diff --git a/apps/cory/admin.json b/apps/cory/admin.json
index 4daf78b7..89cfd1a2 100644
--- a/apps/cory/admin.json
+++ b/apps/cory/admin.json
@@ -1 +1 @@
-{"type":"tildefriends-app","files":{"app.js":"&xotWQ8M3xgnWAPM/1TdrLmkcCyxGPiXqg9CsBm2ngcc=.sha256","index.html":"&PrdNng+/SYCFSEbx+E7tMKxs4/ypPDxbRlak4tGN/SM=.sha256","lit.min.js":"&3FfrVflmGr0n4lvN0GriN1Qz1lEw31SbZxRSJrcXR28=.sha256","script.js":"&hW7AyNMgC+paQBFDcggxmhwNWmEY+5HofubRalcz6u8=.sha256"}}
\ No newline at end of file
+{"type":"tildefriends-app","files":{"app.js":"&NhFznWHPiG2TKpaGK+DrqzCr67trV3wYgDS+xwZml+Q=.sha256","index.html":"&PrdNng+/SYCFSEbx+E7tMKxs4/ypPDxbRlak4tGN/SM=.sha256","lit.min.js":"&3FfrVflmGr0n4lvN0GriN1Qz1lEw31SbZxRSJrcXR28=.sha256","script.js":"&hgxmXRvzwz27iH2BATFq20aLX4rtvL/AI/5QJV487XM=.sha256"}}
\ No newline at end of file
diff --git a/apps/cory/admin/app.js b/apps/cory/admin/app.js
index 8a6d4a64..9e532249 100644
--- a/apps/cory/admin/app.js
+++ b/apps/cory/admin/app.js
@@ -5,9 +5,10 @@ tfrpc.register(function delete_user(user) {
 });
 
 async function main() {
-	let data = {
-		users: await core.users(),
-	};
+	let data = {users: {}};
+	for (let user of await core.users()) {
+		data.users[user] = await core.permissionsForUser(user);
+	}
 	await app.setDocument(utf8Decode(getFile('index.html')).replace('$data', JSON.stringify(data)));
 }
 main();
\ No newline at end of file
diff --git a/apps/cory/admin/script.js b/apps/cory/admin/script.js
index 8f0a9181..50ff5a52 100644
--- a/apps/cory/admin/script.js
+++ b/apps/cory/admin/script.js
@@ -12,10 +12,20 @@ function delete_user(user) {
 }
 
 window.addEventListener('load', function() {
-	const user_template = (user) => html`<li><button @click=${(e) => delete_user(user)}>Delete</button> ${user}</li>`;
+	const permission_template = (permission) =>
+		html` <code>${permission}</code>`;
+	const user_template = (user, permissions) => html`
+		<li>
+			<button @click=${(e) => delete_user(user)}>
+				Delete
+			</button>
+			${user}:
+			${permissions.map(x => permission_template(x))}
+		</li>
+	`;
 	const users_template = (users) =>
 		html`<ul>
-			${users.map(u => user_template(u))}
+			${users.map(u => user_template(u[0], u[1]))}
 		</ul>`;
-	render(users_template(g_data.users), document.body);
+	render(users_template(Object.entries(g_data.users)), document.body);
 });
\ No newline at end of file
diff --git a/apps/cory/ssb.json b/apps/cory/ssb.json
index 8036bba7..17e296e0 100644
--- a/apps/cory/ssb.json
+++ b/apps/cory/ssb.json
@@ -1 +1 @@
-{"type":"tildefriends-app","files":{"app.js":"&bblne6t8jCLxRO/NJ9LhacmC/mjvx69xAyGsOVAOteI=.sha256","index.html":"&SFYAxbNRcpB1WU6vH8sL7oYzHsumyErk5mfN+UGU0Ck=.sha256","vue-material.js":"&K5cdLqXYCENPak/TCINHQhyJhpS4G9DlZHGwoh/LF2g=.sha256","tf-user.js":"&kQhf+sq/eFsfa7jHPhw7trycL02fZ0YAKfX46tiqwNs=.sha256","tf-message.js":"&uMXQxfJ3eeVE6Ta2LMAvb0XA1KztMTD4pApYnfBc1Nc=.sha256","tf.js":"&9e2q6GPmU2PC4K+/+Qc6mOskPE5/SH73g3Vj7SaRfE0=.sha256","commonmark.min.js":"&EP0OeR9zyLwZannz+0ga4s9AGES2RLvvIIQYHqqV6+k=.sha256","vue.js":"&g1wvA+yHl1sVC+eufTsg9If7ZeVyMTBU+h0tks7ZNzE=.sha256","vue-material-theme-default-dark.css":"&RP2nr+2CR18BpHHw5ST9a5GJUCOG9n0G2kuGkcQioWE=.sha256","vue-material.min.css":"&kGbUM2QgFSyHZRzqQb0b+0S3EVIlZ0AXpdiAVjIhou8=.sha256","roboto.css":"&jJv43Om673mQO5JK0jj7714s5E+5Yrf82H6LcDx7wUs=.sha256","material-icons.css":"&a28PdcVvgq/DxyIvJAx/e+ZOEtOuHnr3kjLWKyzH11M=.sha256","tf-shared.js":"&MPINm55jkpz2rrNbwsYl09PKGvbgL3nwgBy6CMQkSnw=.sha256","style.css":"&qegBNCrVUihxffRUxGFuG/6u+0Y6d18zHtfNHBZtZ04=.sha256"}}
\ No newline at end of file
+{"type":"tildefriends-app","files":{"app.js":"&W/og3+Bmi2YJJ9PudClLLIhK5ZgplUMpsOowSF5o05s=.sha256","index.html":"&ye2GeqCrDi3Dbl3UVIfE8H5GzCxN8O46FWj5zhLnZAw=.sha256","vue-material.js":"&K5cdLqXYCENPak/TCINHQhyJhpS4G9DlZHGwoh/LF2g=.sha256","tf-user.js":"&cI/JLy83mOngcqYCEP8Vej8urDvAQAV1WxFsL67/K3M=.sha256","tf-message.js":"&JVARtJEQkq3XjjL0Jv/NUDkO2WZnXGIqkWsqYvTPXBI=.sha256","tf.js":"&m6it9k3I6Ou1xhckbtoMlAg9Y1tca5HV9GUmuFqPD7k=.sha256","commonmark.min.js":"&EP0OeR9zyLwZannz+0ga4s9AGES2RLvvIIQYHqqV6+k=.sha256","vue.js":"&g1wvA+yHl1sVC+eufTsg9If7ZeVyMTBU+h0tks7ZNzE=.sha256","vue-material-theme-default-dark.css":"&RP2nr+2CR18BpHHw5ST9a5GJUCOG9n0G2kuGkcQioWE=.sha256","vue-material.min.css":"&kGbUM2QgFSyHZRzqQb0b+0S3EVIlZ0AXpdiAVjIhou8=.sha256","roboto.css":"&jJv43Om673mQO5JK0jj7714s5E+5Yrf82H6LcDx7wUs=.sha256","material-icons.css":"&a28PdcVvgq/DxyIvJAx/e+ZOEtOuHnr3kjLWKyzH11M=.sha256","tf-shared.js":"&LXyUSm6zSakN/ghJlZ1Qg2VJfV5alhN0gl8F7txIIOU=.sha256","style.css":"&qegBNCrVUihxffRUxGFuG/6u+0Y6d18zHtfNHBZtZ04=.sha256"}}
\ No newline at end of file
diff --git a/apps/cory/ssb/app.js b/apps/cory/ssb/app.js
index 2af7633f..d70b39ed 100644
--- a/apps/cory/ssb/app.js
+++ b/apps/cory/ssb/app.js
@@ -396,9 +396,10 @@ async function getPosts(db, ids) {
 
 tfrpc.register(async function ready() {
 	let identities = await ssb.getIdentities();
+	let whoami = await app.localStorageGet('whoami');
 	await tfrpc.rpc.set_identities(identities);
 	g_ready = true;
-	refresh_internal(g_whoami, g_selected, true);
+	refresh_internal(whoami, g_selected, true);
 });
 
 tfrpc.register(async function store_blob(blob) {
@@ -442,11 +443,10 @@ async function updateSequences(db) {
 }
 
 async function refresh_internal(whoami, selected, force) {
-	if (!g_ready) {
-		return;
-	}
-	let hash = selected || undefined;
 	if (whoami !== g_whoami || selected !== g_selected || force) {
+		if (g_whoami !== whoami && whoami) {
+			await app.localStorageSet('whoami', whoami);
+		}
 		g_whoami = whoami;
 		g_selected = selected;
 	} else {
@@ -455,12 +455,16 @@ async function refresh_internal(whoami, selected, force) {
 	if (typeof(whoami) !== 'string') {
 		return;
 	}
+	if (!g_ready) {
+		return;
+	}
 	var timing = [];
 	timing.push({name: 'start', time: new Date()});
 	g_following_cache = {};
 	g_following_deep_cache = {};
 	await tfrpc.rpc.clear();
 	await tfrpc.rpc.set_identities(await ssb.getIdentities());
+	await tfrpc.rpc.set('selected', selected);
 	var db = await database("ssb");
 	g_sequence = {};
 	try {
@@ -598,13 +602,8 @@ core.register('message', async function(m) {
 		}
 	} else if (m.event == 'hashChange') {
 		let hash = m.hash.length  > 1 ? m.hash.substring(1) : null;
-		if (hash) {
-			let parts = hash.split(':');
-			let changed = g_whoami !== parts[0] || g_selected !== parts[1];
-			g_whoami = parts[0];
-			g_selected = parts[1];
-			await refresh_internal(g_whoami, g_selected, changed);
-		}
+		let changed = g_selected !== hash;
+		await refresh_internal(g_whoami, hash, changed);
 	} else if (m.event == 'focus' || m.event == 'blur') {
 		/* Shh. */
 	} else {
diff --git a/apps/cory/ssb/index.html b/apps/cory/ssb/index.html
index 1503ec72..a11b34e9 100644
--- a/apps/cory/ssb/index.html
+++ b/apps/cory/ssb/index.html
@@ -110,7 +110,7 @@
 								</md-card-actions>
 							</md-card>
 
-							<md-button v-if="selected?.length" class="md-raised md-primary" style="margin: 1em" @click="selected = null">
+							<md-button v-if="selected !== undefined" class="md-raised md-primary" style="margin: 1em" @click="selected = null">
 								<md-icon>home</md-icon> Home
 							</md-button>
 
diff --git a/apps/cory/ssb/tf-message.js b/apps/cory/ssb/tf-message.js
index 190d9ed8..b1da6fe8 100644
--- a/apps/cory/ssb/tf-message.js
+++ b/apps/cory/ssb/tf-message.js
@@ -67,7 +67,7 @@ Vue.component('tf-message', {
 		show_message: function() {
 			window.parent.postMessage({
 				action: 'setHash',
-				hash: tf.g_data.whoami + ':' + this.message.id,
+				hash: this.message.id,
 			}, '*');
 		},
 		expand_image: function(event) {
@@ -89,7 +89,12 @@ Vue.component('tf-message', {
 			img.style.objectFit = 'contain';
 			img.style.width = '100%';
 			div.appendChild(img);
-			div.onclick = function() { document.body.removeChild(div); };
+			function image_close(event) {
+				document.body.removeChild(div);
+				window.removeEventListener('keydown', image_close);
+			}
+			div.onclick = image_close;
+			window.addEventListener('keydown', image_close);
 			document.body.appendChild(div);
 		},
 	},
diff --git a/apps/cory/ssb/tf-shared.js b/apps/cory/ssb/tf-shared.js
index 887d3658..efcdc699 100644
--- a/apps/cory/ssb/tf-shared.js
+++ b/apps/cory/ssb/tf-shared.js
@@ -1,3 +1,5 @@
+import * as tf from './tf.js';
+
 export function markdown(md) {
 	var reader = new commonmark.Parser({safe: true});
 	var writer = new commonmark.HtmlRenderer();
diff --git a/apps/cory/ssb/tf-user.js b/apps/cory/ssb/tf-user.js
index b5be364c..13d09dff 100644
--- a/apps/cory/ssb/tf-user.js
+++ b/apps/cory/ssb/tf-user.js
@@ -15,12 +15,12 @@ Vue.component('tf-user', {
 		show_user: function() {
 			window.parent.postMessage({
 				action: 'setHash',
-				hash: tf.g_data.whoami + ':' + this.id,
+				hash: this.id,
 			}, '*');
 		},
 	},
 	template: `<md-chip :class="following ? 'md-accent' : ''">
-					<a :href="'#' + whoami + ':' + id" style="color: #fff">{{users[id] && users[id].name ? users[id].name : id}}</a>
+					<a :href="'#' + id" style="color: #fff">{{users[id] && users[id].name ? users[id].name : id}}</a>
 					<md-tooltip v-if="users[id] && users[id].name">{{id}}</md-tooltip>
 				</md-chip>`,
 });
\ No newline at end of file
diff --git a/apps/cory/ssb/tf.js b/apps/cory/ssb/tf.js
index 04484464..e6d32bfc 100644
--- a/apps/cory/ssb/tf.js
+++ b/apps/cory/ssb/tf.js
@@ -262,9 +262,7 @@ window.addEventListener('load', function() {
 				}
 			},
 			set_hash() {
-				let hash = this.whoami && this.selected ?
-						this.whoami + ':' + this.selected :
-						(this.whoami ? this.whoami : '#');
+				let hash = this.selected ?? '#';
 				window.parent.postMessage({
 					action: 'setHash',
 					hash: hash,