diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index b042e00b..32e0705d 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -201,7 +201,8 @@ class HttpCli(object):
         if "multipart/form-data" in ctype:
             return self.handle_post_multipart()
 
-        if "text/plain" in ctype:
+        if "text/plain" in ctype or "application/xml" in ctype:
+            # TODO this will be intredasting
             return self.handle_post_json()
 
         if "application/octet-stream" in ctype:
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 725b6ec1..97c4202f 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -82,8 +82,8 @@ var mp = (function () {
 		'tracks': tracks,
 		'cover_url': ''
 	};
-	var re_audio = new RegExp(/\.(opus|ogg|m4a|aac|mp3|wav|flac)$/, 'i');
-	var re_cover = new RegExp(/^(cover|folder|cd|front|back)\.(jpe?g|png|gif)$/, 'i');
+	var re_audio = new RegExp('\.(opus|ogg|m4a|aac|mp3|wav|flac)$', 'i');
+	var re_cover = new RegExp('^(cover|folder|cd|front|back)\.(jpe?g|png|gif)$', 'i');
 
 	var trs = document.getElementById('files').getElementsByTagName('tbody')[0].getElementsByTagName('tr');
 	for (var a = 0, aa = trs.length; a < aa; a++) {
@@ -579,13 +579,9 @@ function unblocked() {
 
 // show ui to manually start playback of a linked song
 function autoplay_blocked(tid) {
-	show_modal(`
-		<div id="blk_play">
-			<a id="blk_go"></a>
-		</div>
-		<div id="blk_abrt">
-			<a id="blk_na">Cancel<br />(show file list)</a>
-		</div>`);
+	show_modal(
+		'<div id="blk_play"><a id="blk_go"></a></div>' +
+		'<div id="blk_abrt"><a id="blk_na">Cancel<br />(show file list)</a></div>');
 
 	var go = o('blk_go');
 	var na = o('blk_na');
diff --git a/copyparty/web/up2k.js b/copyparty/web/up2k.js
index f540051b..6178c79f 100644
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -58,6 +58,23 @@ function o(id) {
 
 
 (function () {
+    // chrome requires https to use crypto.subtle,
+    // usually it's undefined but some chromes throw on invoke
+    try {
+        crypto.subtle.digest(
+            'SHA-512', new Uint8Array(1)
+        ).then(
+            function(x) {up2k_init(true)},
+            function(x) {up2k_init(false)}
+        );
+    }
+    catch (ex) {
+        up2k_init(false);
+    }
+})();
+
+
+function up2k_init(have_crypto) {
     // show modal message
     function showmodal(msg) {
         o('u2notbtn').innerHTML = msg;
@@ -74,10 +91,11 @@ function o(id) {
         o('u2notbtn').innerHTML = '';
     }
 
-    // might need sha512 polyfill when non-https (thx webkit (again))
-    var have_crypto = window.crypto && crypto.subtle && crypto.subtle.digest;
     var shame = 'your browser <a href="https://www.chromium.org/blink/webcrypto">disables sha512</a> unless you <a href="' + (window.location + '').replace(':', 's:') + '">use https</a>'
-    //have_crypto = false;
+    var is_https = (window.location + '').indexOf('https:') === 0;
+    if (is_https)
+        // chrome<37 firefox<34 edge<12 ie<11 opera<24 safari<10.1
+        shame = 'your browser is impressively ancient'
 
     // upload ui hidden by default, clicking the header shows it
     o('u2tgl').onclick = function (e) {
@@ -89,7 +107,10 @@ function o(id) {
             showmodal('<h1>loading sha512.js</h1><h2>since ' + shame + '</h2><h4>thanks chrome</h4>');
             import_js('/.cpr/deps/sha512.js', unmodal);
 
-            o('u2foot').innerHTML = 'seems like ' + shame + ' so do that if you want more performance';
+            if (is_https)
+                o('u2foot').innerHTML = shame + ' so <em>this</em> uploader will do like 500kB/s at best';
+            else
+                o('u2foot').innerHTML = 'seems like ' + shame + ' so do that if you want more performance';
         }
     };
 
@@ -215,7 +236,7 @@ function o(id) {
             try {
                 fobj.size;
             }
-            catch {
+            catch (ex) {
                 return alert(
                     'Due to a browser bug, Firefox-Android can only do one file at a time:\n' +
                     'https://bugzilla.mozilla.org/show_bug.cgi?id=1456557');
@@ -382,11 +403,11 @@ function o(id) {
             prog(t.n, nchunk, col_hashing);
         };
 
-        var segm_load = async function (ev) {
+        var segm_load = function (ev) {
             var filebuf = ev.target.result;
             var hashbuf;
             if (have_crypto)
-                hashbuf = await crypto.subtle.digest('SHA-512', filebuf);
+                crypto.subtle.digest('SHA-512', filebuf).then(hash_done);
             else {
                 var ofs = 0;
                 var eof = filebuf.byteLength;
@@ -399,8 +420,11 @@ function o(id) {
                     ofs = ofs2;
                 }
                 hasher.finish();
-                hashbuf = hasher.result;
+                hash_done(hasher.result);
             }
+        };
+
+        var hash_done = function (hashbuf) {
             t.hash.push(buf2b64(hashbuf).substr(0, 44));
 
             prog(t.n, nchunk, col_hashed);
@@ -658,4 +682,4 @@ function o(id) {
 
     bumpchunk({ "target": 1 })
     bumpthread({ "target": 1 })
-})();
+}
diff --git a/docs/notes.sh b/docs/notes.sh
index ea46b2e5..48d81d7a 100644
--- a/docs/notes.sh
+++ b/docs/notes.sh
@@ -37,6 +37,12 @@ for dir in "${dirs[@]}"; do for fn in ふが "$(printf \\xed\\x93)" 'qwe,rty;asd
 wget -S --header='Accept-Encoding: gzip' -U 'MSIE 6.0; SV1' http://127.0.0.1:1234/.cpr/deps/ogv.js -O- | md5sum; p=~ed/dev/copyparty/copyparty/web/deps/ogv.js.gz; md5sum $p; gzip -d < $p | md5sum
 
 
+##
+## sha512(file) | base64
+
+f=/boot/vmlinuz-4.19-x86_64; sp=2; v=0; sz=$(stat -c%s "$f"); while true; do w=$((v+sp*1024*1024)); printf $(tail -c +$((v+1)) "$f" | head -c $((w-v)) | sha512sum | sed -r 's/ .*//;s/(..)/\\x\1/g') | base64 -w0 | cut -c-44 | tr '+/' '-_'; v=$w; [ $v -lt $sz ] || break; done
+
+
 ##
 ## vscode