1 files changed, 5 insertions, 5 deletions

diff --git a/src/sledjchisl/sledjchisl.c b/src/sledjchisl/sledjchisl.c
index 60102f3..d53e5b5 100644
--- a/src/sledjchisl/sledjchisl.c
+++ b/src/sledjchisl/sledjchisl.c
@@ -65,6 +65,7 @@ extern char **environ;
 #include <uuid/uuid.h>
 
 // Toybox's strend overrides another strend that causes MariaDB library to crash.  Renaming it to tb_strend helps.
+// I deal with that by using a sed invokation when building toybox.
 #include "toys.h"
 
 
@@ -226,8 +227,6 @@ size_t qB64_decode(char *str) {
 }
 
 
-
-
 // Duplicate some small amount of code from toys/pending/sh.c
 int runToy(char *argv[])
 {
@@ -462,7 +461,7 @@ qhashtbl_t *mimeTypes;
 
 
 // TODO - log to file.  The problem is we don't know where to log until after we have loaded the configs, and before that we are spewing log messages.
-//          Now that we are using spawn-fcgi, all the logs are going to STDOUT, which we can capture and write to a file.
+//          Now that we are using spawn-fcgi, all the logs are going to STDERR, which we can capture and write to a file.
 //          A better idea, when we spawn tmux or spawn-fcgi, capture STDERR, full log everything to that, filtered log to the tmux console (STDOUT).
 //          Then we can use STDOUT / STDIN to run the console stuff.
 
@@ -728,6 +727,7 @@ char *getSimName(char *sim)
     do
     {
       // TODO - get_line() is slow, and wont help much with DOS and Mac line endings.
+      //        gio_gets() isn't any faster really, but deals with DOS line endings at least.
       temp = get_line(fd);
       if (temp)
       {
@@ -2545,7 +2545,7 @@ HTMLfile *checkHTMLcache(char *file)
 .           Let them do things as normal, in case this was just someone being mean to them, coz their email addy might be public.
 .           Including the usual logging out and in again with their old password.
 .           Warn them on login and any page refresh that there is an outstanding password reset awaiting them.
-        email linky, which is some or all of the token result bits strung together, BASE64 encode the result.
++       email linky, which is some or all of the token result bits strung together, BASE64 encode the result.
 .       regenerate the usual token
 .    user clicks on the linky (or just enters the linky in a field)
 .       validate the linky token.
@@ -4820,7 +4820,7 @@ T("BODY");
         Rd->Rheaders->putstr(Rd->Rheaders, "X-XSS-Protection", "1;mode=block");
         Rd->Rheaders->putstr(Rd->Rheaders, "X-Frame-Options", "SAMEORIGIN");
         Rd->Rheaders->putstr(Rd->Rheaders, "X-Content-Type-Options", "nosniff");
-// Failed experiment.
+// Failed experiment, looks like JavaScript is the only way to change headers for the session ID.
 //      Rd->Rheaders->putstr(Rd->Rheaders, "X-Toke-N-Munchie", "foo, bar");
 
         if ((strcmp("GET", Rd->Method) != 0) && (strcmp("HEAD", Rd->Method) != 0) && (strcmp("POST", Rd->Method) != 0))