diff --git a/lib/apis.js b/lib/apis.js
index 2d1e659..d8f9da3 100644
--- a/lib/apis.js
+++ b/lib/apis.js
@@ -2,7 +2,8 @@
 
 module.exports.create = function (xconfx, apiFactories, apiDeps) {
   var PromiseA = apiDeps.Promise;
-  var express = require('express');
+  //var express = require('express');
+  var express = require('express-lazy');
   var fs = PromiseA.promisifyAll(require('fs'));
   var path = require('path');
   var localCache = { rests: {}, pkgs: {} };
@@ -59,7 +60,7 @@ module.exports.create = function (xconfx, apiFactories, apiDeps) {
     // TODO should not require package.json. Should work with files alone.
     return fs.readFileAsync(path.join(pkgPath, 'package.json'), 'utf8').then(function (text) {
       var pkg = JSON.parse(text);
-      var deps = {};
+      var pkgDeps = {};
       var myApp;
 
       if (pkg.walnut) {
@@ -67,10 +68,10 @@ module.exports.create = function (xconfx, apiFactories, apiDeps) {
       }
 
       Object.keys(apiDeps).forEach(function (key) {
-        deps[key] = apiDeps[key];
+        pkgDeps[key] = apiDeps[key];
       });
       Object.keys(apiFactories).forEach(function (key) {
-        deps[key] = apiFactories[key];
+        pkgDeps[key] = apiFactories[key];
       });
 
       // TODO pull db stuff from package.json somehow and pass allowed data models as deps
@@ -81,10 +82,38 @@ module.exports.create = function (xconfx, apiFactories, apiDeps) {
       // deps.memstore = apiFactories.memstoreFactory.create(req.experienceId + pkgId);
 
       // let's go with this one for now and the api can choose to scope or not to scope
-      deps.memstore = apiFactories.memstoreFactory.create(pkgId);
+      pkgDeps.memstore = apiFactories.memstoreFactory.create(pkgId);
 
       console.log('DEBUG pkgPath', pkgPath);
       myApp = express();
+
+/*
+			var pkgConf = {
+				pagespath: path.join(__dirname, '..', '..', 'packages', 'pages') + path.sep
+			, apipath: path.join(__dirname, '..', '..', 'packages', 'apis') + path.sep
+			, servicespath: path.join(__dirname, '..', '..', 'packages', 'services')
+			, vhostsMap: vhostsMap
+			, vhostPatterns: null
+			, server: webserver
+			, externalPort: info.conf.externalPort
+			, primaryNameserver: info.conf.primaryNameserver
+			, nameservers: info.conf.nameservers
+			, privkey: info.conf.privkey
+			, pubkey: info.conf.pubkey
+			, redirects: info.conf.redirects
+			, apiPrefix: '/api'
+			, 'org.oauth3.consumer': info.conf['org.oauth3.consumer']
+			, 'org.oauth3.provider': info.conf['org.oauth3.provider']
+			, keys: info.conf.keys
+			};
+*/
+
+      var _getOauth3Controllers = pkgDeps.getOauth3Controllers = require('oauthcommon/example-oauthmodels').create(
+        { sqlite3Sock: xconfx.sqlite3Sock, ipcKey: xconfx.ipcKey }
+      ).getControllers;
+      //require('oauthcommon').inject(packagedApi._getOauth3Controllers, packagedApi._api, pkgConf, pkgDeps);
+      require('oauthcommon').inject(_getOauth3Controllers, myApp/*, pkgConf, pkgDeps*/);
+
       myApp.use('/', function preHandler(req, res, next) {
         req.originalUrl = req.originalUrl || req.url;
         // "/path/api/com.example/hello".replace(/.*\/api\//, '').replace(/([^\/]*\/+)/, '/') => '/hello'
@@ -97,7 +126,7 @@ module.exports.create = function (xconfx, apiFactories, apiDeps) {
       //
       return PromiseA.resolve(require(pkgPath).create({
         etcpath: xconfx.etcpath
-      }/*pkgConf*/, deps/*pkgDeps*/, myApp/*myApp*/)).then(function (handler) {
+      }/*pkgConf*/, pkgDeps/*pkgDeps*/, myApp/*myApp*/)).then(function (handler) {
         localCache.pkgs[pkgId] = { pkg: pkg, handler: handler || myApp, createdAt: Date.now() };
         return localCache.pkgs[pkgId];
       });
diff --git a/lib/main.js b/lib/main.js
index c0fe00f..67f46bf 100644
--- a/lib/main.js
+++ b/lib/main.js
@@ -50,8 +50,11 @@ module.exports.create = function (app, xconfx, apiFactories, apiDeps, errorIfApi
 
   function notConfigured(req, res, next) {
     if (setupDomain !== req.hostname) {
-      redirectSetup(req.hostname, req, res);
-      return;
+      console.log('[notConfigured] req.hostname', req.hostname);
+      if (/\.html\b/.test(req.url)) {
+        redirectSetup(req.hostname, req, res);
+        return;
+      }
     }
 
     if (!setupApp) {
@@ -73,6 +76,7 @@ module.exports.create = function (app, xconfx, apiFactories, apiDeps, errorIfApi
       // path.join('packages/pages', 'domain.tld#hello') // dynamic exact url match
       var sitepath = path.join(xconfx.sitespath, name);
 
+      console.log('sitepath', sitepath);
       return fs.lstatAsync(sitepath).then(function (stat) {
         if (stat.isSymbolicLink()) {
           return disallowSymLinks;
@@ -141,22 +145,44 @@ module.exports.create = function (app, xconfx, apiFactories, apiDeps, errorIfApi
       }
       nodes.sort(shortToLong);
 
-      nodes.forEach(function (name) {
-        console.log('[all apps]', name);
-        if (!localCache.statics[name]) {
-          console.log('[load this app]', name);
-          localCache.statics[name] = { handler: loadSiteHandler(name), createdAt: Date.now() };
+      nodes = nodes.filter(function (pkgName) {
+        console.log('[all apps]', pkgName);
+        // load the apps that match this id's domain and could match the path
+        // domain.daplie.me matches domain.daplie.me
+        // daplie.me#path#to#thing matches daplie.me
+        // daplie.me does NOT match daplie.me#path#to#thing
+        var reqParts = appId.split('#');
+        var pkgParts = pkgName.split('#');
+        var reqDomain = reqParts.shift();
+        var pkgDomain = pkgParts.shift();
+        var reqPath = reqParts.join('#');
+        var pkgPath = pkgParts.join('#');
+        if (reqPath.length) {
+          reqPath += '#';
         }
+        if (pkgPath.length) {
+          pkgPath += '#';
+        }
+        if (!(reqDomain === pkgDomain && 0 === reqPath.indexOf(pkgPath))) {
+          return false;
+        }
+        if (!localCache.statics[pkgName]) {
+          console.log('[load this app]', pkgName);
+          localCache.statics[pkgName] = { handler: loadSiteHandler(pkgName), createdAt: Date.now() };
+        }
+        return true;
       });
 
       // Secure Matching
       // apple.com#blah#  apple.com#blah#
       // apple.com.us#    apple.com#foo#
       // apple.com#       apple.com#foo#
-      nodes.some(function (name) {
-        if (0 === (name + '#').indexOf(appId + '#')) {
-          if (appId !== name) {
-            localCache.statics[appId] = localCache.statics[name];
+      console.log('nodes', nodes);
+      nodes.some(function (pkgName) {
+        console.log('pkgName, appId', pkgName, appId);
+        if (0 === (appId + '#').indexOf(pkgName + '#')) {
+          if (appId !== pkgName) {
+            localCache.statics[appId] = localCache.statics[pkgName];
           }
           return true;
         }
diff --git a/lib/worker.js b/lib/worker.js
index e1c1cff..6a9fe44 100644
--- a/lib/worker.js
+++ b/lib/worker.js
@@ -188,6 +188,11 @@ module.exports.create = function (webserver, xconfx, state) {
 
           if (!bootstrapApp) {
             if (xconfx.debug) { console.log('[bootstrap] setup'); }
+            if (xconfx.primaryDomain) {
+              bootstrapApp = true;
+              setupMain();
+              return;
+            }
             bootstrapApp = express();
             require('./bootstrap').create(bootstrapApp, xconfx, models).then(function () {
               if (xconfx.debug) { console.log('[bootstrap] ready'); }