diff --git a/.vscode/settings.json b/.vscode/settings.json
index ff8651c0..c7b918b9 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -39,6 +39,9 @@
         "--max-line-length=120",
         "--ignore=E722,F405,E203,W503,W293",
     ],
+    "python.linting.banditArgs": [
+        "--ignore=B104"
+    ],
     "python.formatting.provider": "black",
     "editor.formatOnSave": true,
     "[html]": {
diff --git a/copyparty/authsrv.py b/copyparty/authsrv.py
index 45907a70..59dc2ef0 100644
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -138,6 +138,8 @@ class AuthSrv(object):
         self.log_func = log_func
         self.args = args
 
+        self.warn_anonwrite = True
+
         self.mutex = threading.Lock()
         self.reload()
 
@@ -262,6 +264,18 @@ class AuthSrv(object):
             v.uread = mread[dst]
             v.uwrite = mwrite[dst]
 
+        try:
+            vfs.get("/", "*", False, True)
+            if self.warn_anonwrite:
+                self.warn_anonwrite = False
+                self.log(
+                    "\033[31manyone can write to the current directory: {}\033[0m".format(
+                        os.getcwd()
+                    )
+                )
+        except Pebkac:
+            self.warn_anonwrite = True
+
         with self.mutex:
             self.vfs = vfs
             self.user = user
diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index ceaf6933..be2d0a11 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -232,13 +232,17 @@ class HttpCli(object):
                 if os.path.exists(fsenc(fn)):
                     fn += ".{:.6f}".format(time.time())
 
-            with open(fn, "wb") as f:
-                self.log("writing to {0}".format(fn))
-                sz, sha512 = hashcopy(self.conn, p_data, f)
-                if sz == 0:
-                    break
+            try:
+                with open(fn, "wb") as f:
+                    self.log("writing to {0}".format(fn))
+                    sz, sha512 = hashcopy(self.conn, p_data, f)
+                    if sz == 0:
+                        break
 
-                files.append([sz, sha512])
+                    files.append([sz, sha512])
+
+            except FileNotFoundError:
+                raise Pebkac("create that folder before uploading to it")
 
         self.parser.drop()
 
@@ -318,7 +322,7 @@ class HttpCli(object):
 
     def tx_browser(self):
         vpath = ""
-        vpnodes = [["/", "/"]]
+        vpnodes = [["", "/"]]
         for node in self.vpath.split("/"):
             if not vpath:
                 vpath = node
diff --git a/copyparty/web/browser.html b/copyparty/web/browser.html
index 5ddfe273..63780635 100644
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -22,7 +22,7 @@
     
     <h1 id="path">
         {%- for n in vpnodes[:-1] %}
-        <a href="{{ n[0] }}">{{ n[1] }}</a>
+        <a href="/{{ n[0] }}">{{ n[1] }}</a>
         {%- endfor %}
         <span>{{ vpnodes[-1][1] }}</span>
     </h1>
diff --git a/docs/notes.sh b/docs/notes.sh
index fe721497..bdc6fee8 100644
--- a/docs/notes.sh
+++ b/docs/notes.sh
@@ -25,7 +25,7 @@ head -c $((2*1024*1024*1024)) /dev/zero | openssl enc -aes-256-ctr -pass pass:hu
 ## testing multiple parallel uploads
 ## usage:  para | tee log
 
-para() { for s in 1 2 3 4 5 6 7 8 12 16 24 32 48 64; do echo $s; for r in {1..4}; do for ((n=0;n<s;n++)); do curl -sF "f=@garbage.file" http://127.0.0.1:1234/32 2>&1 & done; wait; echo; done; done; }
+para() { for s in 1 2 3 4 5 6 7 8 12 16 24 32 48 64; do echo $s; for r in {1..4}; do for ((n=0;n<s;n++)); do curl -sF "act=bput" -F "f=@garbage.file" http://127.0.0.1:1234/ 2>&1 & done; wait; echo; done; done; }
 
 
 ##