diff --git a/client/app.js b/client/app.js
index a7fa04b..5943c18 100644
--- a/client/app.js
+++ b/client/app.js
@@ -157,7 +157,7 @@ function clickedTab(event) {
 	document.getElementById(`thread${window.threadId}`).tab = event.target.id;
 }
 
-render(document.body, html`
+document.body.append(html.node`
 	<div id='home' class='column'>
 		<div id='threads'>
 			<h3>vybe</h3>
@@ -170,7 +170,7 @@ render(document.body, html`
 		}>${window.name}</div>
 	</div>
 	<div id='profile' class='column hidden'>
-		<strong>authentication requests</strong>
+		<p><strong>authentication requests</strong></p>
 		<div id='authrequests'></div>
 	</div>
 	<hr class='separator' color='#666'>
diff --git a/client/auth.js b/client/auth.js
index 5bd4ce9..d30ac09 100644
--- a/client/auth.js
+++ b/client/auth.js
@@ -27,6 +27,7 @@ async function auth() {
 			let register = document.getElementById('register');
 			if (!msg.success) {
 				console.log('authenticate failed', msg);
+				document.getElementById('result').innerText = msg.message;
 				register.classList.remove('hidden');
 				return;
 			}
diff --git a/client/index.html b/client/index.html
index 4d279c5..cf45490 100644
--- a/client/index.html
+++ b/client/index.html
@@ -90,7 +90,6 @@
 			}
 			.column {
 				flex: 1;
-				overflow: hidden;
 			}
 			.separator {
 				margin: 8px 2px;
@@ -154,10 +153,12 @@
 			#message {
 				display: flex;
 				flex-direction: column;
+				min-height: 0; /* flex makes this auto so it can't shrink */
 			}
 			#messages {
 				margin: 2px;
 				flex-grow: 1;
+				overflow: auto;
 			}
 			#msginput {
 				display: flex;
diff --git a/client/message.js b/client/message.js
index 3ab685a..f07edbc 100644
--- a/client/message.js
+++ b/client/message.js
@@ -18,11 +18,15 @@ let earliestMessage;
 window.socket.on('new_message', message => {
 	if (message.thread !== window.threadId)
 		return;
-	document.getElementById('messages').appendChild(html.node`
+	const messages = document.getElementById('messages');
+	let scroll = messages.scrollHeight - messages.scrollTop <= messages.clientHeight;
+	messages.appendChild(html.node`
 		<div class='message'>
 			<strong>${message.name}: </strong>
 			${message.message}
 		</div>`);
+	if (scroll)
+		messages.scroll(0, messages.scrollHeight - messages.clientHeight);
 	if (!earliestMessage)
 		earliestMessage = message.id;
 });
diff --git a/client/space.js b/client/space.js
index c9b694b..78bfe2a 100644
--- a/client/space.js
+++ b/client/space.js
@@ -76,6 +76,8 @@ function add(s) {
 	};
 	span.onwheel = function(event) {
 		event.preventDefault();
+		if (event.deltaY < 0 && this.scale >= 200)
+			return;
 		this.scale *= 1 - event.deltaY * .001;
 		this.style.transform = `translate(-50%, -50%) scale(${this.scale})`;
 		save(this);
diff --git a/src/event/authenticate.js b/src/event/authenticate.js
index b46fc4f..58ca527 100644
--- a/src/event/authenticate.js
+++ b/src/event/authenticate.js
@@ -29,7 +29,8 @@ const authenticate = async (msg, respond, socket) => {
 				cleartextMessage: msg.message
 			}),
 			verificationKeys: key,
-			expectSigned: true
+			expectSigned: true,
+			date: new Date(Date.now() + 60000 * 4) // slightly in the future to compensate for some system times
 		});
 		const data = verification.data.split(' ');
 		if (data[0] !== 'vybe_auth') {
diff --git a/src/event/get_keys.js b/src/event/get_keys.js
index 7b7e1aa..34b7526 100644
--- a/src/event/get_keys.js
+++ b/src/event/get_keys.js
@@ -15,8 +15,8 @@ const get_keys = async (msg, respond) => {
 			message: "can't iterate user names"
 		});
 	}
-	const keys = await db.query(
-		`select name, pubkey from user where name in
+	const keys = await db.query( // todo: encryption !
+		`select name from user where name in
 			(${msg.names.map((i) => '?').join(',')})`,
 		msg.names
 	);