diff --git a/core/database/foxx/api/user_router.js b/core/database/foxx/api/user_router.js
index eb43be123..5c98cfc56 100644
--- a/core/database/foxx/api/user_router.js
+++ b/core/database/foxx/api/user_router.js
@@ -328,7 +328,7 @@ router.get('/find/by_name_uid', function(req, res) {
                 cnt = req.queryParams.count ? req.queryParams.count : 20;
 
             var result = g_db._query("for u in userview search analyzer(u.name in tokens(@name,'user_name'), 'user_name')" +
-                " let s = BM25(u) filter s > 2 sort s desc limit @off,@cnt return {uid:u._id,name_last:u.name_last,name_first:u.name_first}", {
+                " let s = BM25(u) filter s > 0 sort s desc limit @off,@cnt return {uid:u._id,name_last:u.name_last,name_first:u.name_first}", {
                     name: name,
                     off: off,
                     cnt: cnt
@@ -1011,4 +1011,4 @@ router.get('/ep/set', function(req, res) {
     .queryParam('client', joi.string().required(), "Client ID")
     .queryParam('eps', joi.array().items(joi.string()).required(), "End-points (UUIDs or legacy names)")
     .summary('Set recent end-points')
-    .description('Set recent end-points');
\ No newline at end of file
+    .description('Set recent end-points');
diff --git a/web/datafed-ws.js b/web/datafed-ws.js
index 9d3b8671e..cb8a40386 100755
--- a/web/datafed-ws.js
+++ b/web/datafed-ws.js
@@ -574,6 +574,7 @@ app.get('/api/usr/list/all', ( a_req, a_resp ) => {
     sendMessage( "UserListAllRequest", par, a_req, a_resp, function( reply ) {
         a_resp.json(reply);
     });
+
 });
 
 app.get('/api/usr/list/collab', ( a_req, a_resp ) => {
@@ -586,6 +587,7 @@ app.get('/api/usr/list/collab', ( a_req, a_resp ) => {
     sendMessage( "UserListCollabRequest", par, a_req, a_resp, function( reply ) {
         a_resp.json(reply);
     });
+
 });
 
 app.post('/api/prj/create', ( a_req, a_resp ) => {
diff --git a/web/static/dlg_pick_user.js b/web/static/dlg_pick_user.js
index 0d6d1e693..be17467b2 100644
--- a/web/static/dlg_pick_user.js
+++ b/web/static/dlg_pick_user.js
@@ -65,8 +65,8 @@ export function show(  a_uid, a_excl, a_single_sel, cb ){
     var search_input = $("#search_input",frame);
 
     var src = [
-        {title:"Collaborators",icon:"ui-icon ui-icon-folder",folder:true,lazy:true,unselectable:true,key:"collab"},
-        {title:"By Groups",icon:"ui-icon ui-icon-folder",folder:true,lazy:true,unselectable:true,key:"groups"},
+        {title:"Collaborators",icon:"ui-icon ui-icon-folder",folder:true,lazy:true,unselectable:true,key:"collab",offset:0},
+        {title:"By Groups",icon:"ui-icon ui-icon-folder",folder:true,lazy:true,unselectable:true,key:"groups",offset:0},
         {title:"All",icon:"ui-icon ui-icon-folder",folder:true,lazy:true,unselectable:true,key:"all",offset:0},
         {title:"Search Results",icon:"ui-icon ui-icon-folder",folder:true,lazy:true,unselectable:true,key:"search",offset:0}
     ];
@@ -130,11 +130,12 @@ export function show(  a_uid, a_excl, a_single_sel, cb ){
         },
         postProcess: function( ev, a_data ) {
             var i;
-
+            
             if ( a_data.node.key == "collab" || a_data.node.key == "all" || a_data.node.key == "search" ){
                 a_data.result = [];
                 if ( a_data.response.offset > 0 || a_data.response.total > (a_data.response.offset + a_data.response.count )){
-                    var pages = Math.ceil(a_data.response.total/settings.opts.page_sz), page = 1+a_data.response.offset/settings.opts.page_sz;
+                    var pages = Math.ceil(a_data.response.total/settings.opts.page_sz);
+                    var page = 1+a_data.response.offset/settings.opts.page_sz;
                     a_data.result.push({title:
                         "<button id='first_page' class='btn btn-icon-tiny' "+(page==1?" disabled":"")+"><span class='ui-icon ui-icon-triangle-1-w-stop'></span></button> " +
                         "<button id='back_page' class='btn btn-icon-tiny' "+(page==1?" disabled":"")+"><span class='ui-icon ui-icon-triangle-1-w'></span></button> " +
@@ -146,24 +147,9 @@ export function show(  a_uid, a_excl, a_single_sel, cb ){
                       unselectable:true,
                       hasBtn:true });
 
-              
-                  $(document).ready(function() {
-                    $('#first_page').click(function() {
-                      userPageLoad(a_data.node.key,0);
-                    });
-                    $('#back_page').click(function() {
-                      userPageLoad(a_data.node.key, (page-2)*settings.opts.page_sz);
-                    });
-                    $('#forward_page').click(function() {
-                      userPageLoad(a_data.node.key, page*settings.opts.page_sz);
-                    });
-                    $('#last_page').click(function() {
-                      userPageLoad(a_data.node.key, (pages-1)*settings.opts.page_sz);
-                    });
-                  });
+                  a_data.node.page = page;
+                  a_data.node.pages = pages;
                 }
-
-                console.log(a_data.result);
                 var user,unsel;
                 for ( i in a_data.response.user ) {
                     user = a_data.response.user[i];
@@ -197,6 +183,18 @@ export function show(  a_uid, a_excl, a_single_sel, cb ){
         renderNode: function(ev,data){
             if ( data.node.data.hasBtn ){
                 $(".btn",data.node.li).button();
+                $('#first_page', data.node.span).click(function() {
+                  userPageLoad(data.node.parent.key,0);
+                });
+                $('#back_page', data.node.span).click(function() {
+                  userPageLoad(data.node.parent.key, (data.node.parent.page-2)*settings.opts.page_sz);
+                });
+                $('#forward_page', data.node.span).click(function() {
+                  userPageLoad(data.node.parent.key, data.node.parent.page*settings.opts.page_sz);
+                });
+                $('#last_page', data.node.span).click(function() {
+                  userPageLoad(data.node.parent.key, (data.node.parent.pages-1)*settings.opts.page_sz);
+                });
             }
         },
     });
diff --git a/web/static/dlg_set_acls.js b/web/static/dlg_set_acls.js
index 48141d87b..211457084 100644
--- a/web/static/dlg_set_acls.js
+++ b/web/static/dlg_set_acls.js
@@ -383,7 +383,7 @@ export function show( item ){
                             group = groups.find( function(elem){ return elem.gid == gid; } );
                             if ( group ){
                                 node.resetLazy();
-                                node.setTitle( utils.escapeHTML( group.title ) + " (" + gid + ")");
+                                node.setTitle( util.escapeHTML( group.title ) + " (" + gid + ")");
                             }else{
                                 new_rules.splice(i,1);
                                 node.remove();
diff --git a/web/views/docs.ect b/web/views/docs.ect
index b44699b6d..30cd53676 100644
--- a/web/views/docs.ect
+++ b/web/views/docs.ect
@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
     <head>
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8;script-src 'nonce-<%= @nonce %> 'self'">
         <% include 'head.ect' %>
         <title>DataFed Help</title>
     </head>
diff --git a/web/views/register.ect b/web/views/register.ect
index adefef3bc..61d9029d4 100644
--- a/web/views/register.ect
+++ b/web/views/register.ect
@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
     <head>
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8;script-src 'nonce-<%= @nonce %> 'self'">
         <% include 'head.ect' %>
         <title>DataFed Register</title>
         <script type="application/json" id="template_data">
@@ -8,9 +9,9 @@
             "uname" : "<%- @uname %>"
         }
         </script>
-        <script type="module" charset="utf-8" src="/dialogs.js"></script>
-        <script type="module" charset="utf-8" src="/api.js"></script>
-        <script type="module" charset="utf-8" src="/register.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dialogs.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/api.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/register.js"></script>
     </head>
     <body>
         <div class="col-flex ui-widget-content" style="height:100%;border:none">