.StatusOK, "editUser", user)
+	editor := models.Editor{User: user, AsAdmin: session.Admin}
+	_ = templates.ExecuteTemplate(w, "editUser", editor)
 }
 
-func getCurrentUser(c *gin.Context) {
-	session := sessions.Default(c)
-	visitor := session.Get("user").(string)
-	user, err := database.GetUser(visitor)
+func getCurrentUser(w http.ResponseWriter, r *http.Request) {
+	session := sessionData(r)
+	if session == nil {
+		processError(w, http.StatusBadRequest, "session data")
+		return
+	}
+	user, err := database.GetUser(session.User)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	c.HTML(http.StatusOK, "editUser", user)
+	editor := models.Editor{User: user, AsAdmin: session.Admin}
+	_ = templates.ExecuteTemplate(w, "editUser", editor)
 }
 
 func hashPassword(password string) (string, error) {