--- a/bitsyblog/bitsyblog.py	Fri Oct 30 18:49:55 2009 -0400
+++ b/bitsyblog/bitsyblog.py	Sat Oct 31 00:17:42 2009 -0400
@@ -255,12 +255,12 @@
         """
         write a blog entry and other POST requests
         """
-        # TODO: posting to '/' ?
         
         # find user + path
         user, path = self.userpath(request)
 
-        check = self.check_user(user)
+        # check to make sure the user is authenticated
+        check = self.check_user(user, request)
         if check is not None:
             return check
 
@@ -289,7 +289,7 @@
                 if privacy:
                     self.blog.delete(user, datestamp)
                     self.blog.post(user, datestamp, entry.body, privacy)
-                return exc.HTTPSeeOther("Settings updated", location='/%s/%s' % (user, datestamp))
+                return exc.HTTPSeeOther("Settings updated", location=self.user_url(request, user, datestamp))
             else:
                 return exc.HTTPMethodNotAllowed("Not sure what you're trying to do")
         
@@ -299,14 +299,14 @@
         body = body.strip()
         if not body:
             return exc.HTTPSeeOther("Your post has no content!  No blog for you", 
-                                    location='/%s' % self.user_url(request, user, 'post'))
+                                    location=self.user_url(request, user, 'post'))
 
         # determine if the post is secret or private
         privacy = request.GET.get('privacy') or request.POST.get('privacy') or 'public'
 
         # write the file
         now = utils.datestamp(datetime.datetime.now())
-        location = "/%s" % self.user_url(request, user, now)
+        location = self.user_url(request, user, now)
         self.blog.post(user, now, body, privacy)
 
         # point the user at the post