diff --git a/lib/app/index.js b/lib/app/index.js
index fd36e46192..d4cf251588 100644
--- a/lib/app/index.js
+++ b/lib/app/index.js
@@ -1,5 +1,5 @@
 // Generated by CoffeeScript 1.3.3
-var Guid, content, derby, get, ready, view, _ref;
+var Guid, content, derby, get, getHabits, ready, view, _ref;
 
 derby = require('derby');
 
@@ -76,18 +76,18 @@ view.fn("silver", function(num) {
   }
 });
 
-get('/:userId?', function(page, model, _arg) {
-  var userId;
-  userId = _arg.userId;
-  return model.subscribe("users", function(err, users) {
-    var debuggingUsers, guid, newUser, task, user, _i, _len, _ref1;
-    debuggingUsers = parseInt(userId) < 40;
-    if ((userId != null) && (users.get(userId) || debuggingUsers)) {
-      model.set('_userId', userId);
-      model.session.userId = userId;
+get('/:uidParam?', function(page, model, _arg) {
+  var uidParam;
+  uidParam = _arg.uidParam;
+  return model.fetch('users', function(err, users) {
+    var guid, newUser, task, user, userId, _i, _len, _ref1;
+    if ((uidParam != null) && users.get(uidParam)) {
+      model.set('_userId', uidParam);
+      model.session.userId = uidParam;
     }
     userId = model.get('_userId');
-    if (!model.get("users." + userId)) {
+    user = users.get(userId);
+    if (user == null) {
       newUser = {
         stats: {
           money: 0,
@@ -128,7 +128,23 @@ get('/:userId?', function(page, model, _arg) {
       }
       users.set(userId, newUser);
     }
-    user = model.at("users." + userId);
+    model.store.accessControl = true;
+    model.store.readPathAccess('users.*', function(id, accept) {
+      return accept(id === userId);
+    });
+    model.store.writeAccess('*', 'users.*', function(id, accept) {
+      console.log("model.writeAccess called with id:" + id);
+      return accept(id === userId);
+    });
+    return getHabits(page, model, userId);
+  });
+});
+
+getHabits = function(page, model, userId) {
+  return model.subscribe("users." + userId, function(err, user) {
+    console.log(userId, 'userId');
+    console.log(err, 'err');
+    console.log(user.get(), '[debug] user');
     model.ref('_user', user);
     model.set('_items', {
       armor: content.items.armor[parseInt(user.get('items.armor')) + 1],
@@ -145,7 +161,7 @@ get('/:userId?', function(page, model, _arg) {
     model.refList("_rewardList", "_user.tasks", "_user.rewardIds");
     return page.render();
   });
-});
+};
 
 ready(function(model) {
   var endOfDayTally, expModifier, hpModifier, poormanscron, setupSortable, step, tour, type, updateStats, _i, _j, _len, _len1, _ref1, _ref2;
diff --git a/src/app/index.coffee b/src/app/index.coffee
index e0af658954..a220691f4d 100644
--- a/src/app/index.coffee
+++ b/src/app/index.coffee
@@ -44,23 +44,22 @@ view.fn "silver", (num) ->
   
 ## ROUTES ##
 
-get '/:userId?', (page, model, {userId}) ->
-
-  model.subscribe "users", (err, users) ->
+get '/:uidParam?', (page, model, {uidParam}) ->
+  
+  model.fetch 'users', (err, users) ->
     
     # Previously saved session (eg, http://localhost/{guid}) (temporary solution until authentication built)
-    debuggingUsers = (parseInt(userId) < 40) #these are users created before guid was in use, need to convert them to guid and get rid of this 
-    if userId? and (users.get(userId) or debuggingUsers)
-      model.set '_userId', userId # set for this request
-      model.session.userId = userId # and for next requests
-   
+    if uidParam? and users.get(uidParam)
+      model.set '_userId', uidParam # set for this request
+      model.session.userId = uidParam # and for next requests
+    
     # Current browser session
     # The session middleware will assign a _userId automatically
-    # Render page if a userId is already stored in session data
     userId = model.get '_userId'
-
-    unless model.get "users.#{userId}"
-      # Otherwise, select a new userId and initialize user
+    user = users.get(userId)
+    
+    # Else, select a new userId and initialize user
+    unless user?
       newUser = {
         stats: { money: 0, exp: 0, lvl: 1, hp: 50 }
         items: { itemsEnabled: false, armor: 0, weapon: 0 }
@@ -76,8 +75,24 @@ get '/:userId?', (page, model, {userId}) ->
           when 'todo' then newUser.todoIds.push guid 
           when 'reward' then newUser.rewardIds.push guid 
       users.set userId, newUser
+      
+    #TODO these *Access functions aren't being called, why?      
+    model.store.accessControl = true
+    model.store.readPathAccess 'users.*', (id, accept) ->
+      accept(id == userId)
+    model.store.writeAccess '*', 'users.*', (id, accept) ->
+      console.log "model.writeAccess called with id:#{id}"
+      accept(id == userId)
+      
+    getHabits(page, model, userId)      
+      
+getHabits = (page, model, userId) ->  
 
-    user = model.at("users.#{userId}")
+  model.subscribe "users.#{userId}", (err, user) ->
+    console.log userId, 'userId'
+    console.log err, 'err'
+    console.log user.get(), '[debug] user'
+    
     model.ref '_user', user
     
     # Store