diff --git a/activity.go b/activity.go
index 5e75922..8bbecf5 100644
--- a/activity.go
+++ b/activity.go
@@ -56,7 +56,7 @@ func friendorfoe(ct string) bool {
 	return false
 }
 
-var debugClient = &http.Client{
+var develClient = &http.Client{
 	Transport: &http.Transport{
 		TLSClientConfig: &tls.Config{
 			InsecureSkipVerify: true,
@@ -70,8 +70,8 @@ func PostJunk(keyname string, key httpsig.PrivateKey, url string, j junk.Junk) e
 
 func PostMsg(keyname string, key httpsig.PrivateKey, url string, msg []byte) error {
 	client := http.DefaultClient
-	if debugMode {
-		client = debugClient
+	if develMode {
+		client = develClient
 	}
 	req, err := http.NewRequest("POST", url, bytes.NewReader(msg))
 	if err != nil {
@@ -129,8 +129,8 @@ var flightdeck = gate.NewSerializer()
 
 func GetJunkTimeout(url string, timeout time.Duration) (junk.Junk, error) {
 	client := http.DefaultClient
-	if debugMode {
-		client = debugClient
+	if develMode {
+		client = develClient
 	}
 	fn := func() (interface{}, error) {
 		at := thefakename
@@ -156,8 +156,8 @@ func GetJunkTimeout(url string, timeout time.Duration) (junk.Junk, error) {
 
 func fetchsome(url string) ([]byte, error) {
 	client := http.DefaultClient
-	if debugMode {
-		client = debugClient
+	if develMode {
+		client = develClient
 	}
 	req, err := http.NewRequest("GET", url, nil)
 	if err != nil {
diff --git a/bloat.go b/bloat.go
index f634369..d4c7867 100644
--- a/bloat.go
+++ b/bloat.go
@@ -37,7 +37,7 @@ func servewonkles(w http.ResponseWriter, r *http.Request) {
 	for _, l := range strings.Split(wonkles, "\n") {
 		words = append(words, l)
 	}
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=7776000")
 	}
 
diff --git a/docs/honk.8 b/docs/honk.8
index 936ff84..5d78e32 100644
--- a/docs/honk.8
+++ b/docs/honk.8
@@ -174,10 +174,9 @@ Be mindful of what other services may be exposed via localhost or the
 local network.
 .Ss Debug
 Debug mode may be enabled or disabled by running
-.Ic debug Ar on|off .
-In debug mode, secure cookies are disabled and templates are reloaded
-every request.
-Debug mode is really more useful for development, not debugging production.
+.Ic devel Ar on|off .
+In devel mode, secure cookies are disabled, TLS certs are not verified,
+and templates are reloaded every request.
 .Ss Import
 Data may be imported and converted from other services using the
 .Ic import
diff --git a/go.mod b/go.mod
index 8a77da0..f235a28 100644
--- a/go.mod
+++ b/go.mod
@@ -10,5 +10,5 @@ require (
 	golang.org/x/image v0.0.0-20200927104501-e162460cd6b5 // indirect
 	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
 	humungus.tedunangst.com/r/go-sqlite3 v1.1.3
-	humungus.tedunangst.com/r/webs v0.6.49
+	humungus.tedunangst.com/r/webs v0.6.50
 )
diff --git a/go.sum b/go.sum
index 9b290ef..f0bb588 100644
--- a/go.sum
+++ b/go.sum
@@ -24,5 +24,5 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 humungus.tedunangst.com/r/go-sqlite3 v1.1.3 h1:G2N4wzDS0NbuvrZtQJhh4F+3X+s7BF8b9ga8k38geUI=
 humungus.tedunangst.com/r/go-sqlite3 v1.1.3/go.mod h1:FtEEmQM7U2Ey1TuEEOyY1BmphTZnmiEjPsNLEAkpf/M=
-humungus.tedunangst.com/r/webs v0.6.49 h1:Tv3Fx2xnv+TINW5gepCpaDP+xhkOWlWp3rYE9FAkP50=
-humungus.tedunangst.com/r/webs v0.6.49/go.mod h1:S9sXpVSbgAIa24yYhnMN0C94LKHG+2rioS+NsiDimps=
+humungus.tedunangst.com/r/webs v0.6.50 h1:MScU6TwnaluLUuyveARr43iXJkv2xeyAWBKea+5tnLA=
+humungus.tedunangst.com/r/webs v0.6.50/go.mod h1:S9sXpVSbgAIa24yYhnMN0C94LKHG+2rioS+NsiDimps=
diff --git a/honk.go b/honk.go
index abea138..8b1114c 100644
--- a/honk.go
+++ b/honk.go
@@ -318,7 +318,7 @@ func main() {
 	serverPrefix = fmt.Sprintf("https://%s/", serverName)
 	getconfig("usersep", &userSep)
 	getconfig("honksep", &honkSep)
-	getconfig("debug", &debugMode)
+	getconfig("devel", &develMode)
 	prepareStatements(db)
 	switch cmd {
 	case "admin":
@@ -328,15 +328,15 @@ func main() {
 			elog.Fatal("import username mastodon|twitter srcdir")
 		}
 		importMain(args[1], args[2], args[3])
-	case "debug":
+	case "devel":
 		if len(args) != 2 {
-			elog.Fatal("need an argument: debug (on|off)")
+			elog.Fatal("need an argument: devel (on|off)")
 		}
 		switch args[1] {
 		case "on":
-			setconfig("debug", 1)
+			setconfig("devel", 1)
 		case "off":
-			setconfig("debug", 0)
+			setconfig("devel", 0)
 		default:
 			elog.Fatal("argument must be on or off")
 		}
diff --git a/upgradedb.go b/upgradedb.go
index 04a2442..8853f0d 100644
--- a/upgradedb.go
+++ b/upgradedb.go
@@ -67,9 +67,9 @@ func upgradedb() {
 			setconfig("loginmsg", "<h2>login</h2>")
 		}
 		d := -1
-		getconfig("debug", &d)
+		getconfig("devel", &d)
 		if d == -1 {
-			setconfig("debug", 0)
+			setconfig("devel", 0)
 		}
 		doordie(db, "update config set value = 27 where key = 'dbversion'")
 		fallthrough
diff --git a/util.go b/util.go
index 0dc70be..85647d9 100644
--- a/util.go
+++ b/util.go
@@ -158,7 +158,7 @@ func initdb() {
 	setconfig("servermsg", "<h2>Things happen.</h2>")
 	setconfig("aboutmsg", "<h3>What is honk?</h3><p>Honk is amazing!")
 	setconfig("loginmsg", "<h2>login</h2>")
-	setconfig("debug", 0)
+	setconfig("devel", 0)
 
 	db.Close()
 	fmt.Printf("done.\n")
diff --git a/web.go b/web.go
index ce12c60..e98d426 100644
--- a/web.go
+++ b/web.go
@@ -47,7 +47,7 @@ var readviews *templates.Template
 var userSep = "u"
 var honkSep = "h"
 
-var debugMode = false
+var develMode = false
 
 func getuserstyle(u *login.UserInfo) template.CSS {
 	if u == nil {
@@ -235,7 +235,7 @@ func showrss(w http.ResponseWriter, r *http.Request) {
 			modtime = honk.Date
 		}
 	}
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=300")
 		w.Header().Set("Last-Modified", modtime.Format(http.TimeFormat))
 	}
@@ -862,7 +862,7 @@ func thelistingoftheontologies(w http.ResponseWriter, r *http.Request) {
 	sort.Slice(onts, func(i, j int) bool {
 		return onts[i].Name < onts[j].Name
 	})
-	if u == nil && !debugMode {
+	if u == nil && !develMode {
 		w.Header().Set("Cache-Control", "max-age=300")
 	}
 	templinfo := getInfo(r)
@@ -1085,7 +1085,7 @@ func honkpage(w http.ResponseWriter, u *login.UserInfo, honks []*Honk, templinfo
 			templinfo["TopHID"] = 0
 		}
 	}
-	if u == nil && !debugMode {
+	if u == nil && !develMode {
 		w.Header().Set("Cache-Control", "max-age=60")
 	}
 	err := readviews.Execute(w, "honkpage.html", templinfo)
@@ -2125,20 +2125,20 @@ func somedays() string {
 }
 
 func avatate(w http.ResponseWriter, r *http.Request) {
-	if debugMode {
+	if develMode {
 		loadAvatarColors()
 	}
 	n := r.FormValue("a")
 	hex := r.FormValue("hex") == "1"
 	a := genAvatar(n, hex)
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age="+somedays())
 	}
 	w.Write(a)
 }
 
 func serveasset(w http.ResponseWriter, r *http.Request) {
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=7776000")
 	}
 	dir := viewDir
@@ -2149,7 +2149,7 @@ func serveasset(w http.ResponseWriter, r *http.Request) {
 }
 func servehelp(w http.ResponseWriter, r *http.Request) {
 	name := mux.Vars(r)["name"]
-	if !debugMode {
+	if !develMode {
 		w.Header().Set("Cache-Control", "max-age=3600")
 	}
 	http.ServeFile(w, r, viewDir+"/docs/"+name)
@@ -2163,7 +2163,7 @@ func servehtml(w http.ResponseWriter, r *http.Request) {
 	if r.URL.Path == "/about" {
 		templinfo["Sensors"] = getSensors()
 	}
-	if u == nil && !debugMode {
+	if u == nil && !develMode {
 		w.Header().Set("Cache-Control", "max-age=60")
 	}
 	err := readviews.Execute(w, r.URL.Path[1:]+".html", templinfo)
@@ -2433,7 +2433,7 @@ func bgmonitor() {
 
 func serve() {
 	db := opendatabase()
-	login.Init(login.InitArgs{Db: db, Logger: ilog})
+	login.Init(login.InitArgs{Db: db, Logger: ilog, Insecure: develMode})
 
 	listener, err := openListener()
 	if err != nil {
@@ -2447,7 +2447,7 @@ func serve() {
 	loadLingo()
 	w100 := wait100ms()
 
-	readviews = templates.Load(debugMode,
+	readviews = templates.Load(develMode,
 		viewDir+"/views/honkpage.html",
 		viewDir+"/views/honkfrags.html",
 		viewDir+"/views/honkers.html",
@@ -2466,7 +2466,7 @@ func serve() {
 		viewDir+"/views/onts.html",
 		viewDir+"/views/honkpage.js",
 	)
-	if !debugMode {
+	if !develMode {
 		assets := []string{viewDir + "/views/style.css", dataDir + "/views/local.css", viewDir + "/views/honkpage.js"}
 		for _, s := range assets {
 			savedassetparams[s] = getassetparam(s)