diff --git a/readme.md b/readme.md
index 69648a4..a5ec559 100644
--- a/readme.md
+++ b/readme.md
@@ -32,14 +32,15 @@ i've run out of ideas.
 
 ## todo
 
-- account settings page
-- better web design
-- user icons in the account management + settings (gdicon.oat.zone? selfhost?) ideally we find a legal way to do this (i cant distribute the plist+asset files directly) but doing this illegally is always an option
-- use chrono
-- 2.2 friends only unlisted
-- add dailies, events, weekly
-- moderation utilities
-- better song support
-- authentication caching
-- use log instead of println
-- make a proper rank system (reuploading, uploading music, rating, etc.)
\ No newline at end of file
+- User icons in account management pages
+- Account settings page
+- Better web design
+- Use chrono for dates in database, add recent
+- 2.2's friends only unlisted
+- Dailies, weeklies, events(?)
+- Moderation utilities
+- Better song support
+- Cache authentication
+- Panic less
+- Make a proper rank system (reuploading, uploading music, rating, etc.)
+- Swap to a better web framework
\ No newline at end of file
diff --git a/src/helpers/levels.rs b/src/helpers/levels.rs
index acce802..c0f4a79 100644
--- a/src/helpers/levels.rs
+++ b/src/helpers/levels.rs
@@ -195,8 +195,19 @@ pub fn decode(level_data: String) -> Vec<HashMap<String, String>> {
 
     let mut decoder = GzDecoder::new(&decoded_bytes[..]);
 
-    let mut uncompressed_data = String::new();
-    decoder.read_to_string(&mut uncompressed_data).expect("err unzipping level");
+    let uncompressed_data = String::from_utf8(if decoded_bytes.starts_with(&[0x1F, 0x8B]) {
+        // gzip!!
+        let mut decompressed_data = Vec::new();
+        decoder.read_to_end(&mut decompressed_data).expect("err uncompressing level");
+        decompressed_data
+    } else if decoded_bytes.starts_with(&[0x78]) {
+        // zlib!!
+        let mut decompressed_data = Vec::new();
+        decoder.read_to_end(&mut decompressed_data).expect("err uncompressing level");
+        decompressed_data
+    } else {
+        panic!("invalid compression method")
+    }).expect("invalid utf-8 sequence");
 
     return parse(uncompressed_data.as_str())
 }
diff --git a/src/helpers/reupload.rs b/src/helpers/reupload.rs
index 67ffc68..a1a003b 100644
--- a/src/helpers/reupload.rs
+++ b/src/helpers/reupload.rs
@@ -21,8 +21,6 @@ pub fn init() {
             Ok(reupload_acc_id) => {
                 let mut write_lock = REUPLOAD_ACCOUNT_ID.write().expect("poisoned lock!!");
                 *write_lock = reupload_acc_id;
-
-                println!("reupload account found, id: {}", reupload_acc_id);
             },
             Err(_) => {
                 let new_account = NewAccount {
@@ -35,7 +33,7 @@ pub fn init() {
                 let inserted_account = diesel::insert_into(accounts::table)
                     .values(&new_account)
                     .get_result::<Account, >(connection)
-                    .expect("Fatal error saving the new account");
+                    .expect("error saving the new account");
 
                 let reupload_acc_id = inserted_account.id;
 
@@ -48,7 +46,7 @@ pub fn init() {
                 diesel::insert_into(users::table)
                     .values(&new_user)
                     .get_result::<User, >(connection)
-                    .expect("Fatal error saving the new user");
+                    .expect("error saving the new user");
 
                 let mut write_lock = REUPLOAD_ACCOUNT_ID.write().expect("poisoned lock!!");
                 *write_lock = reupload_acc_id;
diff --git a/src/template_endpoints/login.rs b/src/template_endpoints/login.rs
index 227319c..f1f6436 100644
--- a/src/template_endpoints/login.rs
+++ b/src/template_endpoints/login.rs
@@ -38,7 +38,6 @@ pub fn post_login(cookies: &CookieJar<'_>, input: Form<FormLogin>) -> Template {
                         "blackmail_data", 
                         format!("{}:{}:{}", account_id_username_val.1, account_id_user_id_val.0, account_id_user_id_val.1))
                         .path("/")
-                        // should probably make this true when we get into production
                         .secure(false)
                         .http_only(true)
                         .max_age(Duration::days(365))