diff --git a/lib/app/index.js b/lib/app/index.js
index 7127b99fc6..aebb99a196 100644
--- a/lib/app/index.js
+++ b/lib/app/index.js
@@ -19,12 +19,13 @@ helpers = require('./helpers');
 
 helpers.viewHelpers(view);
 
-get('/', function(page, model) {
-  var userId;
+get('/:uidParam?', function(page, model, _arg) {
+  var uidParam, userId;
+  uidParam = _arg.uidParam;
   userId = model.get('_userId');
   return model.fetch("users." + userId, function(err, user) {
     var guid, newUser, task, _i, _len, _ref1;
-    if (user == null) {
+    if (!user.get('id')) {
       newUser = schema.userSchema;
       _ref1 = content.defaultTasks;
       for (_i = 0, _len = _ref1.length; _i < _len; _i++) {
diff --git a/lib/server/index.js b/lib/server/index.js
index 30870ecf82..539fcbe074 100644
--- a/lib/server/index.js
+++ b/lib/server/index.js
@@ -1,6 +1,5 @@
 // Generated by CoffeeScript 1.3.3
-var ONE_YEAR, app, customMiddleware, derby, express, expressApp, gzippo, http, path, publicPath, racer, root, server, serverError, store,
-  __indexOf = [].indexOf || function(item) { for (var i = 0, l = this.length; i < l; i++) { if (i in this && this[i] === item) return i; } return -1; };
+var ONE_YEAR, app, customMiddleware, derby, express, expressApp, gzippo, http, path, publicPath, racer, root, server, serverError, store;
 
 http = require('http');
 
@@ -38,7 +37,7 @@ store = derby.createStore({
   listen: server
 });
 
-require('./queries')(store);
+require('./setupStore').accessControl(store);
 
 ONE_YEAR = 1000 * 60 * 60 * 24 * 365;
 
@@ -46,31 +45,20 @@ root = path.dirname(path.dirname(__dirname));
 
 publicPath = path.join(root, 'public');
 
-customMiddleware = function(req, res, next) {
-  var acceptableUid, model, uidParam, _i, _results;
-  model = req.getModel();
-  model.set('_mobileDevice', /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header('User-Agent')));
-  uidParam = req.url.split('/')[1];
-  acceptableUid = require('Guid').isGuid(uidParam) || (__indexOf.call((function() {
-    _results = [];
-    for (_i = 0; _i <= 40; _i++){ _results.push(_i); }
-    return _results;
-  }).apply(this), uidParam) >= 0);
-  if (acceptableUid && model.session.userId !== uidParam) {
-    model.fetch("users." + uidParam, function(err, user) {
-      console.log({
-        uidParam: uidParam,
-        split: req.url.split('/'),
-        err: err,
-        user: user
-      });
-      if (!user.get('id')) {
-        model.set('_userId', uidParam);
-        return model.session.userId = uidParam;
-      }
-    });
-  }
-  return next();
+customMiddleware = function(that) {
+  return function(req, res, next) {
+    var acceptableUid, model, uidParam;
+    model = req.getModel();
+    model.set('_mobileDevice', /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header('User-Agent')));
+    uidParam = req.url.split('/')[1];
+    acceptableUid = require('Guid').isGuid(uidParam) || (uidParam === '3' || uidParam === '4' || uidParam === '9');
+    if (acceptableUid && model.session.userId !== uidParam) {
+      model.set('_userId', uidParam);
+      model.session.userId = uidParam;
+    }
+    next();
+    return that;
+  };
 };
 
 expressApp.use(express.favicon()).use(gzippo.staticGzip(publicPath, {
@@ -80,7 +68,7 @@ expressApp.use(express.favicon()).use(gzippo.staticGzip(publicPath, {
   cookie: {
     maxAge: ONE_YEAR
   }
-})).use(store.modelMiddleware()).use(customMiddleware).use(app.router()).use(expressApp.router).use(serverError(root));
+})).use(store.modelMiddleware()).use(customMiddleware(this)).use(app.router()).use(expressApp.router).use(serverError(root));
 
 expressApp.all('*', function(req) {
   throw "404: " + req.url;
diff --git a/lib/server/queries.js b/lib/server/queries.js
deleted file mode 100644
index 654f250716..0000000000
--- a/lib/server/queries.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Generated by CoffeeScript 1.3.3
-
-module.exports = function(store) {
-  return store.query.expose('users', 'withId', function(id) {
-    return this.byId(id);
-  });
-};
diff --git a/lib/server/setupStore.js b/lib/server/setupStore.js
new file mode 100644
index 0000000000..b637f7ce96
--- /dev/null
+++ b/lib/server/setupStore.js
@@ -0,0 +1,19 @@
+// Generated by CoffeeScript 1.3.3
+
+module.exports.queries = function(store) {
+  return store.query.expose('users', 'withId', function(id) {
+    return this.byId(id);
+  });
+};
+
+module.exports.accessControl = function(store) {
+  store.accessControl = true;
+  store.readPathAccess('users.*', function(userId, accept) {
+    console.log(accept, 'read.accept');
+    return accept(userId === this.session.userId);
+  });
+  return store.writeAccess('*', 'users.*', function(mutator, userId, accept) {
+    console.log(accept, 'write.accept');
+    return accept(userId === this.session.userId);
+  });
+};
diff --git a/src/app/index.coffee b/src/app/index.coffee
index 91c582633f..93328a3516 100644
--- a/src/app/index.coffee
+++ b/src/app/index.coffee
@@ -12,7 +12,7 @@ helpers.viewHelpers(view)
 
 # ========== ROUTES ==========
 
-get '/', (page, model) ->
+get '/:uidParam?', (page, model, {uidParam}) ->
   
   # Current browser session
   # The session middleware will assign a _userId automatically
@@ -21,7 +21,7 @@ get '/', (page, model) ->
   model.fetch "users.#{userId}", (err, user) ->
     
     # Else, select a new userId and initialize user
-    unless user?
+    unless user.get('id')
       newUser = schema.userSchema
       for task in content.defaultTasks
         guid = task.id = require('derby/node_modules/racer').uuid()
@@ -33,15 +33,6 @@ get '/', (page, model) ->
           when 'reward' then newUser.rewardIds.push guid 
       model.set "users.#{userId}", newUser
       
-    # #TODO these *Access functions aren't being called, why?      
-    # model.store.accessControl = true
-    # model.store.readPathAccess 'users.*', (id, accept) ->
-      # console.log "model.writeAccess called with id:#{id}" # never called
-      # accept(id == userId)
-    # model.store.writeAccess '*', 'users.*', (id, accept) ->
-      # console.log "model.writeAccess called with id:#{id}" # never called
-      # accept(id == userId)
-      
     getHabits(page, model, userId)      
       
 getHabits = (page, model, userId) ->  
diff --git a/src/server/index.coffee b/src/server/index.coffee
index 6e562cbd0e..ee3bffb836 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -24,28 +24,30 @@ derby.use(require 'racer-db-mongo')
 store = derby.createStore
   db: {type: 'Mongo', uri: process.env.NODE_DB_URI}
   listen: server
-require('./queries')(store)
+require('./setupStore').accessControl(store)
 
 ONE_YEAR = 1000 * 60 * 60 * 24 * 365
 root = path.dirname path.dirname __dirname
 publicPath = path.join root, 'public'
 
-customMiddleware = (req, res, next) ->
-  # Setup for mobile-device customizations
-  model = req.getModel()
-  model.set '_mobileDevice', /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header 'User-Agent')
-  
-  # PURL pseudo-auth: Previously saved session (eg, http://localhost/{guid}) (temporary solution until authentication built)
-  uidParam = req.url.split('/')[1]
-  acceptableUid = require('Guid').isGuid(uidParam) or (uidParam in [0..40])
-  if acceptableUid and model.session.userId!=uidParam 
-    model.fetch "users.#{uidParam}", (err, user) ->
-      console.log {uidParam:uidParam, split:req.url.split('/'), err:err, user:user}
-      unless user.get('id')
-        model.set '_userId', uidParam # set for this request
-        model.session.userId = uidParam # and for next requests
-      
-  next()
+customMiddleware = (that) -> 
+  return (req, res, next) ->
+    # Setup for mobile-device customizations
+    model = req.getModel()
+    model.set '_mobileDevice', /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header 'User-Agent')
+    
+    uidParam = req.url.split('/')[1]
+    # PURL pseudo-auth: Previously saved session (eg, http://localhost/{guid}) (temporary solution until authentication built)
+    acceptableUid = require('Guid').isGuid(uidParam) or (uidParam in ['3','4','9'])
+    if acceptableUid and model.session.userId!=uidParam 
+      ##FIXME why isn't this working?
+      # model.fetch "users.#{uidParam}", (err, user) ->
+        # console.log {uidParam:uidParam, split:req.url.split('/'), err:err, user:user}
+        # unless user.get('id')
+      model.set '_userId', uidParam # set for this request
+      model.session.userId = uidParam # and for next requests
+    next()
+    return that
     
 expressApp
   .use(express.favicon())
@@ -70,7 +72,7 @@ expressApp
   .use(store.modelMiddleware())
   # Middelware can be inserted after the modelMiddleware and before
   # the app router to pass server accessible data to a model
-  .use(customMiddleware)
+  .use(customMiddleware(this))
   # Creates an express middleware from the app's routes
   .use(app.router())
   .use(expressApp.router)
diff --git a/src/server/queries.coffee b/src/server/queries.coffee
deleted file mode 100644
index d554f6ff70..0000000000
--- a/src/server/queries.coffee
+++ /dev/null
@@ -1,3 +0,0 @@
-module.exports = (store) ->
-  store.query.expose 'users', 'withId', (id) ->
-    @byId(id)
diff --git a/src/server/setupStore.coffee b/src/server/setupStore.coffee
new file mode 100644
index 0000000000..1d94c43451
--- /dev/null
+++ b/src/server/setupStore.coffee
@@ -0,0 +1,17 @@
+# expose query motifs 
+module.exports.queries = (store) ->
+  store.query.expose 'users', 'withId', (id) ->
+    @byId(id)
+    
+# setup accessControl
+module.exports.accessControl = (store) ->
+  
+  store.accessControl = true
+  
+  store.readPathAccess 'users.*', (userId, accept) ->
+    console.log accept, 'read.accept'
+    accept(userId == @session.userId)
+    
+  store.writeAccess '*', 'users.*', (mutator, userId, accept) ->
+    console.log accept, 'write.accept'
+    accept(userId == @session.userId)