diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 3a4b6fe7..19c4fea8 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -1533,6 +1533,9 @@ class HttpCli(object):
     def tx_md(self, fs_path):
         logmsg = "{:4} {} ".format("", self.req)
 
+        if "edit" in self.uparam or "edit2" in self.uparam and not self.can_write:
+            return self.tx_404()
+
         tpl = "mde" if "edit2" in self.uparam else "md"
         html_path = os.path.join(E.mod, "web", "{}.html".format(tpl))
         template = self.j2(tpl)
@@ -1555,6 +1558,10 @@ class HttpCli(object):
         self.out_headers.update(NO_CACHE)
         status = 200 if do_send else 304
 
+        arg_base = "?"
+        if "k" in self.uparam:
+            arg_base = "?k={}&".format(self.uparam["k"])
+
         boundary = "\roll\tide"
         targs = {
             "edit": "edit" in self.uparam,
@@ -1564,6 +1571,7 @@ class HttpCli(object):
             "md_chk_rate": self.args.mcr,
             "md": boundary,
             "ts": self.conn.hsrv.cachebuster(),
+            "arg_base": arg_base,
         }
         html = template.render(**targs).encode("utf-8", "replace")
         html = html.split(boundary.encode("utf-8"))
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 9f21bccb..360ebf3c 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -368,7 +368,7 @@ var mpl = (function () {
 
 			for (var a = 0, aa = files.length; a < aa; a++) {
 				if (/^(cover|folder)\.(jpe?g|png|gif)$/.test(files[a].textContent)) {
-					cover = files[a].getAttribute('href');
+					cover = noq_href(files[a]);
 					break;
 				}
 			}
@@ -427,7 +427,7 @@ function MPlayer() {
 			link = tds[1].getElementsByTagName('a');
 
 		link = link[link.length - 1];
-		var url = link.getAttribute('href'),
+		var url = noq_href(link),
 			m = re_audio.exec(url);
 
 		if (m) {
@@ -2157,7 +2157,7 @@ var fileman = (function () {
 			links = QSA('#files tbody td:nth-child(2) a');
 
 		for (var a = 0, aa = links.length; a < aa; a++)
-			indir.push(vsplit(links[a].getAttribute('href'))[1]);
+			indir.push(vsplit(noq_href(links[a]))[1]);
 
 		for (var a = 0; a < r.clip.length; a++) {
 			var found = false;
@@ -2350,7 +2350,7 @@ var thegrid = (function () {
 			return true;
 
 		var oth = ebi(this.getAttribute('ref')),
-			href = this.getAttribute('href'),
+			href = noq_href(this),
 			aplay = ebi('a' + oth.getAttribute('id')),
 			is_img = /\.(gif|jpe?g|png|webp|webm|mp4)(\?|$)/i.test(href),
 			in_tree = null,
@@ -2358,7 +2358,7 @@ var thegrid = (function () {
 			td = oth.closest('td').nextSibling,
 			tr = td.parentNode;
 
-		if (/\/(\?|$)/.test(href)) {
+		if (href.endsWith('/')) {
 			var ta = QSA('#treeul a.hl+ul>li>a+a'),
 				txt = oth.textContent.slice(0, -1);
 
@@ -2397,7 +2397,7 @@ var thegrid = (function () {
 			var tr = ebi(ths[a].getAttribute('ref')).closest('tr'),
 				cl = tr.getAttribute('class') || '';
 
-			if (ths[a].getAttribute('href').endsWith('/'))
+			if (noq_href(ths[a]).endsWith('/'))
 				cl += ' dir';
 
 			ths[a].setAttribute('class', cl);
@@ -2461,15 +2461,16 @@ var thegrid = (function () {
 		var files = QSA('#files>tbody>tr>td:nth-child(2) a[id]');
 		for (var a = 0, aa = files.length; a < aa; a++) {
 			var ao = files[a],
-				href = esc(ao.getAttribute('href')),
+				ohref = esc(ao.getAttribute('href')),
+				href = ohref.split('?')[0],
 				name = uricom_dec(vsplit(href)[1])[0],
 				ref = ao.getAttribute('id'),
-				isdir = href.split('?')[0].slice(-1)[0] == '/',
+				isdir = href.endsWith('/'),
 				ac = isdir ? ' class="dir"' : '',
 				ihref = href;
 
 			if (r.thumbs) {
-				ihref += (ihref.indexOf('?') === -1 ? '?' : '&') + 'th=' + (have_webp ? 'w' : 'j');
+				ihref += '?th=' + (have_webp ? 'w' : 'j');
 				if (href == "#")
 					ihref = '/.cpr/ico/⏏️';
 			}
@@ -2477,7 +2478,7 @@ var thegrid = (function () {
 				ihref = '/.cpr/ico/folder';
 			}
 			else {
-				var ar = href.split('?')[0].split('.');
+				var ar = href.split('.');
 				if (ar.length > 1)
 					ar = ar.slice(1);
 
@@ -2495,7 +2496,7 @@ var thegrid = (function () {
 				ihref = '/.cpr/ico/' + ihref.slice(0, -1);
 			}
 
-			html.push('<a href="' + href + '" ref="' + ref +
+			html.push('<a href="' + ohref + '" ref="' + ref +
 				'"' + ac + ' ttt="' + esc(name) + '"><img src="' +
 				ihref + '" /><span' + ac + '>' + ao.innerHTML + '</span></a>');
 		}
@@ -3015,7 +3016,7 @@ var treectl = (function () {
 		prev_atop = null,
 		prev_winh = null,
 		mentered = null,
-		treesz = clamp(icfg_get('treesz', 16), 8, 50);
+		treesz = clamp(icfg_get('treesz', 16), 10, 50);
 
 	bcfg_bind(treectl, 'ireadme', 'ireadme', true);
 	bcfg_bind(treectl, 'dyn', 'dyntree', true, onresize);
@@ -3138,9 +3139,8 @@ var treectl = (function () {
 		try {
 			document.documentElement.style.setProperty('--nav-sz', w);
 		}
-		catch (ex) {
-			ebi('tree').style.width = w;
-		}
+		catch (ex) { }
+		ebi('tree').style.width = w;
 		ebi('wrap').style.marginLeft = w;
 		onscroll();
 	}
@@ -3983,7 +3983,7 @@ var msel = (function () {
 			vbase = get_evpath();
 
 		for (var a = 0, aa = links.length; a < aa; a++) {
-			var href = links[a].getAttribute('href').replace(/\/$/, ""),
+			var href = noq_href(links[a]).replace(/\/$/, ""),
 				item = {};
 
 			item.id = links[a].getAttribute('id');
@@ -4129,8 +4129,8 @@ if (readme)
 		for (var a = 0; a < tr.length; a++) {
 			var td = tr[a].cells[1],
 				ao = td.firstChild,
-				href = ao.getAttribute('href'),
-				isdir = href.split('?')[0].slice(-1)[0] == '/',
+				href = noq_href(ao),
+				isdir = href.endsWith('/'),
 				txt = ao.textContent;
 
 			td.setAttribute('sortv', (isdir ? '\t' : '') + txt);
diff --git a/copyparty/web/md.html b/copyparty/web/md.html
index a4b482bf..ab70cafc 100644
--- a/copyparty/web/md.html
+++ b/copyparty/web/md.html
@@ -15,7 +15,7 @@
 		<a id="lightswitch" href="#">go dark</a>
 		<a id="navtoggle" href="#">hide nav</a>
 		{%- if edit %}
-			<a id="save" href="?edit" tt="Hotkey: ctrl-s">save</a>
+			<a id="save" href="{{ arg_base }}edit" tt="Hotkey: ctrl-s">save</a>
 			<a id="sbs" href="#" tt="editor and preview side by side">sbs</a>
 			<a id="nsbs" href="#" tt="switch between editor and preview$NHotkey: ctrl-e">editor</a>
 			<div id="toolsbox">
@@ -28,9 +28,9 @@
 			</div>
 			<span id="lno">L#</span>
 		{%- else %}
-			<a href="?edit" tt="good: higher performance$Ngood: same document width as viewer$Nbad: assumes you know markdown">edit (basic)</a>
-			<a href="?edit2" tt="not in-house so probably less buggy">edit (fancy)</a>
-			<a href="?raw">view raw</a>
+			<a href="{{ arg_base }}edit" tt="good: higher performance$Ngood: same document width as viewer$Nbad: assumes you know markdown">edit (basic)</a>
+			<a href="{{ arg_base }}edit2" tt="not in-house so probably less buggy">edit (fancy)</a>
+			<a href="{{ arg_base }}raw">view raw</a>
 		{%- endif %}
 	</div>
 	<div id="toc"></div>
diff --git a/copyparty/web/util.js b/copyparty/web/util.js
index b2d5054b..1c48c180 100644
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -494,6 +494,11 @@ function get_vpath() {
 }
 
 
+function noq_href(el) {
+    return el.getAttribute('href').split('?')[0];
+}
+
+
 function get_pwd() {
     var pwd = ('; ' + document.cookie).split('; cppwd=');
     if (pwd.length < 2)