diff --git a/TODO.md b/TODO.md
index 481a988..cdf1df1 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,5 +1,7 @@
 ## high importance
 
+- [ ] nix services/ and split it up into core/ request/ 
+
 - [ ] Add unit tests all over the place.
   - ⚠️ Huge task - needs breakdown before starting
 
@@ -11,8 +13,8 @@
 
 
 - [ ] Add authentication
-  - password
-  - third party?
+  - [ ] password
+  - [ ] third party?
 
 
 - [ ] Add middleware concept
@@ -43,7 +45,14 @@
         think we can make handlers a lot shorter to write, sometimes not even
         necessary at all, with some sane defaults and an easy to use override
         mechanism
-        
+
+- [ ] fill in the rest of express/http-codes.ts
+
+- [ ] fill out express/content-types.ts
+
+
+- [ ] identify redundant "old skool" and ajax routes, factor out their
+      commonalities, etc.
 
 - [ ] figure out and add logging to disk
 
@@ -72,6 +81,13 @@
 - [ ] make migration creation default to something like yyyy-mm-dd_ssss (are
       9999 migrations in a day enough?)
 
+- [ ] clean up `cmd` and `mgmt`: do the right thing with their commonalities
+      and make very plain which is which for what.  Consider additional
+      commands.  Maybe `develop` for specific development tasks,
+      `operate` for operational tasks, and we keep `cmd` for project-specific
+      commands.  Something like that.
+
+
 ## low importance
 
 - [ ] add a prometheus-style `/metrics` endpoint to master