diff --git a/cgi.d b/cgi.d
index 470e7c0..600b7db 100644
--- a/cgi.d
+++ b/cgi.d
@@ -45,7 +45,7 @@ int locationOf(T)(T[] data, string item) {
 /// If you are doing a custom cgi class, mixing this in can take care of
 /// the required constructors for you
 mixin template ForwardCgiConstructors() {
-	this(int maxContentLength = 5_000_000,
+	this(long maxContentLength = 5_000_000,
 		string[string] env = null,
 		const(ubyte)[] delegate() readdata = null,
 		void delegate(const(ubyte)[]) _rawDataOutput = null
@@ -136,7 +136,7 @@ class Cgi {
 		CommandLine }
 
 	/** Initializes it using the CGI (or FastCGI) interface */
-	this(int maxContentLength = 5_000_000,
+	this(long maxContentLength = 5_000_000,
 		// use this to override the environment variable listing
 		in string[string] env = null,
 		// and this should return a chunk of data. return empty when done
@@ -251,7 +251,7 @@ class Cgi {
 			// to be slow if they did that. The spec says it is always there though.
 			// And it has worked reliably for me all year in the live environment,
 			// but some servers might be different.
-			auto  contentLength = to!size_t(getenv("CONTENT_LENGTH"));
+			auto contentLength = to!size_t(getenv("CONTENT_LENGTH"));
 
 			immutable originalContentLength = contentLength;
 			if(contentLength) {
@@ -652,6 +652,8 @@ class Cgi {
 							// Starting small because exiting the loop early is desirable, since
 							// we're not keeping any ambiguity and 1 / 256 chance of exiting is
 							// the best we can do.
+							if(a > pps.buffer.length)
+								break; // FIXME: is this right?
 							assert(a <= pps.buffer.length);
 							assert(a > 0);
 							if(std.algorithm.endsWith(pps.buffer, pps.localBoundary[0 .. a])) {
@@ -1777,8 +1779,7 @@ string getTempDirectory() {
 // And to add insult to injury, they are going to remove the tiny olive branch the new
 // module offered. Whatever, I want it at least some of it.
 
-long sysTimeToDTime(in SysTime sysTime)
-{
+long sysTimeToDTime(in SysTime sysTime) {
     return convert!("hnsecs", "msecs")(sysTime.stdTime - 621355968000000000L);
 }
 
@@ -1787,11 +1788,11 @@ long getUtcTime() { // renamed primarily to avoid conflict with std.date itself
 }
 
 /*
-Copyright: Adam D. Ruppe, 2008 - 2011
+Copyright: Adam D. Ruppe, 2008 - 2012
 License:   <a href="http://www.boost.org/LICENSE_1_0.txt">Boost License 1.0</a>.
 Authors: Adam D. Ruppe
 
-	Copyright Adam D. Ruppe 2008 - 2011.
+	Copyright Adam D. Ruppe 2008 - 2012.
 Distributed under the Boost Software License, Version 1.0.
    (See accompanying file LICENSE_1_0.txt or copy at
 	http://www.boost.org/LICENSE_1_0.txt)
diff --git a/color.d b/color.d
index 19e2f41..11c5e3f 100644
--- a/color.d
+++ b/color.d
@@ -147,12 +147,65 @@ Color darken(Color c, real percentage) {
 	return fromHsl(hsl);
 }
 
+/// for light colors, call darken. for dark colors, call lighten.
+/// The goal: get toward center grey.
+Color moderate(Color c, real percentage) {
+	auto hsl = toHsl(c);
+	if(hsl[2] > 0.5)
+		hsl[2] *= (1 - percentage);
+	else
+		hsl[2] *= (1 + percentage);
+	if(hsl[2] > 1)
+		hsl[2] = 1;
+	return fromHsl(hsl);
+}
+
+/// the opposite of moderate. Make darks darker and lights lighter
+Color extremify(Color c, real percentage) {
+	auto hsl = toHsl(c);
+	if(hsl[2] < 0.5)
+		hsl[2] *= (1 - percentage);
+	else
+		hsl[2] *= (1 + percentage);
+	if(hsl[2] > 1)
+		hsl[2] = 1;
+	return fromHsl(hsl);
+}
+
+/// Move around the lightness wheel, trying not to break on moderate things
+Color oppositeLightness(Color c) {
+	auto hsl = toHsl(c);
+
+	auto original = hsl[2];
+
+	if(original > 0.4 && original < 0.6)
+		hsl[2] = 0.8 - original; // so it isn't quite the same
+	else
+		hsl[2] = 1 - original;
+
+	return fromHsl(hsl);
+}
+
+Color setLightness(Color c, real lightness) {
+	auto hsl = toHsl(c);
+	hsl[2] = lightness;
+	return fromHsl(hsl);
+}
+
+
+
 Color rotateHue(Color c, real degrees) {
 	auto hsl = toHsl(c);
 	hsl[0] += degrees;
 	return fromHsl(hsl);
 }
 
+Color setHue(Color c, real hue) {
+	auto hsl = toHsl(c);
+	hsl[0] = hue;
+	return fromHsl(hsl);
+}
+
 Color desaturate(Color c, real percentage) {
 	auto hsl = toHsl(c);
 	hsl[1] *= (1 - percentage);
@@ -167,6 +220,13 @@ Color saturate(Color c, real percentage) {
 	return fromHsl(hsl);
 }
 
+Color setSaturation(Color c, real saturation) {
+	auto hsl = toHsl(c);
+	hsl[1] = saturation;
+	return fromHsl(hsl);
+}
+
+
 /*
 void main(string[] args) {
 	auto color1 = toHsl(Color(255, 0, 0));
diff --git a/dom.d b/dom.d
index 7b41250..dd156a1 100644
--- a/dom.d
+++ b/dom.d
@@ -3,6 +3,13 @@ module arsd.dom;
 // NOTE: do *NOT* override toString on Element subclasses. It won't work.
 // Instead, override writeToAppender();
 
+// FIXME: should I keep processing instructions like <?blah ?> and <!-- blah --> (comments too lol)? I *want* them stripped out of most my output, but I want to be able to parse and create them too.
+
+// Stripping them is useful for reading php as html.... but adding them
+// is good for building php.
+
+// I need to maintain compatibility with the way it is now too.
+
 import arsd.characterencodings;
 
 import std.string;
@@ -239,8 +246,9 @@ class Element {
 	///.
 	@property Element cloned()
 		out(ret) {
-			assert(ret.children.length == this.children.length);
-			assert(ret.tagName == this.tagName);
+			// FIXME: not sure why these fail...
+//			assert(ret.children.length == this.children.length);
+//			assert(ret.tagName == this.tagName);
 		}
 	body {
 		auto e = new Element(parentDocument, tagName, attributes.dup, selfClosed);
@@ -449,6 +457,11 @@ class Element {
 					if(childInfo2 !is null)
 						e.alt = childInfo2;
 				break;
+				case "link":
+					e.href = childInfo;
+					if(childInfo2 !is null)
+						e.rel = childInfo2;
+				break;
 				case "option":
 					e.innerText = childInfo;
 					if(childInfo2 !is null)
@@ -678,6 +691,12 @@ class Element {
 		return ret;
 	}
 
+	/// .
+	Element[] getElementsByClassName(string cn) {
+		// is this correct?
+		return getElementsBySelector("." ~ cn);
+	}
+
 	///.
 	Element[] getElementsByTagName(string tag) {
 		if(parentDocument && parentDocument.loose)
@@ -1956,6 +1975,13 @@ class Form : Element {
 		}
 	}
 
+	/// This takes an array of strings and adds hidden <input> elements for each one of them. Unlike setValue,
+	/// it makes no attempt to find and modify existing elements in the form to the new values.
+	void addValueArray(string key, string[] arrayOfValues) {
+		foreach(arr; arrayOfValues)
+			addChild("input", key, arr);
+	}
+
 	/// Gets the value of the field; what would be given if it submitted right now. (so
 	/// it handles select boxes and radio buttons too). For checkboxes, if a value isn't
 	/// given, but it is checked, it returns "checked", since null and "" are indistinguishable
@@ -2092,8 +2118,11 @@ class Table : Element {
 
 	///.
 	Element th(T)(T t) {
-		assert(parentDocument !is null);
-		Element e = parentDocument.createElement("th");
+		Element e;
+		if(parentDocument !is null)
+			e = parentDocument.createElement("th");
+		else
+			e = Element.make("th");
 		static if(is(T == Html))
 			e.innerHTML = t;
 		else
@@ -2103,8 +2132,11 @@ class Table : Element {
 
 	///.
 	Element td(T)(T t) {
-		assert(parentDocument !is null);
-		Element e = parentDocument.createElement("td");
+		Element e;
+		if(parentDocument !is null)
+			e = parentDocument.createElement("td");
+		else
+			e = Element.make("td");
 		static if(is(T == Html))
 			e.innerHTML = t;
 		else
@@ -2114,27 +2146,25 @@ class Table : Element {
 
 	///.
 	Element appendRow(T...)(T t) {
-		assert(parentDocument !is null);
-
-		Element row = parentDocument.createElement("tr");
+		Element row = Element.make("tr");
 
 		foreach(e; t) {
 			static if(is(typeof(e) : Element)) {
 				if(e.tagName == "td" || e.tagName == "th")
 					row.appendChild(e);
 				else {
-					Element a = parentDocument.createElement("td");
+					Element a = Element.make("td");
 
 					a.appendChild(e);
 
 					row.appendChild(a);
 				}
 			} else static if(is(typeof(e) == Html)) {
-				Element a = parentDocument.createElement("td");
+				Element a = Element.make("td");
 				a.innerHTML = e.source;
 				row.appendChild(a);
 			} else {
-				Element a = parentDocument.createElement("td");
+				Element a = Element.make("td");
 				a.innerText = to!string(e);
 				row.appendChild(a);
 			}
@@ -2164,7 +2194,7 @@ class Table : Element {
 		}
 
 		if(cap is null) {
-			cap = parentDocument.createElement("caption");
+			cap = Element.make("caption");
 			appendChild(cap);
 		}
 
@@ -2353,6 +2383,9 @@ struct Html {
 }
 
 
+/// This might belong in another module, but it represents a file with a mime type and some data.
+/// Document implements this interface with type = text/html (see Document.contentType for more info)
+/// and data = document.toString, so you can return Documents anywhere web.d expects FileResources.
 interface FileResource {
 	string contentType() const;
 	immutable(ubyte)[] getData() const;
@@ -2373,6 +2406,23 @@ class Document : FileResource {
 
 	}
 
+	/// This is just something I'm toying with. Right now, you use opIndex to put in css selectors.
+	/// It returns a struct that forwards calls to all elements it holds, and returns itself so you
+	/// can chain it.
+	///
+	/// Example: document["p"].innerText("hello").addClass("modified");
+	///
+	/// Equivalent to: foreach(e; document.getElementsBySelector("p")) { e.innerText("hello"); e.addClas("modified"); }
+	///
+	/// Note: always use function calls (not property syntax) and don't use toString in there for best results.
+	///
+	/// You can also do things like: document["p"]["b"] though tbh I'm not sure why since the selector string can do all that anyway. Maybe
+	/// you could put in some kind of custom filter function tho.
+	ElementCollection opIndex(string selector) {
+		auto e = ElementCollection(this.root);
+		return e[selector];
+	}
+
 	string _contentType = "text/html; charset=utf-8";
 
 	/// If you're using this for some other kind of XML, you can
@@ -2382,7 +2432,7 @@ class Document : FileResource {
 	/// It is only used if the document is sent via a protocol like HTTP.
 	///
 	/// This may be called by parse() if it recognizes the data. Otherwise,
-	/// if you don't set it, it assumes text/html.
+	/// if you don't set it, it assumes text/html; charset=utf-8.
 	string contentType(string mimeType) {
 		_contentType = mimeType;
 		return _contentType;
@@ -2510,13 +2560,32 @@ class Document : FileResource {
 
 		string data;
 
+		if(!strict) {
+			// if we're in non-strict mode, we need to check
+			// the document for mislabeling too; sometimes
+			// web documents will say they are utf-8, but aren't
+			// actually properly encoded. If it fails to validate,
+			// we'll assume it's actually Windows encoding - the most
+			// likely candidate for mislabeled garbage.
+			dataEncoding = dataEncoding.toLower();
+			dataEncoding = dataEncoding.replace(" ", "");
+			dataEncoding = dataEncoding.replace("-", "");
+			dataEncoding = dataEncoding.replace("_", "");
+			if(dataEncoding == "utf8") {
+				try {
+					validate(rawdata);
+				} catch(UtfException e) {
+					dataEncoding = "Windows 1252";
+				}
+			}
+		}
+
 		if(dataEncoding != "UTF-8")
 			data = convertToUtf8(cast(immutable(ubyte)[]) rawdata, dataEncoding);
 		else
 			data = rawdata;
 		assert(data !is null);
 
-
 		// go through character by character.
 		// if you see a <, consider it a tag.
 		// name goes until the first non tagname character
@@ -2640,7 +2709,7 @@ class Document : FileResource {
 		}
 		// recursively read a tag
 		Ele readElement(string[] parentChain = null) {
-			// FIXME: this is the closest function in this module, by far, even in strict mode.
+			// FIXME: this is the slowest function in this module, by far, even in strict mode.
 			// Loose mode should perform decently, but strict mode is the important one.
 			if(!strict && parentChain is null)
 				parentChain = [];
@@ -2765,15 +2834,17 @@ class Document : FileResource {
 
 						// HACK to handle script and style as a raw data section as it is in HTML browsers
 						if(tagName == "script" || tagName == "style") {
-							string closer = "</" ~ tagName ~ ">";
-							auto ending = indexOf(data[pos..$], closer);
-							if(loose && ending == -1)
-								ending = indexOf(data[pos..$], closer.toUpper);
-							if(ending == -1)
-								throw new Exception("tag " ~ tagName ~ " never closed");
-							ending += pos;
-							e.innerRawSource = data[pos..ending];
-							pos = ending + closer.length;
+							if(!selfClosed) {
+								string closer = "</" ~ tagName ~ ">";
+								auto ending = indexOf(data[pos..$], closer);
+								if(loose && ending == -1)
+									ending = indexOf(data[pos..$], closer.toUpper);
+								if(ending == -1)
+									throw new Exception("tag " ~ tagName ~ " never closed");
+								ending += pos;
+								e.innerRawSource = data[pos..ending];
+								pos = ending + closer.length;
+							}
 							return Ele(0, e, null);
 						}
 
@@ -3173,6 +3244,11 @@ int intFromHex(string hex) {
 // dt << dl  means go as far up as needed to find a dl (you have an element and want its containers)      NOT IMPLEMENTED
 // :first  means to stop at the first hit, don't do more (so p + p == p ~ p:first
 
+
+
+// CSS4 draft currently says you can change the subject (the element actually returned) by putting a ! at the end of it.
+// That might be useful to implement, though I do have parent selectors too.
+
 		///.
 		static immutable string[] selectorTokens = [
 			// It is important that the 2 character possibilities go first here for accurate lexing
@@ -4282,6 +4358,41 @@ private string[string] dup(in string[string] arr) {
 	return ret;
 }
 
+// I'm just dicking around with this
+struct ElementCollection {
+	this(Element e) {
+		elements = [e];
+	}
+
+	this(Element[] e) {
+		elements = e;
+	}
+
+	Element[] elements;
+	//alias elements this; // let it implicitly convert to the underlying array
+
+	ElementCollection opIndex(string selector) {
+		ElementCollection ec;
+		foreach(e; elements)
+			ec.elements ~= e.getElementsBySelector(selector);
+		return ec;
+	}
+
+	/// Forward method calls to each individual element of the collection
+	/// returns this so it can be chained.
+	ElementCollection opDispatch(string name, T...)(T t) {
+		foreach(e; elements) {
+			mixin("e." ~ name)(t);
+		}
+		return this;
+	}
+
+	ElementCollection opBinary(string op : "~")(ElementCollection rhs) {
+		return ElementCollection(this.elements ~ rhs.elements);
+	}
+}
+
+
 /*
 Copyright: Adam D. Ruppe, 2010 - 2011
 License:   <a href="http://www.boost.org/LICENSE_1_0.txt">Boost License 1.0</a>.
diff --git a/html.d b/html.d
index 193341c..2af6ba6 100644
--- a/html.d
+++ b/html.d
@@ -206,6 +206,105 @@ string favicon(Document document) {
 	return "/favicon.ico"; // it pisses me off that the fucking browsers do this.... but they do, so I will too.
 }
 
+
+/++ Convenience function to create a small <form> to POST, but the creation function is more like a link
+    than a DOM form.
+   
+    The idea is if you have a link to a page which needs to be changed since it is now taking an action,
+    this should provide an easy way to do it.
+
+    You might want to style these with css. The form these functions create has no class - use regular
+    dom functions to add one. When styling, hit the form itself and form > [type=submit]. (That will
+    cover both input[type=submit] and button[type=submit] - the two possibilities the functions may create.)
+   
+    Param:
+    	href: the link. Query params (if present) are converted into hidden form inputs and the rest is used as the form action
+	innerText: the text to show on the submit button
+	params: additional parameters for the form
++/
+Form makePostLink(string href, string innerText, string[string] params = null) {
+	auto submit = Element.make("input");
+	submit.type = "submit";
+	submit.value = innerText;
+
+	return makePostLink_impl(href, params, submit);
+}
+
+/// Similar to the above, but lets you pass HTML rather than just text. It puts the html inside a <button type="submit"> element.
+///
+/// Using html strings imo generally sucks. I recommend you use plain text or structured Elements instead most the time.
+Form makePostLink(string href, Html innerHtml, string[string] params = null) {
+	auto submit = Element.make("button");
+	submit.type = "submit";
+	submit.innerHTML = innerHtml;
+
+	return makePostLink_impl(href, params, submit);
+}
+
+/// Like the Html overload, this uses a <button> tag to get fancier with the submit button. The element you pass is appended to the submit button.
+Form makePostLink(string href, Element submitButtonContents, string[string] params = null) {
+	auto submit = Element.make("button");
+	submit.type = "submit";
+	submit.appendChild(submitButtonContents);
+
+	return makePostLink_impl(href, params, submit);
+}
+
+Form makePostLink_impl(string href, string[string] params, Element submitButton) {
+	auto form = require!Form(Element.make("form"));
+	form.method = "POST";
+
+	auto idx = href.indexOf("?");
+	if(idx == -1) {
+		form.action = href;
+	} else {
+		form.action = href[0 .. idx];
+		foreach(k, arr; decodeVariables(href[idx + 1 .. $]))
+			form.addValueArray(k, arr);
+	}
+
+	foreach(k, v; params)
+		form.setValue(k, v);
+
+	form.appendChild(submitButton);
+
+	return form;
+}
+
+/++ Given an existing link, create a POST item from it.
+    You can use this to do something like:
+
+    auto e = document.requireSelector("a.should-be-post"); // get my link from the dom
+    e.replaceWith(makePostLink(e)); // replace the link with a nice POST form that otherwise does the same thing
+
+    It passes all attributes of the link on to the form, though I could be convinced to put some on the submit button instead.
+++/
+Form makePostLink(Element link) {
+	Form form;
+	if(link.childNodes.length == 1) {
+		auto fc = link.firstChild;
+		if(fc.nodeType == NodeType.Text)
+			form = makePostLink(link.href, fc.nodeValue);
+		else
+			form = makePostLink(link.href, fc);
+	} else {
+		form = makePostLink(link.href, Html(link.innerHTML));
+	}
+
+	assert(form !is null);
+
+	// auto submitButton = form.requireSelector("[type=submit]");
+
+	foreach(k, v; link.attributes) {
+		if(k == "href" || k == "action" || k == "method")
+			continue;
+
+		form.setAttribute(k, v); // carries on class, events, etc. to the form.
+	}
+
+	return form;
+}
+
 /// Translates validate="" tags to inline javascript. "this" is the thing
 /// being checked.
 void translateValidation(Document document) {
@@ -386,6 +485,101 @@ void translateFiltering(Document document) {
 	}
 }
 
+enum TextWrapperWhitespaceBehavior {
+	wrap,
+	ignore,
+	stripOut
+}
+
+/// This wraps every non-empty text mode in the document body with
+/// <t:t></t:t>, and sets an xmlns:t to the html root.
+///
+/// If you use it, be sure it's the last thing you do before
+/// calling toString
+///
+/// Why would you want this? Because CSS sucks. If it had a
+/// :text pseudoclass, we'd be right in business, but it doesn't
+/// so we'll hack it with this custom tag.
+///
+/// It's in an xml namespace so it should affect or be affected by
+/// your existing code, while maintaining excellent browser support.
+///
+/// To style it, use myelement > t\:t { style here } in your css.
+///
+/// Note: this can break the css adjacent sibling selector, first-child,
+/// and other structural selectors. For example, if you write
+/// <span>hello</span> <span>world</span>, normally, css span + span would
+/// select "world". But, if you call wrapTextNodes, there's a <t:t> in the
+/// middle.... so now it no longer matches.
+///
+/// Of course, it can also have an effect on your javascript, especially,
+/// again, when working with siblings or firstChild, etc.
+///
+/// You must handle all this yourself, which may limit the usefulness of this
+/// function.
+///
+/// The second parameter, whatToDoWithWhitespaceNodes, tries to mitigate
+/// this somewhat by giving you some options about what to do with text
+/// nodes that consist of nothing but whitespace.
+///
+/// You can: wrap them, like all other text nodes, you can ignore
+/// them entirely, leaving them unwrapped, and in the document normally,
+/// or you can use stripOut to remove them from the document.
+///
+/// Beware with stripOut: <span>you</span> <span>rock</span> -- that space
+/// between the spans is a text node of nothing but whitespace, so it would
+/// be stripped out - probably not what you want!
+///
+/// ignore is the default, since this should break the least of your
+/// expectations with document structure, while still letting you use this
+/// function.
+void wrapTextNodes(Document document, TextWrapperWhitespaceBehavior whatToDoWithWhitespaceNodes = TextWrapperWhitespaceBehavior.ignore) {
+	enum ourNamespace = "t";
+	enum ourTag = ourNamespace ~ ":t";
+	document.root.setAttribute("xmlns:" ~ ourNamespace, null);
+	foreach(e; document.mainBody.tree) {
+		if(e.tagName == "script")
+			continue;
+		if(e.nodeType != NodeType.Text)
+			continue;
+		auto tn = cast(TextNode) e;
+		if(tn is null)
+			continue;
+
+		if(tn.contents.length == 0)
+			continue;
+
+		if(tn.parentNode !is null
+			&& tn.parentNode.tagName == ourTag)
+		{
+			// this is just a sanity check to make sure
+			// we don't double wrap anything
+			continue;
+		}
+
+		final switch(whatToDoWithWhitespaceNodes) {
+			case TextWrapperWhitespaceBehavior.wrap:
+				break; // treat it like all other text
+			break;
+			case TextWrapperWhitespaceBehavior.stripOut:
+				// if it's actually whitespace...
+				if(tn.contents.strip().length == 0) {
+					tn.removeFromTree();
+					continue;
+				}
+			break;
+			case TextWrapperWhitespaceBehavior.ignore:
+				// if it's actually whitespace...
+				if(tn.contents.strip().length == 0)
+					continue;
+			break;
+		}
+
+		tn.replaceWith(Element.make(ourTag, tn.contents));
+	}
+}
+
+
 void translateInputTitles(Document document) {
 	translateInputTitles(document.root);
 }
@@ -1115,6 +1309,7 @@ class CssRule : CssPart {
 
 CssPart[] lexCss(string css) {
 	import std.regex;
+	// strips comments
 	css = std.regex.replace(css, regex(r"\/\*[^*]*\*+([^/*][^*]*\*+)*\/", "g"), "");
 
 	CssPart[] ret;
@@ -1562,12 +1757,24 @@ class MacroExpander {
 class CssMacroExpander : MacroExpander {
 	this() {
 		super();
+
 		functions["prefixed"] = &prefixed;
+
 		functions["lighten"] = &(colorFunctionWrapper!lighten);
 		functions["darken"] = &(colorFunctionWrapper!darken);
+		functions["moderate"] = &(colorFunctionWrapper!moderate);
+		functions["extremify"] = &(colorFunctionWrapper!extremify);
+
+		functions["oppositeLightness"] = &(oneArgColorFunctionWrapper!oppositeLightness);
+
 		functions["rotateHue"] = &(colorFunctionWrapper!rotateHue);
+
 		functions["saturate"] = &(colorFunctionWrapper!saturate);
 		functions["desaturate"] = &(colorFunctionWrapper!desaturate);
+
+		functions["setHue"] = &(colorFunctionWrapper!setHue);
+		functions["setSaturation"] = &(colorFunctionWrapper!setSaturation);
+		functions["setLightness"] = &(colorFunctionWrapper!setLightness);
 	}
 
 	// prefixed(border-radius: 12px);
@@ -1586,7 +1793,12 @@ class CssMacroExpander : MacroExpander {
 	dstring colorFunctionWrapper(alias func)(dstring[] args) {
 		auto color = readCssColor(to!string(args[0]));
 		auto percentage = readCssNumber(args[1]);
-		return to!dstring(func(color, percentage).toString());
+		return "#"d ~ to!dstring(func(color, percentage).toString());
+	}
+
+	dstring oneArgColorFunctionWrapper(alias func)(dstring[] args) {
+		auto color = readCssColor(to!string(args[0]));
+		return "#"d ~ to!dstring(func(color).toString());
 	}
 }
 
@@ -1730,3 +1942,14 @@ Color readCssColor(string cssColor) {
 			assert(0, "Unknown color: " ~ cssColor);
 	}
 }
+
+/*
+Copyright: Adam D. Ruppe, 2010 - 2012
+License:   <a href="http://www.boost.org/LICENSE_1_0.txt">Boost License 1.0</a>.
+Authors: Adam D. Ruppe, with contributions by Nick Sabalausky and Trass3r
+
+        Copyright Adam D. Ruppe 2010-2012.
+Distributed under the Boost Software License, Version 1.0.
+   (See accompanying file LICENSE_1_0.txt or copy at
+        http://www.boost.org/LICENSE_1_0.txt)
+*/
diff --git a/web.d b/web.d
index bab7a29..097ce76 100644
--- a/web.d
+++ b/web.d
@@ -157,6 +157,7 @@ struct RequestInfo {
 	string requestedEnvelopeFormat; /// the format the data is to be wrapped in
 }
 
+/+
 string linkTo(alias func, T...)(T args) {
 	auto reflection = __traits(parent, func).reflection;
 	assert(reflection !is null);
@@ -170,6 +171,7 @@ string linkTo(alias func, T...)(T args) {
 
 	return funinfo.originalName;
 }
++/
 
 /// this is there so there's a common runtime type for all callables
 class WebDotDBaseType {
@@ -260,22 +262,21 @@ class ApiProvider : WebDotDBaseType {
 
 	/// override this to change cross-site request forgery checks.
 	///
-	/// The default is done on POST requests, using the session object. It throws
-	/// a PermissionDeniedException if the check fails. This might change later
-	/// to make catching it easier.
+	/// To perform a csrf check, call ensureGoodPost(); in your code.
+	///
+	/// It throws a PermissionDeniedException if the check fails.
+	/// This might change later to make catching it easier.
 	///
 	/// If there is no session object, the test always succeeds. This lets you opt
-	/// out of the system. FIXME: should I add ensureGoodPost or something to combine
-	/// enforce(session !is null); ensurePost() and checkCsrfToken();????
+	/// out of the system.
 	///
 	/// If the session is null, it does nothing. FancyMain makes a session for you.
 	/// If you are doing manual run(), it is your responsibility to create a session
 	/// and attach it to each primary object.
 	///
-	/// NOTE: it is important for you use ensurePost() on any data changing things!
-	/// Even though this function is called automatically by run(), it is a no-op on
-	/// non-POST methods, so there's no real protection without ensuring POST when
-	/// making changes.
+	/// NOTE: it is important for you use ensureGoodPost() on any data changing things!
+	/// This function alone is a no-op on non-POST methods, so there's no real protection
+	/// without ensuring POST when making changes.
 	///
 	// FIXME: if someone is OAuth authorized, a csrf token should not really be necessary.
 	// This check is done automatically right now, and doesn't account for that. I guess
@@ -843,8 +844,12 @@ immutable(ReflectionInfo*) prepareReflectionImpl(alias PM, alias Parent)(Parent
 			isApiProvider!(__traits(getMember, PM, member))
 		) {
 			PassthroughType!(__traits(getMember, PM, member)) i;
-			i = new typeof(i)();
-			auto r = prepareReflection!(__traits(getMember, PM, member))(i, null, member);
+			static if(__traits(compiles, i = new typeof(i)(instantiation)))
+				i = new typeof(i)(instantiation);
+			else
+				i = new typeof(i)();
+			auto r = prepareReflectionImpl!(__traits(getMember, PM, member), typeof(i))(i);
+			i.reflection = cast(immutable) r;
 			reflection.objects[member] = r;
 			if(toLower(member) !in reflection.objects) // web filenames are often lowercase too
 				reflection.objects[member.toLower] = r;
@@ -879,10 +884,7 @@ Parameter reflectParam(param)() {
 	} else static if(is(Unqual!(param) == Text)) {
 		p.type = "textarea";
 	} else {
-		if(p.name.toLower.indexOf("password") != -1) // hack to support common naming convention
-			p.type = "password";
-		else
-			p.type = "text";
+		p.type = "text";
 	}
 
 	return p;
@@ -1034,6 +1036,10 @@ void run(Provider)(Cgi cgi, Provider instantiation, size_t pathInfoStartingPoint
 	auto envelopeFormat = cgi.request("envelopeFormat", "document");
 
 	WebDotDBaseType base = instantiation;
+	WebDotDBaseType realObject = instantiation;
+	if(instantiator.length == 0)
+	if(fun !is null && fun.parentObject !is null && fun.parentObject.instantiation !is null)
+		realObject = fun.parentObject.instantiation;
 
 	// FIXME
 	if(cgi.pathInfo.indexOf("builtin.") != -1 && instantiation.builtInFunctions !is null)
@@ -1043,21 +1049,10 @@ void run(Provider)(Cgi cgi, Provider instantiation, size_t pathInfoStartingPoint
 		assert(fun !is null);
 		assert(fun.parentObject !is null);
 		assert(fun.parentObject.instantiate !is null);
-		base = fun.parentObject.instantiate(instantiator);
+		realObject = fun.parentObject.instantiate(instantiator);
 	}
 
 	try {
-		version(fb_inside_hack) {
-			// FIXME: this almost renders the whole thing useless.
-			if(cgi.referrer.indexOf("apps.facebook.com") == -1)
-				instantiation.checkCsrfToken();
-		} else
-			// you know, I wonder if this should even be automatic. If I
-			// just put it in the ensureGoodPost function or whatever
-			// it prolly works - such needs to be there anyway for it to be properly
-			// right.
-			instantiation.checkCsrfToken();
-
 		if(fun is null) {
 			auto d = instantiation._catchallEntry(
 				cgi.pathInfo[pathInfoStartingPoint + 1..$],
@@ -1111,7 +1106,8 @@ void run(Provider)(Cgi cgi, Provider instantiation, size_t pathInfoStartingPoint
 			}
 		}
 
-		res = fun.dispatcher(cgi, base, want, format, secondaryFormat);
+		realObject.cgi = cgi;
+		res = fun.dispatcher(cgi, realObject, want, format, secondaryFormat);
 
 				//if(cgi)
 				//	cgi.setResponseContentType("application/json");
@@ -1135,7 +1131,7 @@ void run(Provider)(Cgi cgi, Provider instantiation, size_t pathInfoStartingPoint
 					// go ahead and use it to make the form page
 					auto doc = fun.createForm(cgi.requestMethod == Cgi.RequestMethod.POST ? cgi.post : cgi.get);
 
-					form = doc.requireSelector!Form("form");
+					form = doc.requireSelector!Form("form.created-by-create-form, form.automatic-form, form");
 				} else {
 					Parameter[] params = (cast(Parameter[])fun.parameters).dup;
 					foreach(i, p; fun.parameters) {
@@ -1234,8 +1230,10 @@ void run(Provider)(Cgi cgi, Provider instantiation, size_t pathInfoStartingPoint
 						} else {
 							auto e = instantiation._getGenericContainer();
 							document = e.parentDocument;
-							// FIXME: slow, esp if func return element
+							// FIXME: a wee bit slow, esp if func return element
 							e.innerHTML = returned;
+							if(fun !is null)
+							e.setAttribute("data-from-function", fun.originalName);
 						}
 
 						if(document !is null) {
@@ -1390,8 +1388,9 @@ Form createAutomaticForm(Document document, in FunctionInfo* func, string[string
 // FIXME: should there be something to prevent the pre-filled options from url? It's convenient but
 // someone might use it to trick people into submitting badness too. I'm leaning toward meh.
 Form createAutomaticForm(Document document, string action, in Parameter[] parameters, string submitText = "Submit", string method = "POST", string[string] fieldTypes = null) {
-	assert(document !is null);
-	auto form = cast(Form) document.createElement("form");
+	auto form = cast(Form) Element.make("form");
+	form.parentDocument = document;
+	form.addClass("automatic-form");
 
 	form.action = action;
 
@@ -1399,18 +1398,13 @@ Form createAutomaticForm(Document document, string action, in Parameter[] parame
 	form.method = method;
 
 
-	auto fieldset = document.createElement("fieldset");
-	auto legend = document.createElement("legend");
-	legend.innerText = submitText;
-	fieldset.appendChild(legend);
+	auto fieldset = form.addChild("fieldset");
+	auto legend = fieldset.addChild("legend", submitText);
 
-	auto table = cast(Table) document.createElement("table");
+	auto table = cast(Table) fieldset.addChild("table");
 	assert(table !is null);
 
-	form.appendChild(fieldset);
-	fieldset.appendChild(table);
-
-	table.appendChild(document.createElement("tbody"));
+	table.addChild("tbody");
 
 	static int count = 0;
 
@@ -1427,10 +1421,10 @@ Form createAutomaticForm(Document document, string action, in Parameter[] parame
 			type = fieldTypes[param.name];
 		
 		if(type == "select") {
-			input = document.createElement("select");
+			input = Element.make("select");
 
 			foreach(idx, opt; param.options) {
-				auto option = document.createElement("option");
+				auto option = Element.make("option");
 				option.name = opt;
 				option.value = param.optionValues[idx];
 
@@ -1447,18 +1441,25 @@ Form createAutomaticForm(Document document, string action, in Parameter[] parame
 			assert(0, "FIXME");
 		} else {
 			if(type.startsWith("textarea")) {
-				input = document.createElement("textarea");
+				input = Element.make("textarea");
 				input.name = param.name;
 				input.innerText = param.value;
 
+				input.rows = "7";
+
 				auto idx = type.indexOf("-");
 				if(idx != -1) {
 					idx++;
 					input.rows = type[idx .. $];
 				}
 			} else {
-				input = document.createElement("input");
-				input.type = type;
+				input = Element.make("input");
+
+				// hack to support common naming convention
+				if(type == "text" && param.name.toLower.indexOf("password") != -1)
+					input.type = "password";
+				else
+					input.type = type;
 				input.name = param.name;
 				input.value = param.value;
 
@@ -1478,8 +1479,8 @@ Form createAutomaticForm(Document document, string action, in Parameter[] parame
 		if(type == "hidden") {
 			form.appendChild(input);
 		} else {
-			auto th = document.createElement("th");
-			auto label = document.createElement("label");
+			auto th = Element.make("th");
+			auto label = Element.make("label");
 			label.setAttribute("for", n); 
 			label.innerText = beautify(param.name) ~ ": ";
 			th.appendChild(label);
@@ -1490,7 +1491,7 @@ Form createAutomaticForm(Document document, string action, in Parameter[] parame
 		count++;
 	};
 
-	auto fmt = document.createElement("select");
+	auto fmt = Element.make("select");
 	fmt.name = "format";
 	fmt.addChild("option", "html").setAttribute("value", "html");
 	fmt.addChild("option", "table").setAttribute("value", "table");
@@ -1502,7 +1503,7 @@ Form createAutomaticForm(Document document, string action, in Parameter[] parame
 	table.appendRow(th, fmt).className = "format-row";
 
 
-	auto submit = document.createElement("input");
+	auto submit = Element.make("input");
 	submit.value = submitText;
 	submit.type = "submit";
 
@@ -1968,7 +1969,7 @@ type fromUrlParam(type)(string[] ofInterest) {
 
 auto getMemberDelegate(alias ObjectType, string member)(ObjectType object) if(is(ObjectType : WebDotDBaseType)) {
 	if(object is null)
-		throw new NoSuchPageException("no such object");
+		throw new NoSuchPageException("no such object " ~ ObjectType.stringof);
 	return &__traits(getMember, object, member);
 }
 
@@ -2335,7 +2336,7 @@ class Session {
 			_sessionId = info[0];
 			auto hash = info[1];
 
-			if(_sessionId.length == 0) {
+			if(_sessionId.length == 0 || !std.file.exists(getFilePath())) {
 				// there is no session
 				_readOnly = true;
 				return;
@@ -2501,7 +2502,7 @@ class Session {
 	void reload() {
 		data = null;
 		auto path = getFilePath();
-		if(std.file.exists(path)) {
+		try {
 			_hasData = true;
 			auto json = std.file.readText(getFilePath());
 
@@ -2536,7 +2537,13 @@ class Session {
 
 				data[k] = ret;
 			}
-		}			
+		} catch(Exception e) {
+			// it's a bad session...
+			_hasData = false;
+			data = null;
+			if(std.file.exists(path))
+				std.file.remove(path);
+		}
 	}
 
 	// FIXME: there's a race condition here - if the user is using the session
@@ -3269,6 +3276,7 @@ enum string javascriptBaseImpl = q{
 					args.format = "json";
 				args.envelopeFormat = "json";
 				return me._doRequest(me._apiBase + name, args, function(t, xml) {
+					/*
 					if(me._debugMode) {
 						try {
 							var obj = eval("(" + t + ")");
@@ -3278,8 +3286,9 @@ enum string javascriptBaseImpl = q{
 								"\nGot:\n" + t);
 						}
 					} else {
+					*/
 						var obj = eval("(" + t + ")");
-					}
+					//}
 
 					if(obj.success) {
 						if(typeof callback == "function")
@@ -3614,11 +3623,11 @@ css and js.
 */
 
 /*
-Copyright: Adam D. Ruppe, 2010 - 2011
+Copyright: Adam D. Ruppe, 2010 - 2012
 License:   <a href="http://www.boost.org/LICENSE_1_0.txt">Boost License 1.0</a>.
 Authors: Adam D. Ruppe, with contributions by Nick Sabalausky
 
-        Copyright Adam D. Ruppe 2010-2011.
+        Copyright Adam D. Ruppe 2010-2012.
 Distributed under the Boost Software License, Version 1.0.
    (See accompanying file LICENSE_1_0.txt or copy at
         http://www.boost.org/LICENSE_1_0.txt)