@@ -56,7 +56,7 @@ }
 	return false
 }
 
-var debugClient = &http.Client{
+var develClient = &http.Client{
 	Transport: &http.Transport{
 		TLSClientConfig: &tls.Config{
 			InsecureSkipVerify: true,
@@ -70,8 +70,8 @@ }
 
 func PostMsg(keyname string, key httpsig.PrivateKey, url string, msg []byte) error {
 	client := http.DefaultClient
-	if debugMode {
-		client = debugClient
+	if develMode {
+		client = develClient
 	}
 	req, err := http.NewRequest("POST", url, bytes.NewReader(msg))
 	if err != nil {
@@ -129,8 +129,8 @@ var flightdeck = gate.NewSerializer()
 
 func GetJunkTimeout(url string, timeout time.Duration) (junk.Junk, error) {
 	client := http.DefaultClient
-	if debugMode {
-		client = debugClient
+	if develMode {
+		client = develClient
 	}
 	fn := func() (interface{}, error) {
 		at := thefakename
@@ -156,8 +156,8 @@ }
 
 func fetchsome(url string) ([]byte, error) {
 	client := http.DefaultClient
-	if debugMode {
-		client = debugClient
+	if develMode {
+		client = develClient
 	}
 	req, err := http.NewRequest("GET", url, nil)
 	if err != nil {

@@ -37,7 +37,7 @@ var words []string
 	for _, l := range strings.Split(wonkles, "\n") {
 		words = append(words, l)
 	}
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=7776000")
 	}
 

@@ -174,10 +174,9 @@ Be mindful of what other services may be exposed via localhost or the
 local network.
 .Ss Debug
 Debug mode may be enabled or disabled by running
-.Ic debug Ar on|off .
-In debug mode, secure cookies are disabled and templates are reloaded
-every request.
-Debug mode is really more useful for development, not debugging production.
+.Ic devel Ar on|off .
+In devel mode, secure cookies are disabled, TLS certs are not verified,
+and templates are reloaded every request.
 .Ss Import
 Data may be imported and converted from other services using the
 .Ic import

@@ -10,5 +10,5 @@ golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897
 	golang.org/x/image v0.0.0-20200927104501-e162460cd6b5 // indirect
 	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
 	humungus.tedunangst.com/r/go-sqlite3 v1.1.3
-	humungus.tedunangst.com/r/webs v0.6.49
+	humungus.tedunangst.com/r/webs v0.6.50
 )

@@ -24,5 +24,5 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 humungus.tedunangst.com/r/go-sqlite3 v1.1.3 h1:G2N4wzDS0NbuvrZtQJhh4F+3X+s7BF8b9ga8k38geUI=
 humungus.tedunangst.com/r/go-sqlite3 v1.1.3/go.mod h1:FtEEmQM7U2Ey1TuEEOyY1BmphTZnmiEjPsNLEAkpf/M=
-humungus.tedunangst.com/r/webs v0.6.49 h1:Tv3Fx2xnv+TINW5gepCpaDP+xhkOWlWp3rYE9FAkP50=
-humungus.tedunangst.com/r/webs v0.6.49/go.mod h1:S9sXpVSbgAIa24yYhnMN0C94LKHG+2rioS+NsiDimps=
+humungus.tedunangst.com/r/webs v0.6.50 h1:MScU6TwnaluLUuyveARr43iXJkv2xeyAWBKea+5tnLA=
+humungus.tedunangst.com/r/webs v0.6.50/go.mod h1:S9sXpVSbgAIa24yYhnMN0C94LKHG+2rioS+NsiDimps=

@@ -318,7 +318,7 @@ }
 	serverPrefix = fmt.Sprintf("https://%s/", serverName)
 	getconfig("usersep", &userSep)
 	getconfig("honksep", &honkSep)
-	getconfig("debug", &debugMode)
+	getconfig("devel", &develMode)
 	prepareStatements(db)
 	switch cmd {
 	case "admin":
@@ -328,15 +328,15 @@ if len(args) != 4 {
 			elog.Fatal("import username mastodon|twitter srcdir")
 		}
 		importMain(args[1], args[2], args[3])
-	case "debug":
+	case "devel":
 		if len(args) != 2 {
-			elog.Fatal("need an argument: debug (on|off)")
+			elog.Fatal("need an argument: devel (on|off)")
 		}
 		switch args[1] {
 		case "on":
-			setconfig("debug", 1)
+			setconfig("devel", 1)
 		case "off":
-			setconfig("debug", 0)
+			setconfig("devel", 0)
 		default:
 			elog.Fatal("argument must be on or off")
 		}

@@ -67,9 +67,9 @@ if s == "" {
 			setconfig("loginmsg", "<h2>login</h2>")
 		}
 		d := -1
-		getconfig("debug", &d)
+		getconfig("devel", &d)
 		if d == -1 {
-			setconfig("debug", 0)
+			setconfig("devel", 0)
 		}
 		doordie(db, "update config set value = 27 where key = 'dbversion'")
 		fallthrough

@@ -158,7 +158,7 @@
 	setconfig("servermsg", "<h2>Things happen.</h2>")
 	setconfig("aboutmsg", "<h3>What is honk?</h3><p>Honk is amazing!")
 	setconfig("loginmsg", "<h2>login</h2>")
-	setconfig("debug", 0)
+	setconfig("devel", 0)
 
 	db.Close()
 	fmt.Printf("done.\n")

@@ -47,7 +47,7 @@
 var userSep = "u"
 var honkSep = "h"
 
-var debugMode = false
+var develMode = false
 
 func getuserstyle(u *login.UserInfo) template.CSS {
 	if u == nil {
@@ -235,7 +235,7 @@ if honk.Date.After(modtime) {
 			modtime = honk.Date
 		}
 	}
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=300")
 		w.Header().Set("Last-Modified", modtime.Format(http.TimeFormat))
 	}
@@ -862,7 +862,7 @@ }
 	sort.Slice(onts, func(i, j int) bool {
 		return onts[i].Name < onts[j].Name
 	})
-	if u == nil && !debugMode {
+	if u == nil && !develMode {
 		w.Header().Set("Cache-Control", "max-age=300")
 	}
 	templinfo := getInfo(r)
@@ -1085,7 +1085,7 @@ } else {
 			templinfo["TopHID"] = 0
 		}
 	}
-	if u == nil && !debugMode {
+	if u == nil && !develMode {
 		w.Header().Set("Cache-Control", "max-age=60")
 	}
 	err := readviews.Execute(w, "honkpage.html", templinfo)
@@ -2125,20 +2125,20 @@ return fmt.Sprintf("%d", secs)
 }
 
 func avatate(w http.ResponseWriter, r *http.Request) {
-	if debugMode {
+	if develMode {
 		loadAvatarColors()
 	}
 	n := r.FormValue("a")
 	hex := r.FormValue("hex") == "1"
 	a := genAvatar(n, hex)
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age="+somedays())
 	}
 	w.Write(a)
 }
 
 func serveasset(w http.ResponseWriter, r *http.Request) {
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=7776000")
 	}
 	dir := viewDir
@@ -2149,7 +2149,7 @@ http.ServeFile(w, r, dir+"/views"+r.URL.Path)
 }
 func servehelp(w http.ResponseWriter, r *http.Request) {
 	name := mux.Vars(r)["name"]
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=3600")
 	}
 	http.ServeFile(w, r, viewDir+"/docs/"+name)
@@ -2163,7 +2163,7 @@ templinfo["HonkVersion"] = softwareVersion
 	if r.URL.Path == "/about" {
 		templinfo["Sensors"] = getSensors()
 	}
-	if u == nil && !debugMode {
+	if u == nil && !develMode {
 		w.Header().Set("Cache-Control", "max-age=60")
 	}
 	err := readviews.Execute(w, r.URL.Path[1:]+".html", templinfo)
@@ -2433,7 +2433,7 @@ }
 
 func serve() {
 	db := opendatabase()
-	login.Init(login.InitArgs{Db: db, Logger: ilog})
+	login.Init(login.InitArgs{Db: db, Logger: ilog, Insecure: develMode})
 
 	listener, err := openListener()
 	if err != nil {
@@ -2447,7 +2447,7 @@ go bgmonitor()
 	loadLingo()
 	w100 := wait100ms()
 
-	readviews = templates.Load(debugMode,
+	readviews = templates.Load(develMode,
 		viewDir+"/views/honkpage.html",
 		viewDir+"/views/honkfrags.html",
 		viewDir+"/views/honkers.html",
@@ -2466,7 +2466,7 @@ viewDir+"/views/header.html",
 		viewDir+"/views/onts.html",
 		viewDir+"/views/honkpage.js",
 	)
-	if !debugMode {
+	if !develMode {
 		assets := []string{viewDir + "/views/style.css", dataDir + "/views/local.css", viewDir + "/views/honkpage.js"}
 		for _, s := range assets {
 			savedassetparams[s] = getassetparam(s)