diff --git a/js/controllers/website-controller.js b/js/controllers/website-controller.js
index 1cb3d84..ee31b86 100644
--- a/js/controllers/website-controller.js
+++ b/js/controllers/website-controller.js
@@ -11,10 +11,15 @@ function handleFiles(ev) {
     return;
   }
 
-  $scope  = angular.element(ev.target).scope();
+  $scope = angular.element(ev.target).scope();
   // 'vm' is the Controller As name.
   vm = $scope.vm;
   vm.currentFiles = ev.target.files;
+  var file = vm.currentFiles[0];
+  vm.isZip = /\.zip$/.test(file.name);
+  vm.unzip = vm.isZip;
+  vm.stripZip = vm.isZip;
+  $scope.$digest();
   console.log('vm.currentFiles', vm.currentFiles);
 }
 window.document.body.addEventListener('change', handleFiles);
@@ -25,13 +30,15 @@ app.controller('websiteCtrl', [
 
   var vm = this;
   vm.domains = [];
+  //vm.unzipPath = '/';
+  vm.webPath = '/';
 
   Auth.api = function (apiname, opts) {
     var els = [];
 
     return $q.all(Auth.sessions.map(function (session) {
 
-      return Auth.select(session).then(function (oauth3) {
+      return Auth.get(session).then(function (oauth3) {
 
         return oauth3.api(apiname, {}).then(function (collection) {
 
@@ -80,6 +87,14 @@ app.controller('websiteCtrl', [
     if (!vm.domain) {
       vm.domain = { domain: vm.newDomain };
     }
+
+    if (!vm.domain.tld) {
+      var parts = vm.domain.domain.split('.');
+      vm.domain.sld = parts.shift();
+      vm.domain.tld = parts.join('.');
+    }
+
+    vm.setRecord();
   };
 
   vm.selectDomain = function (domain) {
@@ -103,6 +118,20 @@ app.controller('websiteCtrl', [
     });
   };
 
+  vm.setRecord = function () {
+    // TODO set record based on (record.host === sub + domain.domain)
+    var sub = vm.newRecord;
+
+    if ('@' === sub) {
+      sub = '';
+    }
+    vm.record = { sub: sub, host: (sub ? sub + '.' : '') + vm.domain.domain };
+    vm.currentHost = vm.record.host;
+
+    console.log('vm.record', vm.record);
+    console.log('vm.currentHost', vm.currentHost);
+  };
+
   vm.selectRecord = function (record) {
     vm.record = record;
     vm.newRecord = record.sub;
@@ -117,24 +146,28 @@ app.controller('websiteCtrl', [
     , sld: vm.domain.sld
     //, sub: vm.record.sub
     , multipart: { site: vm.currentFiles[0] }
+    , unzip: vm.unzip
+    , strip: vm.stripZip
+    , path: vm.webPath
     }).then(function (result) {
       window.alert(JSON.stringify(result));
     });
   };
 
   vm._isSubDomain = function (sub, domain) {
-    return -1 === ('.' + sub).indexOf(('.' + domain));
+    return -1 !== ('.' + sub).indexOf(('.' + domain));
   };
 
   vm.createWebsite = function () {
+    console.log('##### Auth.oauth3');
+    console.log(Auth.oauth3);
+
     var pkg = Auth.oauth3.pkg('www@daplie.com');
     var parts;
     var sub;
     var sld;
     var tld;
 
-    console.log('Auth.oauth3', Auth.oauth3);
-
     //vm.unlock('webpreneur');
     if (!vm.currentFiles || !vm.currentFiles.length) {
       window.alert('No files chosen.');
@@ -149,17 +182,15 @@ app.controller('websiteCtrl', [
       return;
     }
 
-    // already validated
-    if (vm.sites.some(function (r) {
-      return -1 !== ('.' + vm.currentHost).indexOf(('.' + r.domain));
-    })) {
-      vm._createWebsite(pkg);
-    }
-
     if (vm.domain) {
-      parts = vm.domain.domain.split('.');
-      sld = parts.shift();
-      tld = parts.join('.');
+      if (!vm.domain.tld || !vm.domain.sld) {
+        parts = vm.domain.domain.split('.');
+        sld = parts.shift();
+        tld = parts.join('.');
+      } else {
+        sld = vm.domain.sld;
+        tld = vm.domain.tld;
+      }
     } else {
       parts = vm.currentHost.split('.');
       // TODO get list of tlds
@@ -168,29 +199,48 @@ app.controller('websiteCtrl', [
       sub = parts.join('.');
     }
 
+    // already validated
+    if (vm.sites.some(function (r) {
+      return -1 !== ('.' + vm.currentHost).indexOf(('.' + r.domain));
+    })) {
+      vm._createWebsite(pkg);
+      return;
+    }
+
     // We're making a request to claim a domain
     // (because two users could both claim a single domain)
     // We're claiming it at the top level (i.e. example.com)
     // but we could also claim it at the subdomain level (needs UI update)
-    return pkg.request({ sld: sld, tld: tld, sub: undefined }).then(function (result) {
+    var domainReq = { sld: sld, tld: tld, sub: undefined };
+    return pkg.request(domainReq).then(function (result) {
       var sess;
       var prom;
       var def;
       console.log('[pkg www] request domain');
-      console.log(result);
+      console.log(result.data);
+
+      console.log('[pkg www] vm.domain.session:');
+      console.log(vm.domain.session);
+
+      console.log(vm.currentHost, vm.domain.domain);
+      console.log(vm._isSubDomain(vm.currentHost, vm.domain.domain));
 
       // can validate automatically
       if (vm.domain.session && vm._isSubDomain(vm.currentHost, vm.domain.domain)) {
         // this should always succeed
         Auth.sessions.some(function (session) {
+          console.log('#', session.token.sub + '@' + session.token.iss);
           if (vm.domain.session === (session.token.sub + '@' + session.token.iss)) {
+            console.log('=', session.token.sub + '@' + session.token.iss);
             sess = session;
             return session;
           }
         });
 
         if (sess) {
-          prom = Auth.select(sess).then(function (oauth3) {
+          console.log('[pkg www] session selected', sess);
+          prom = Auth.get(sess).then(function (oauth3) {
+            console.log('[pkg www] instance selected', oauth3);
             return oauth3.api('dns.set', { sld: sld, tld: tld, sub: ('' + result.data.prefix), type: 'TXT', ttl: 300, value: result.data.challenge });
           });
         }
@@ -209,7 +259,12 @@ app.controller('websiteCtrl', [
       }
 
       return prom.then(function () {
-        vm._createWebsite(pkg);
+        console.log('[pkg www] after pkg');
+        console.log(pkg);
+        return pkg.claim(domainReq).then(function (result) {
+          console.log('[pkg www] claim', result);
+          return vm._createWebsite(pkg);
+        });
       });
 
     });
@@ -221,23 +276,21 @@ app.controller('websiteCtrl', [
     return $q.all(Auth.sessions.map(function (session) {
 
       console.log('[www] select');
-      return Auth.select(session).then(function (oauth3) {
-        console.log('[www] oauth3', oauth3._resourceProviderDirectives);
+      return Auth.get(session).then(function (oauth3) {
         var pkg = oauth3.pkg('www@daplie.com');
-        console.log('[www] post pkg', oauth3._resourceProviderDirectives);
 
         return pkg.list().then(function (result) {
-          var sites = result.data;
+          var _sites = result.data;
 
-          if (Array.isArray(sites)) {
-            sites = sites.concat(sites);
+          if (Array.isArray(_sites)) {
+            sites = _sites.concat(sites);
             return;
           }
 
-          console.error('sites is not an array');
-          console.error(sites);
+          console.error('_sites is not an array');
+          console.error(_sites);
         }, function (err) {
-          console.error('sites had an error');
+          console.error('_sites had an error');
           console.error(err);
         });
       });
diff --git a/js/services/auth-service.js b/js/services/auth-service.js
index 0bc7791..7acba02 100644
--- a/js/services/auth-service.js
+++ b/js/services/auth-service.js
@@ -66,7 +66,7 @@ app.factory('Auth', [
       });
       return Auth.session;
     }
-  , select: function (session) {
+  , get: function (session) {
       if (!session.issuer) {
         throw new Error("session doesn't have an issuer");
       }
@@ -97,12 +97,16 @@ app.factory('Auth', [
       console.log('session.subject:', session.subject);
       console.log('session:', session);
 
-      promise.then(function (oauth3) {
+      return promise;
+    }
+  , select: function (session) {
+      return Auth.get(session).then(function (oauth3) {
+        var dapName = 'dap-' + session.subject + '|' + session.issuer;
+        localStorage.setItem(dapSession, dapName);
+
         Auth.session = session;
         Auth.oauth3 = oauth3;
-      })
-
-      return promise;
+      });
     }
   , signOut: function () {
       var session = Auth.session;
diff --git a/js/www@daplie.com.js b/js/www@daplie.com.js
index 472226b..2cb17b6 100644
--- a/js/www@daplie.com.js
+++ b/js/www@daplie.com.js
@@ -7,11 +7,12 @@ OAUTH3._pkgs['www@daplie.com'] = {
   add: function (opts) {
     var providerUri = opts.audience;
     var session = opts.session;
-    debugger;
+
     return OAUTH3.request({
       method: 'POST'
     , url: OAUTH3.url.normalize(providerUri)
         + '/api/www@daplie.com/acl/add/' + opts.hostname
+        + '?' + OAUTH3.utils.query.stringify({ tld: opts.tld, sld: opts.sld/*, sub: opts.sub*/, unzip: opts.unzip, strip: opts.strip, path: opts.path })
     , session: session
     , multipart: opts.multipart // special property to be figured out by browser request code
     }).then(function (result) {
@@ -48,6 +49,24 @@ OAUTH3._pkgs['www@daplie.com'] = {
     }).then(function (result) {
       // result.data
 
+      return result;
+    });
+  }
+, claim: function (opts) {
+    var providerUri = opts.audience;
+    var session = opts.session;
+
+    return OAUTH3.request({
+      method: 'POST'
+    , url: OAUTH3.url.normalize(providerUri)
+        + '/api/www@daplie.com/acl/claim/:tld/:sld/:sub'
+            .replace(/(:tld)/, opts.tld)
+            .replace(/(:sld)/, opts.sld)
+            .replace(/(:sub)/, opts.sub || '')
+    , session: session
+    }).then(function (result) {
+      // result.data
+
       return result;
     });
   }
diff --git a/templates/website.html b/templates/website.html
index 53e0de0..8358702 100644
--- a/templates/website.html
+++ b/templates/website.html
@@ -44,7 +44,15 @@
         <br>
         -->
         <div class="input-group">
-          <label>Select .zip upload</label> <input type="file" class="js-file-upload this-has-a-special-non-angular-event-handler" />
+          <div><label>Select .zip upload</label> <input type="file" class="js-file-upload this-has-a-special-non-angular-event-handler" /></div>
+
+          <div ng-if="vm.isZip" ><label><input type="checkbox" ng-model="vm.unzip" /> Unpack .zip</label></div>
+
+          <div ng-if="vm.unzip" ><label><input type="checkbox" ng-model="vm.stripZip" /> Strip zip directory root</label></div>
+
+          <!-- div ng-if="vm.isZip" ><label>Unzip directory</label> <input type="text" ng-model="vm.unzipPath" /></div -->
+
+          <div><label>Web path</label> <input type="text"  ng-model="vm.webPath"  /></div>
         </div>
       </div>
     </div>