diff --git a/app/app.css b/app/app.css
index 4a1efde..faeaf74 100644
--- a/app/app.css
+++ b/app/app.css
@@ -665,9 +665,10 @@ nav ul li.active {
   margin-left: auto;
 }
 #yt pre {
+  margin: 0.5em 0.5ch;
   flex-grow: 1;
   overflow: auto;
-  white-space: pre;
+  white-space: pre-wrap;
 }
 #yt.pending header {
   background-image: linear-gradient(var(--primary), var(--primary));
diff --git a/app/css/yt.less b/app/css/yt.less
index 1cc0d6c..5064771 100644
--- a/app/css/yt.less
+++ b/app/css/yt.less
@@ -14,9 +14,10 @@
 	}
 
 	pre {
+		margin: 0.5em 0.5ch;
 		flex-grow: 1;
 		overflow: auto;
-		white-space: pre;
+		white-space: pre-wrap;
 	}
 
 	&.pending header {
diff --git a/app/js/lib/mpd.js b/app/js/lib/mpd.js
index 83c946c..2feeadb 100644
--- a/app/js/lib/mpd.js
+++ b/app/js/lib/mpd.js
@@ -138,9 +138,12 @@ export async function albumArt(songUrl) {
 }
 
 export async function init() {
+	let response = await fetch("/ticket", {method:"POST"});
+	let ticket = (await response.json()).ticket;
+
 	return new Promise((resolve, reject) => {
 		try {
-			ws = new WebSocket(`ws://${location.host}`);
+			ws = new WebSocket(`ws://${location.host}/?ticket=${encodeURIComponent(ticket)}`);
 		} catch (e) { reject(e); }
 		current = {resolve, reject};
 
diff --git a/index.js b/index.js
index 2b81cf3..f3d8b5d 100644
--- a/index.js
+++ b/index.js
@@ -2,14 +2,15 @@ const static = require("node-static");
 const app = new static.Server("./app");
 const port = Number(process.argv[2]) || 8080;
 
+let tickets = [];
+
 const cmd = "youtube-dl";
-//const cmd = "./test.sh";
+
 
 function downloadYoutube(q, response) {
 	response.setHeader("Content-Type", "text/plain"); // necessary for firefox to read by chunks
 //	response.setHeader("Content-Type", "text/plain; charset=utf-8");
 
-	// FIXME create directory
 	console.log("YouTube downloading", q);
 	let args = [
 		"-f", "bestaudio",
@@ -49,15 +50,42 @@ function handleYoutube(request, response) {
 	});
 }
 
+function handleTicket(request, response) {
+	request.resume().on("end", () => {
+		let ticket = require("crypto").randomBytes(16).toString("hex");
+		tickets.push(ticket);
+		if (tickets.length > 10) { tickets.shift(); }
+
+		let data = {ticket};
+		response.setHeader("Content-Type", "application/json");
+		response.end(JSON.stringify(data));
+	});
+}
+
 function onRequest(request, response) {
-	if (request.method == "POST" && request.url == "/youtube") {
-		return handleYoutube(request, response);
+	switch (true) {
+		case request.method == "POST" && request.url == "/youtube":
+			return handleYoutube(request, response);
+
+		case request.method == "POST" && request.url == "/ticket":
+			return handleTicket(request, response);
+
+		default:
+			return request.on("end", () => app.serve(request, response)).resume();
+	}
+}
+
+function requestValidator(request) {
+	let ticket = request.resourceURL.query["ticket"];
+	let index = tickets.indexOf(ticket);
+	if (index > -1) {
+		tickets.splice(index, 1);
+		return true;
 	} else {
-		request.on("end", () => app.serve(request, response)).resume();
+		return false;
 	}
 }
 
 let httpServer = require("http").createServer(onRequest).listen(port);
-require("ws2mpd").ws2mpd(httpServer, /.*/);
-//require("ws2mpd").ws2mpd(httpServer, `http://localhost:${port}`);
-//require("ws2mpd").logging(false);
+require("ws2mpd").ws2mpd(httpServer, requestValidator);
+require("ws2mpd").logging(false);
diff --git a/package.json b/package.json
index b9650ad..c166b75 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "main": "index.js",
   "dependencies": {
     "node-static": "^0.7.11",
-    "ws2mpd": "^1.1.0"
+    "ws2mpd": "^2.0.0"
   },
   "devDependencies": {
     "less": "^3.9.0"