diff --git a/Assistant/Threads/WebApp.hs b/Assistant/Threads/WebApp.hs
index 50add37354..3e53828af8 100644
--- a/Assistant/Threads/WebApp.hs
+++ b/Assistant/Threads/WebApp.hs
@@ -38,9 +38,9 @@ data WebApp = WebApp
 staticFiles "static"
 
 mkYesod "WebApp" [parseRoutes|
-/static StaticR Static getStatic
 / HomeR GET
 /config ConfigR GET
+/static StaticR Static getStatic
 |]
 
 instance Yesod WebApp where
@@ -62,12 +62,12 @@ instance Yesod WebApp where
 
 getHomeR :: Handler RepHtml
 getHomeR = defaultLayout $ do
-	[whamlet|Hello, World<p><a href=@{ConfigR}>config|]
+	[whamlet|Hello, World<p><a href="@{ConfigR}">config|]
 
 getConfigR :: Handler RepHtml
 getConfigR = defaultLayout $ do
 	setTitle "configuration"
-	[whamlet|<a href=@{HomeR}>main|]
+	[whamlet|<a href="@{HomeR}">main|]
 
 webAppThread :: ThreadState -> DaemonStatusHandle -> IO ()
 webAppThread st dstatus = do
diff --git a/doc/design/assistant/webapp.mdwn b/doc/design/assistant/webapp.mdwn
index cec766c579..0f6051d6d6 100644
--- a/doc/design/assistant/webapp.mdwn
+++ b/doc/design/assistant/webapp.mdwn
@@ -4,7 +4,7 @@ The webapp is a web server that displays a shiny interface.
 
 * Listen only to localhost. **done**
 * Instruct the user's web browser to open an url that contains a secret
-  token. This guards against other users on the same system.
+  token. This guards against other users on the same system. **done**
 * I would like to avoid passwords or other authentication methods,
   it's your local system.
 * Alternative for Linux at least would be to write a small program using