diff --git a/lib/app/index.js b/lib/app/index.js
index ad44512295..810f2f31ad 100644
--- a/lib/app/index.js
+++ b/lib/app/index.js
@@ -20,13 +20,8 @@ helpers = require('./helpers');
 helpers.viewHelpers(view);
 
 get('/:uidParam?', function(page, model, _arg) {
-  var acceptableUid, uidParam, userId;
+  var uidParam, userId;
   uidParam = _arg.uidParam;
-  acceptableUid = require('guid').isGuid(uidParam) || (uidParam === '3' || uidParam === '9');
-  if (acceptableUid) {
-    model.session.userId = uidParam;
-    return page.redirect('/');
-  }
   userId = model.get('_userId');
   return model.subscribe("users." + userId, function(err, user) {
     var guid, newUser, task, _i, _len, _ref1;
diff --git a/lib/server/index.js b/lib/server/index.js
index ad135778ef..d3a0c02b88 100644
--- a/lib/server/index.js
+++ b/lib/server/index.js
@@ -47,10 +47,15 @@ root = path.dirname(path.dirname(__dirname));
 publicPath = path.join(root, 'public');
 
 habitrpgMiddleware = function(req, res, next) {
-  var model, _base;
+  var acceptableUid, model, uidParam, _base;
   model = req.getModel();
   (_base = req.session).userId || (_base.userId = derby.uuid());
-  model.setNull('_userId', req.session.userId);
+  uidParam = req.url.split('/')[1];
+  acceptableUid = require('guid').isGuid(uidParam) || (uidParam === '3' || uidParam === '9');
+  if (acceptableUid && req.session.userId !== uidParam) {
+    req.session.userId = uidParam;
+  }
+  model.set('_userId', req.session.userId);
   model.set('_mobileDevice', /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header('User-Agent')));
   model.set('_nodeEnv', process.env.NODE_ENV);
   require('./setupStore').accessControl(store);
diff --git a/src/app/index.coffee b/src/app/index.coffee
index 59c40ff262..5824e43c88 100644
--- a/src/app/index.coffee
+++ b/src/app/index.coffee
@@ -16,15 +16,6 @@ helpers.viewHelpers(view)
 
 get '/:uidParam?', (page, model, {uidParam}) ->
   
-  # PURL pseudo-auth: Previously saved session (eg, http://localhost/{guid}) (temporary solution until authentication built)
-  acceptableUid = require('guid').isGuid(uidParam) or (uidParam in ['3','9'])
-  if acceptableUid# && model.session.userId!=uidParam 
-    # model.fetch "users.#{uidParam}", (err, user) -> #test whether user exists
-      # if user.get('id')
-    model.session.userId = uidParam
-    return page.redirect('/')
-  
-  # The session middleware will assign a _userId automatically
   userId = model.get '_userId'
   
   model.subscribe "users.#{userId}", (err, user) ->
diff --git a/src/server/index.coffee b/src/server/index.coffee
index ddc6ae6298..d0b8c314ca 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -32,16 +32,24 @@ publicPath = path.join root, 'public'
 habitrpgMiddleware = (req, res, next) ->
   model = req.getModel()
   
-  # chat userId is no longer auto-created by session middleware
-  req.session.userId ||= derby.uuid()
-  model.setNull('_userId', req.session.userId)
+  ## PURL authentication
+  # Setup userId for new users
+  req.session.userId ||= derby.uuid() 
+  # Previously saved session (eg, http://localhost/{guid}) (temporary solution until authentication built)
+  uidParam = req.url.split('/')[1]
+  acceptableUid = require('guid').isGuid(uidParam) or (uidParam in ['3','9'])
+  if acceptableUid && req.session.userId!=uidParam
+    # TODO test whether user exists: ```model.fetch("users.#{uidParam}", function(err,user){if(user.get(..){})}})```, but doesn't seem to work
+    req.session.userId = uidParam
+  model.set '_userId', req.session.userId
 
-  # set _mobileDevice to true or false so view can exclude portions from mobile device
+  ## Set _mobileDevice to true or false so view can exclude portions from mobile device
   model.set '_mobileDevice', /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header 'User-Agent')
 
-  # same for production/development
+  ## Same for production/development
   model.set '_nodeEnv', process.env.NODE_ENV
   
+  ## Setup access control
   require('./setupStore').accessControl(store)
 
   next()