diff --git a/README.md b/README.md
index c58bc91f..5c73192d 100644
--- a/README.md
+++ b/README.md
@@ -74,15 +74,15 @@ summary: it works! you can use it! (but technically not even close to beta)
 
 # searching
 
-when started with `-e2dsa` copyparty will scan/index all your files, avoiding duplicates on upload, and also makes the volumes searchable through the web-ui
+when started with `-e2dsa` copyparty will scan/index all your files. This avoids duplicates on upload, and also makes the volumes searchable through the web-ui:
+* make search queries by `size`/`date`/`directory-path`/`filename`, or...
+* drag/drop a local file to see if the same contents exist somewhere on the server (you get the URL if it does)
 
-you can do queries for size/date/directory-path/filename, but you can also drag/drop a local file to see if the same contents exists somewhere on the server (you get the URL if it does)
+path/name queries are space-separated, AND'ed together, and words are negated with a `-` prefix, so for example:
+* path: `shibayan -bossa` finds all files where one of the folders contain `shibayan` but filters out any results where `bossa` exists somewhere in the path
+* name: `demetori styx` gives you [good stuff](https://www.youtube.com/watch?v=zGh0g14ZJ8I&list=PL3A147BD151EE5218&index=9)
 
-path/name queries are space-separated, AND'ed together, and words are negated with a `-` prefix, for example:
-* `shibayan -bossa` in the `path` field finds all files within a folder named `shibayan` but filters out any results where `bossa` exists somewhere in the path
-* `demetori styx` in the `name` field gives you [good stuff](https://www.youtube.com/watch?v=zGh0g14ZJ8I&list=PL3A147BD151EE5218&index=9)
-
-other metadata like song tags etc are not yet indexed for searching
+other metadata (like song tags etc) are not yet indexed for searching
 
 
 # client examples
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 2d100880..02e6b7b8 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -970,6 +970,8 @@ function despin(sel) {
 
 
 function apply_perms(perms) {
+	perms = perms || [];
+
 	var o = document.querySelectorAll('#ops>a[data-perm]');
 	for (var a = 0; a < o.length; a++)
 		o[a].style.display = 'none';