@@ -140,7 +140,7 @@ clientSession.Values[appview.SessionDid] = atSessionish.GetDid()
 	clientSession.Values[appview.SessionPds] = pdsEndpoint
 	clientSession.Values[appview.SessionAccessJwt] = atSessionish.GetAccessJwt()
 	clientSession.Values[appview.SessionRefreshJwt] = atSessionish.GetRefreshJwt()
-	clientSession.Values[appview.SessionExpiry] = time.Now().Add(time.Hour).Format(time.RFC3339)
+	clientSession.Values[appview.SessionExpiry] = time.Now().Add(time.Minute * 15).Format(time.RFC3339)
 	clientSession.Values[appview.SessionAuthenticated] = true
 	return clientSession.Save(r, w)
 }

@@ -0,0 +1,112 @@
+package state
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+
+	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	lexutil "github.com/bluesky-social/indigo/lex/util"
+	tangled "github.com/sotangled/tangled/api/tangled"
+)
+
+func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
+	currentUser := s.auth.GetUser(r)
+
+	subject := r.URL.Query().Get("subject")
+	if subject == "" {
+		log.Println("invalid form")
+		return
+	}
+
+	subjectIdent, err := s.resolver.ResolveIdent(r.Context(), subject)
+	if err != nil {
+		log.Println("failed to follow, invalid did")
+	}
+
+	if currentUser.Did == subjectIdent.DID.String() {
+		log.Println("cant follow or unfollow yourself")
+		return
+	}
+
+	client, _ := s.auth.AuthorizedClient(r)
+
+	switch r.Method {
+	case http.MethodPost:
+		createdAt := time.Now().Format(time.RFC3339)
+		rkey := s.TID()
+		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
+			Collection: tangled.GraphFollowNSID,
+			Repo:       currentUser.Did,
+			Rkey:       rkey,
+			Record: &lexutil.LexiconTypeDecoder{
+				Val: &tangled.GraphFollow{
+					Subject:   subjectIdent.DID.String(),
+					CreatedAt: createdAt,
+				}},
+		})
+		if err != nil {
+			log.Println("failed to create atproto record", err)
+			return
+		}
+
+		err = s.db.AddFollow(currentUser.Did, subjectIdent.DID.String(), rkey)
+		if err != nil {
+			log.Println("failed to follow", err)
+			return
+		}
+
+		log.Println("created atproto record: ", resp.Uri)
+
+		w.Write([]byte(fmt.Sprintf(`
+			<button id="followBtn"
+				class="btn mt-2"
+				hx-delete="/follow?subject=%s"
+				hx-trigger="click"
+				hx-target="#followBtn"
+				hx-swap="outerHTML">
+				Unfollow
+			</button>
+		`, subjectIdent.DID.String())))
+
+		return
+	case http.MethodDelete:
+		// find the record in the db
+		follow, err := s.db.GetFollow(currentUser.Did, subjectIdent.DID.String())
+		if err != nil {
+			log.Println("failed to get follow relationship")
+			return
+		}
+
+		_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
+			Collection: tangled.GraphFollowNSID,
+			Repo:       currentUser.Did,
+			Rkey:       follow.RKey,
+		})
+
+		if err != nil {
+			log.Println("failed to unfollow")
+			return
+		}
+
+		err = s.db.DeleteFollow(currentUser.Did, subjectIdent.DID.String())
+		if err != nil {
+			log.Println("failed to delete follow from DB")
+			// this is not an issue, the firehose event might have already done this
+		}
+
+		w.Write([]byte(fmt.Sprintf(`
+			<button id="followBtn"
+				class="btn mt-2"
+				hx-post="/follow?subject=%s"
+				hx-trigger="click"
+				hx-target="#followBtn"
+				hx-swap="outerHTML">
+				Follow
+			</button>
+		`, subjectIdent.DID.String())))
+		return
+	}
+
+}

@@ -54,7 +54,8 @@ },
 				}
 				atSession, err := comatproto.ServerRefreshSession(r.Context(), &client)
 				if err != nil {
-					log.Println(err)
+					log.Println("failed to refresh session", err)
+					http.Redirect(w, r, "/login", http.StatusTemporaryRedirect)
 					return
 				}
 

@@ -682,106 +682,6 @@ DidHandleMap: didHandleMap,
 	})
 }
 
-func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
-	currentUser := s.auth.GetUser(r)
-
-	subject := r.URL.Query().Get("subject")
-	if subject == "" {
-		log.Println("invalid form")
-		return
-	}
-
-	subjectIdent, err := s.resolver.ResolveIdent(r.Context(), subject)
-	if err != nil {
-		log.Println("failed to follow, invalid did")
-	}
-
-	if currentUser.Did == subjectIdent.DID.String() {
-		log.Println("cant follow or unfollow yourself")
-		return
-	}
-
-	client, _ := s.auth.AuthorizedClient(r)
-
-	switch r.Method {
-	case http.MethodPost:
-		createdAt := time.Now().Format(time.RFC3339)
-		rkey := s.TID()
-		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
-			Collection: tangled.GraphFollowNSID,
-			Repo:       currentUser.Did,
-			Rkey:       rkey,
-			Record: &lexutil.LexiconTypeDecoder{
-				Val: &tangled.GraphFollow{
-					Subject:   subjectIdent.DID.String(),
-					CreatedAt: createdAt,
-				}},
-		})
-		if err != nil {
-			log.Println("failed to create atproto record", err)
-			return
-		}
-
-		err = s.db.AddFollow(currentUser.Did, subjectIdent.DID.String(), rkey)
-		if err != nil {
-			log.Println("failed to follow", err)
-			return
-		}
-
-		log.Println("created atproto record: ", resp.Uri)
-
-		w.Write([]byte(fmt.Sprintf(`
-			<button id="followBtn"
-				class="btn mt-2"
-				hx-delete="/follow?subject=%s"
-				hx-trigger="click"
-				hx-target="#followBtn"
-				hx-swap="outerHTML">
-				Unfollow
-			</button>
-		`, subjectIdent.DID.String())))
-
-		return
-	case http.MethodDelete:
-		// find the record in the db
-		follow, err := s.db.GetFollow(currentUser.Did, subjectIdent.DID.String())
-		if err != nil {
-			log.Println("failed to get follow relationship")
-			return
-		}
-
-		_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
-			Collection: tangled.GraphFollowNSID,
-			Repo:       currentUser.Did,
-			Rkey:       follow.RKey,
-		})
-
-		if err != nil {
-			log.Println("failed to unfollow")
-			return
-		}
-
-		err = s.db.DeleteFollow(currentUser.Did, subjectIdent.DID.String())
-		if err != nil {
-			log.Println("failed to delete follow from DB")
-			// this is not an issue, the firehose event might have already done this
-		}
-
-		w.Write([]byte(fmt.Sprintf(`
-			<button id="followBtn"
-				class="btn mt-2"
-				hx-post="/follow?subject=%s"
-				hx-trigger="click"
-				hx-target="#followBtn"
-				hx-swap="outerHTML">
-				Follow
-			</button>
-		`, subjectIdent.DID.String())))
-		return
-	}
-
-}
-
 func (s *State) Router() http.Handler {
 	router := chi.NewRouter()
 
@@ -861,8 +761,10 @@ r.Get("/", s.Timeline)
 
 	r.Get("/logout", s.Logout)
 
-	r.Get("/login", s.Login)
-	r.Post("/login", s.Login)
+	r.Route("/login", func(r chi.Router) {
+		r.Get("/", s.Login)
+		r.Post("/", s.Login)
+	})
 
 	r.Route("/knots", func(r chi.Router) {
 		r.Use(AuthMiddleware(s))