diff --git a/src/app/index.coffee b/src/app/index.coffee
index b4d27a9cb0..2c2f3340ca 100644
--- a/src/app/index.coffee
+++ b/src/app/index.coffee
@@ -24,6 +24,8 @@ _ = require('underscore')
 # ========== ROUTES ==========
 
 get '/', (page, model, next) ->
+  return page.redirect '/' if page.params?.query?.play?
+
   # temporary view variables, so we don't call model.set() too fast
   _view = model.get '_view' || {}
 
diff --git a/src/app/party.coffee b/src/app/party.coffee
index 2e5c269671..0284d2444d 100644
--- a/src/app/party.coffee
+++ b/src/app/party.coffee
@@ -23,7 +23,7 @@ module.exports.partySubscribe = partySubscribe = (model, cb) ->
   # partyUnsubscribe model, ->
 
   # Restart subscription to the main user
-  selfQ = model.query('users').withId(model.get('_userId') or model.session.userId)
+  selfQ = model.query('users').withId model.get('_userId') #or model.session.userId # see http://goo.gl/TPYIt
   selfQ.subscribe (err, self) ->
     throw err if err
     u = self.at(0)
@@ -166,7 +166,7 @@ module.exports.app = (appExports, model) ->
 #    model.set '_party', null
 #    model.set '_partyMembers', null
 #    partyUnsubscribe model, ->
-#      selfQ = model.query('users').withId(model.get('_userId') or model.session.userId)
+#      selfQ = model.query('users').withId model.get('_userId') #or model.session.userId # see http://goo.gl/TPYIt
 #      selfQ.subscribe (err, u) ->
 #        model.ref '_user', u.at(0)
 #        browser.resetDom model
\ No newline at end of file
diff --git a/src/server/api.coffee b/src/server/api.coffee
index f394945f09..84531744f3 100644
--- a/src/server/api.coffee
+++ b/src/server/api.coffee
@@ -24,8 +24,8 @@ router.post '/users/:uid/tasks/:taskId/:direction', (req, res) ->
   return res.send(500, ':taskId required') unless taskId
   return res.send(500, ":direction must be 'up' or 'down'") unless direction in ['up','down']
 
-  model = req.getModel()
   req._isServer = true
+  model = req.getModel()
   model.fetch model.query('users').withIdAndToken(uid, apiToken), (err, result) ->
     return res.send(500, err) if err
     user = result.at(0)
diff --git a/src/server/private.coffee b/src/server/private.coffee
index 5e7c148ab4..f882bac83b 100644
--- a/src/server/private.coffee
+++ b/src/server/private.coffee
@@ -50,7 +50,7 @@ module.exports.routes = (expressApp) ->
         return res.send(500, err.response.error.message)
       else
         model = req.getModel()
-        userId = model.get('_userId') or model.session.userId
+        userId = model.get('_userId') #or model.session.userId # see http://goo.gl/TPYIt
         req._isServer = true
         model.fetch "users.#{userId}", (err, user) ->
           model.ref '_user', "users.#{userId}"
diff --git a/src/server/store.coffee b/src/server/store.coffee
index 38476d72cc..cebd70e5cd 100644
--- a/src/server/store.coffee
+++ b/src/server/store.coffee
@@ -1,3 +1,5 @@
+derbyAuth = require('derby-auth/store')
+
 ###
 Setup read / write access
 @param store
@@ -14,14 +16,21 @@ module.exports.customAccessControl = (store) ->
 userAccess = (store) ->
 
   store.readPathAccess "users.*", -> # captures, accept, err ->
+    accept = arguments[arguments.length-2]
+    err = arguments[arguments.length - 1]
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
+
     accept = arguments[arguments.length - 2]
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
     uid = arguments[0]
-    accept (uid is @session.userId) or @session.req?._isServer
+    accept (uid is @session.userId) or derbyAuth.isServer(@)
 
   store.writeAccess "*", "users.*", -> # captures, value, accept, err ->
     accept = arguments[arguments.length-2]
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
+    err = arguments[arguments.length - 1]
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
+
     captures = arguments[0].split('.')
     uid = captures.shift()
     attrPath = captures.join('.') # new array shifted left, after shift() was run
@@ -31,21 +40,25 @@ userAccess = (store) ->
       return accept(true)
 
     # Same session (user.id = this.session.userId)
-    if (uid is @session.userId) or @session.req?._isServer
+    if (uid is @session.userId) or derbyAuth.isServer(@)
       return accept(true)
 
     accept(false)
 
   store.writeAccess "*", "users.*.balance", (id, newBalance, accept, err) ->
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
+
     oldBalance = @session.req?._racerModel?.get("users.#{id}.balance") || 0
     purchasingSomethingOnClient = newBalance < oldBalance
     accept(purchasingSomethingOnClient or @session.req?._isServer)
 
   store.writeAccess "*", "users.*.flags.ads", -> # captures, value, accept, err ->
-    accept = arguments[arguments.length - 1]
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
-    accept(@session.req?._isServer)
+    err = arguments[arguments.length - 1]
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
+
+    accept(derbyAuth.isServer(@))
 
 
 ###
@@ -53,14 +66,14 @@ userAccess = (store) ->
   Get user with API token
 ###
 REST = (store) ->
-  store.query.expose "users", "withIdAndToken", (id, apiToken) ->
-    @where("id").equals(id)
-      .where('apiToken').equals(apiToken)
-      .limit(1)
+  store.query.expose "users", "withIdAndToken", (uid, token) ->
+    @byId(uid)
+      .where('apiToken').equals(token)
+      .one
 
-  store.queryAccess "users", "withIdAndToken", (id, apiToken, accept, err) ->
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
-    accept(true) # only user has id & token
+  store.queryAccess "users", "withIdAndToken", (uid, token, accept, err) ->
+    return accept(true) if uid && token
+    accept(false) # only user has id & token
 
 
 ###
@@ -77,11 +90,15 @@ partySystem = (store) ->
             'auth.facebook.displayName')
 
   store.queryAccess "users", "party", (ids, accept, err) ->
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
     accept(true) # no harm in public user stats
 
   store.query.expose "parties", "withId", (id) ->
     @where("id").equals(id)
   store.queryAccess "parties", "withId", (id, accept, err) ->
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
     accept(true)
 
   store.readPathAccess "parties.*", ->
@@ -90,4 +107,7 @@ partySystem = (store) ->
 
   store.writeAccess "*", "parties.*", ->
     accept = arguments[arguments.length-2]
-    accept(true)
\ No newline at end of file
+    err = arguments[arguments.length - 1]
+#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    return accept(false) if derbyAuth.bustedSession(@)
+    accept(true)