diff --git a/Gemfile b/Gemfile
index df39a3b..c6ce3ae 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,6 +12,7 @@ gem "addressable"
 gem "omniauth"
 gem "omniauth_openid_connect"
 gem "redcarpet"
+gem "rackup"
 # needed for when we go to ruby 3.3, but we aren't there yet
 # gem "csv" # included here because httparty uses it and ought to requirequire it
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 8a5e3fc..7050645 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -11,9 +11,9 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (7.1.2)
-      activesupport (= 7.1.2)
-    activesupport (7.1.2)
+    activemodel (7.1.3)
+      activesupport (= 7.1.3)
+    activesupport (7.1.3)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
@@ -26,17 +26,17 @@ GEM
     addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     aes_key_wrap (1.1.0)
-    anyway_config (2.6.1)
+    anyway_config (2.6.2)
       ruby-next-core (~> 1.0)
     ast (2.4.2)
     attr_required (1.0.2)
     base64 (0.2.0)
-    bigdecimal (3.1.5)
+    bigdecimal (3.1.6)
     bindata (2.4.15)
     byebug (11.1.3)
     climate_control (1.2.0)
     coderay (1.1.3)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
     crack (0.4.5)
       rexml
@@ -48,13 +48,12 @@ GEM
     dry-initializer (3.1.1)
     email_validator (2.2.4)
       activemodel
-    faraday (2.8.1)
-      base64
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
+    faraday (2.9.0)
+      faraday-net_http (>= 2.0, < 3.2)
     faraday-follow_redirects (0.3.0)
       faraday (>= 1, < 3)
-    faraday-net_http (3.0.2)
+    faraday-net_http (3.1.0)
+      net-http
     hashdiff (1.1.0)
     hashie (5.0.0)
     httparty (0.21.0)
@@ -80,20 +79,22 @@ GEM
       net-smtp
     method_source (1.0.0)
     mini_mime (1.1.5)
-    minitest (5.20.0)
+    minitest (5.21.2)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     mustermann (3.0.0)
       ruby2_keywords (~> 0.0.1)
     mutex_m (0.2.0)
-    net-imap (0.4.9)
+    net-http (0.4.1)
+      uri
+    net-imap (0.4.9.1)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.2)
       timeout
-    net-smtp (0.4.0)
+    net-smtp (0.4.0.1)
       net-protocol
     nio4r (2.7.0)
     omniauth (2.1.2)
@@ -117,7 +118,7 @@ GEM
       validate_url
       webfinger (~> 2.0)
     parallel (1.24.0)
-    parser (3.2.2.4)
+    parser (3.3.0.5)
       ast (~> 2.4.1)
       racc
     prometheus-client (4.2.2)
@@ -128,10 +129,10 @@ GEM
       byebug (~> 11.0)
       pry (>= 0.13, < 0.15)
     public_suffix (5.0.4)
-    puma (6.4.1)
+    puma (6.4.2)
       nio4r (~> 2.0)
     racc (1.7.3)
-    rack (2.2.8)
+    rack (3.0.8)
     rack-oauth2 (2.2.1)
       activesupport
       attr_required
@@ -139,14 +140,19 @@ GEM
       faraday-follow_redirects
       json-jwt (>= 1.11.0)
       rack (>= 2.1.0)
-    rack-protection (3.2.0)
+    rack-protection (4.0.0)
       base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.0.0)
+      rack (>= 3.0.0)
     rack-test (2.1.0)
       rack (>= 1.3)
+    rackup (2.1.0)
+      rack (>= 3)
+      webrick (~> 1.8)
     rainbow (3.1.1)
     redcarpet (3.6.0)
-    regexp_parser (2.8.3)
+    regexp_parser (2.9.0)
     rexml (3.2.6)
     rspec (3.12.0)
       rspec-core (~> 3.12.0)
@@ -174,7 +180,7 @@ GEM
       unicode-display_width (>= 2.4.0, < 3.0)
     rubocop-ast (1.30.0)
       parser (>= 3.2.1.0)
-    rubocop-performance (1.20.1)
+    rubocop-performance (1.20.2)
       rubocop (>= 1.48.1, < 2.0)
       rubocop-ast (>= 1.30.0, < 2.0)
     ruby-next-core (1.0.0)
@@ -186,16 +192,17 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
-    sinatra (3.2.0)
+    sinatra (4.0.0)
       mustermann (~> 3.0)
-      rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.2.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.0.0)
+      rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (3.2.0)
+    sinatra-contrib (4.0.0)
       multi_json (>= 0.0.2)
       mustermann (~> 3.0)
-      rack-protection (= 3.2.0)
-      sinatra (= 3.2.0)
+      rack-protection (= 4.0.0)
+      sinatra (= 4.0.0)
       tilt (~> 2.0)
     sinatra-flash (0.3.0)
       sinatra (>= 1.0.0)
@@ -208,9 +215,9 @@ GEM
     standard-custom (1.0.2)
       lint_roller (~> 1.0)
       rubocop (~> 1.50)
-    standard-performance (1.3.0)
+    standard-performance (1.3.1)
       lint_roller (~> 1.1)
-      rubocop-performance (~> 1.20.1)
+      rubocop-performance (~> 1.20.2)
     swd (2.0.3)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
@@ -222,6 +229,7 @@ GEM
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.5.0)
+    uri (0.13.0)
     validate_url (1.0.15)
       activemodel (>= 3.0.0)
       public_suffix
@@ -233,6 +241,7 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.8.1)
     yabeda (0.12.0)
       anyway_config (>= 1.0, < 3)
       concurrent-ruby
@@ -263,6 +272,7 @@ DEPENDENCIES
   pry-byebug
   puma
   rack-test
+  rackup
   redcarpet
   rspec
   simplecov
@@ -276,4 +286,4 @@ DEPENDENCIES
   yabeda-puma-plugin
 
 BUNDLED WITH
-   2.5.4
+   2.5.5
diff --git a/env.development b/env.development
index af86db0..b71547d 100644
--- a/env.development
+++ b/env.development
@@ -4,6 +4,6 @@ JWT_SECRET='jwt_secret'
 PATRON_ACCOUNT_BASE_URL='http://localhost:4567'
 CIRCULATION_HISTORY_URL='http://circulation-history:3000'
 CIRCULATION_HISTORY_API_KEY='circulation_history_api_key'
-RACK_COOKIE_SECRET='rack_cookie_secret_this_is_extra_text_so_that_it_is_32_bytes_aa'
+RACK_COOKIE_SECRET='rack_cookie_secret_this_is_extra_text_so_that_it_is_32_bytes_aaaaa'
 WEBLOGIN_ID='patron-account-testing'
 WEBLOGIN_URL='https://weblogin.lib.umich.edu'