diff --git a/lib/commands/invitation.js b/lib/commands/invitation.js
index 2624389e7..337e56bec 100644
--- a/lib/commands/invitation.js
+++ b/lib/commands/invitation.js
@@ -7,9 +7,10 @@ const Invitation = module.exports;
 const Invite = require('../storage/invite');
 const Util = require("../common-util");
 const Users = require("./users");
+const Crypto = require('node:crypto');
 
 const getUid = () => {
-    return Util.uid() + Util.uid() + Util.uid();
+    return Crypto.randomBytes(18).toString('hex');
 };
 
 Invitation.getAll = (Env, cb) => {
diff --git a/lib/http-commands.js b/lib/http-commands.js
index 2d2ad7436..f5e027804 100644
--- a/lib/http-commands.js
+++ b/lib/http-commands.js
@@ -129,7 +129,7 @@ var handleCommand = function (Env, req, res) {
         COMMANDS[command](Env, body, function (err) {
             if (err) {
                 Env.Log.error('CHALLENGE_COMMAND_EXECUTION_ERROR', {
-                    body: body,
+                    command,
                     error: Util.serializeError(err),
                 });
                 // errors returned from commands are passed back to the client
@@ -229,16 +229,6 @@ var handleResponse = function (Env, req, res) {
             });
         }
 
-        // garbage collection can clean this up later
-        Challenge.delete(Env, txid, function (err) {
-            if (err) {
-                Env.Log.error("CHALLENGE_DELETION_ERROR", {
-                    txid: txid,
-                    error: Util.serializeError(err),
-                });
-            }
-        });
-
         var json = Util.tryParse(text);
 
         if (!json) {
@@ -284,8 +274,7 @@ var handleResponse = function (Env, req, res) {
             u8_publicKey = Util.decodeBase64(publicKey);
         } catch (err3) {
             Env.Log.error('CHALLENGE_RESPONSE_DECODING_ERROR', {
-                text: text,
-                sig: sig,
+                command,
                 publicKey: publicKey,
                 error: Util.serializeError(err3),
             });
@@ -305,6 +294,16 @@ var handleResponse = function (Env, req, res) {
             });
         }
 
+        // garbage collection can clean this up later
+        Challenge.delete(Env, txid, function (err) {
+            if (err) {
+                Env.Log.error("CHALLENGE_DELETION_ERROR", {
+                    txid: txid,
+                    error: Util.serializeError(err),
+                });
+            }
+        });
+
         // execute the command
         action(Env, json, function (err, content) {
             if (err) {
diff --git a/lib/http-worker.js b/lib/http-worker.js
index b1768016f..03dac79c7 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -258,7 +258,7 @@ app.use('/ssoauth', (req, res, next) => {
                 Log.error('E_SSO_WRITE_REQ', err);
                 return res.sendStatus(500);
             }
-            let value = `samltoken="${token}"; SameSite=Strict; HttpOnly`;
+            let value = `samltoken="${token}"; SameSite=Strict; HttpOnly; Path=/; Secure`;
             res.setHeader('Set-Cookie', value);
             next();
         });
@@ -750,22 +750,6 @@ var send500 = function (res, path) {
     });
 };
 
-app.get('/api/updatequota', function (req, res) {
-    if (!Env.accounts_api) {
-        res.status(404);
-        return void send404(res);
-    }
-    sendMessage({
-        command: 'UPDATE_QUOTA',
-    }, (err) => {
-        if (err) {
-            res.status(500);
-            return void send500(res);
-        }
-        res.send();
-    });
-});
-
 app.get('/api/profiling', function (req, res) {
     if (!Env.enableProfiling) { return void send404(res); }
     sendMessage({
diff --git a/lib/storage/basic.js b/lib/storage/basic.js
index 96e353e76..667c6498b 100644
--- a/lib/storage/basic.js
+++ b/lib/storage/basic.js
@@ -89,3 +89,7 @@ Basic.restore = function (Env, archivePath, path, cb) {
         cb(err);
     });
 };
+
+Basic.isValidId = id => {
+    return id && typeof(id) === "string" && /^[a-zA-Z0-9-+=]+$/.test(id);
+};
diff --git a/lib/storage/challenge.js b/lib/storage/challenge.js
index 914284e00..8217f5c5e 100644
--- a/lib/storage/challenge.js
+++ b/lib/storage/challenge.js
@@ -22,7 +22,9 @@ const Challenge = module.exports;
 */
 
 const pathFromId = function (Env, id) {
-    if (!id || typeof(id) !== 'string') { return void console.error('CHALLENGE_BAD_ID', id); }
+    if (!Basic.isValidId(id)) {
+        return void console.error('CHALLENGE_BAD_ID', id);
+    }
     return Path.join(Env.paths.base, "challenges", id.slice(0, 2), id);
 };
 
diff --git a/lib/storage/invite.js b/lib/storage/invite.js
index 90220eb94..2ef2c4316 100644
--- a/lib/storage/invite.js
+++ b/lib/storage/invite.js
@@ -17,7 +17,9 @@ const Invite = module.exports;
 */
 
 const pathFromId = function (Env, id) {
-    if (!id || typeof(id) !== 'string') { return void console.error('INVITE_BAD_ID', id); }
+    if (!Basic.isValidId(id)) {
+        return void console.error('INVITE_BAD_ID', id);
+    }
     return Path.join(Env.paths.base, "invitations", id.slice(0, 2), id);
 };
 
diff --git a/lib/storage/mfa.js b/lib/storage/mfa.js
index d84539f69..572dc3c28 100644
--- a/lib/storage/mfa.js
+++ b/lib/storage/mfa.js
@@ -28,6 +28,7 @@ so that it can be accessed quickly.
 var pathFromId = function (Env, id) {
     if (!id || typeof(id) !== 'string') { return; }
     id = Util.escapeKeyCharacters(id);
+    if (!Basic.isValidId(id)) { return; }
     return Path.join(Env.paths.base, "mfa", id.slice(0, 2), `${id}.json`);
 };
 
diff --git a/lib/storage/moderator.js b/lib/storage/moderator.js
index b889497c1..6ae0b214e 100644
--- a/lib/storage/moderator.js
+++ b/lib/storage/moderator.js
@@ -14,7 +14,9 @@ const Moderator = module.exports;
 */
 
 const pathFromId = function (Env, id) {
-    if (!id || typeof(id) !== 'string') { return void console.error('KNWONUSER_BAD_ID', id); }
+    if (!Basic.isValidId(id)) {
+        return void console.error('MODERATOR_BAD_ID', id);
+    }
     return Path.join(Env.paths.base, "support", id.slice(0, 2), id);
 };
 
diff --git a/lib/storage/sessions.js b/lib/storage/sessions.js
index 85ac3c1b1..f2deacec3 100644
--- a/lib/storage/sessions.js
+++ b/lib/storage/sessions.js
@@ -25,6 +25,7 @@ const Sessions = module.exports;
 
 var pathFromId = function (Env, id, ref) {
     if (!id || typeof(id) !== 'string') { return; }
+    if (!Basic.isValidId(ref)) { return; }
     id = Util.escapeKeyCharacters(id);
     return Path.join(Env.paths.base, "sessions", id.slice(0, 2), id, ref);
 };
diff --git a/lib/storage/sso.js b/lib/storage/sso.js
index ba9de3b6a..a2bda171f 100644
--- a/lib/storage/sso.js
+++ b/lib/storage/sso.js
@@ -20,6 +20,7 @@ The path for the user database is based on their persistent identifier (id) from
 var pathFromId = function (Env, id, subPath) {
     if (!id || typeof(id) !== 'string') { return; }
     id = Util.escapeKeyCharacters(id);
+    if (!Basic.isValidId(id)) { return; }
     return Path.join(Env.paths.base, subPath, id.slice(0, 2), `${id}.json`);
 };
 var reqPathFromId = function (Env, id) {
diff --git a/lib/storage/user.js b/lib/storage/user.js
index a1dc4a15a..659541d54 100644
--- a/lib/storage/user.js
+++ b/lib/storage/user.js
@@ -14,7 +14,9 @@ const User = module.exports;
 */
 
 const pathFromId = function (Env, id) {
-    if (!id || typeof(id) !== 'string') { return void console.error('KNWONUSER_BAD_ID', id); }
+    if (!Basic.isValidId(id)) {
+        return void console.error('USER_BAD_ID', id);
+    }
     return Path.join(Env.paths.base, "users", id.slice(0, 2), id);
 };