diff --git a/TODO.txt b/TODO.txt
index 8ae9d2c..98ea0df 100644
--- a/TODO.txt
+++ b/TODO.txt
@@ -1,8 +1,7 @@
-Check that the selected DB exists and is a valid Peachy DB
-	Set application_id and user_version when creating DB
 Use pattern matching (https://github.com/silentbicycle/tamale) for parsed sexps
 Write schema management package
 Unceremoniously dump a rudimentary schema management UI on index
 Set up page routes
 Figure out how Lua Server Pages work
 Try keeping shared state in a zipped file
+Make DB creation explicit, rather than automatic when opening a nonexistent file.
\ No newline at end of file
diff --git a/assets/.init.lua b/assets/.init.lua
index 6aad07a..50355e1 100644
--- a/assets/.init.lua
+++ b/assets/.init.lua
@@ -2,12 +2,34 @@ local migrate = require "migrate"
 
 local DB_FILENAME = "peachy.db"
 sqlite3 = require "lsqlite3"
+
+local function OpenDB(req)
+	local appID <const> = utf8.codepoint("🍑")
+	local filename = req.session.filename
+	if not filename then
+		error "no file selected"
+	end
+	local db = sqlite3.open(filename, sqlite3.OPEN_READWRITE)
+	if not db then
+		db, errcode, errmsg = sqlite3.open(filename)
+		if errcode then error(errmsg) end
+		errcode = db:exec(string.format("PRAGMA application_id=%d", appID))
+		if errcode ~= sqlite3.OK then error(db:errmsg()) end
+	end
+	local currentAppID
+	for id in db:urows("PRAGMA application_id") do currentAppID = id end
+	if currentAppID ~= appID then error("not a Peachy database") end
+	schema.setup(db)
+	req.db = db
+end
+
 local db = sqlite3.open(DB_FILENAME)
 db:exec("PRAGMA journal_mode=WAL")
 db:exec("PRAGMA foreign_keys")
 -- migrate.migrate(db)
 
 fm = require "fullmoon"
+schema = require "schema"
 fm.sessionOptions.secret = false
 fm.setTemplate({ "/tmpl/", tmpl = "fmt" })
 
@@ -24,6 +46,15 @@ fm.setRoute("/open", function(r)
 	local filename = r.session.filename or ""
 	return fm.serveContent("opendb", { filename = filename, dir = files })
 end)
+fm.setRoute("/testdb", function(r)
+	OpenDB(r)
+	local name = tostring(math.random(100000))
+	schema.new_node_type(r.db, name)
+	for ntype in schema.get_node_types(r.db) do
+		print(ntype)
+	end
+	return false
+end)
 fm.setRoute("/dirlist", function(r)
 	local function isSpecial(name)
 		return name == "." or name == ".." or string.sub(name, 1, 1) == "$"
diff --git a/assets/.lua/fullmoon.lua b/assets/.lua/fullmoon.lua
index da58ad1..db4b223 100644
--- a/assets/.lua/fullmoon.lua
+++ b/assets/.lua/fullmoon.lua
@@ -1335,7 +1335,7 @@ local function getSession()
     LogWarn("invalid session crypto hash: "..hash)
     return {}
   end
-  if DecodeBase64(sig) ~= GetCryptoHash(hash, msg, sopts.secret) then
+  if DecodeBase64(sig) ~= GetCryptoHash(hash, msg, sopts.secret or "") then
     LogWarn("invalid session signature: "..sig)
     return {}
   end