diff --git a/authn/authenticate.go b/authn/authenticate.go
index 89c599894..214b5a0c6 100644
--- a/authn/authenticate.go
+++ b/authn/authenticate.go
@@ -34,7 +34,7 @@ func NewAuth(logger logger.Logger, url string, scopes []string, authUrl, tokenUr
 	auth := &Auth{
 		logger:         logger,
 		cookieName:     "molecula-chip",
-		refreshWithin:  time.Second * time.Duration(15),
+		refreshWithin:  time.Minute * time.Duration(15),
 		groupEndpoint:  groupEndpoint,
 		logoutEndpoint: "https://login.microsoftonline.com/common/oauth2/v2.0/logout",
 		fbURL:          url,
@@ -49,22 +49,17 @@ func NewAuth(logger logger.Logger, url string, scopes []string, authUrl, tokenUr
 			},
 		},
 	}
-	data, err := decodeHex(hashKey)
-	if err != nil {
+	var err error
+	if auth.hashKey, err = decodeHex(hashKey); err != nil {
 		return nil, errors.Wrap(err, "decoding hash key")
 	}
-	auth.hashKey = data
 
-	data, err = decodeHex(blockKey)
-	if err != nil {
+	if auth.blockKey, err = decodeHex(blockKey); err != nil {
 		return nil, errors.Wrap(err, "decoding block key")
 	}
-	auth.blockKey = data
 
 	auth.secure = securecookie.New(auth.hashKey, auth.blockKey)
 
-	auth.logger.Infof("AUTH: %+v", auth)
-
 	return auth, nil
 }
 
diff --git a/authn/authenticate_test.go b/authn/authenticate_test.go
index 627b41567..5099cf007 100644
--- a/authn/authenticate_test.go
+++ b/authn/authenticate_test.go
@@ -99,12 +99,12 @@ func TestAuth(t *testing.T) {
 	// })
 
 	t.Run("Logout", func(t *testing.T) {
-		r := httptest.NewRequest(gohttp.MethodGet, "/login", nil)
+		r := httptest.NewRequest(gohttp.MethodGet, "/logout", nil)
 		w := httptest.NewRecorder()
 		a.Logout(w, r)
 	})
 	t.Run("Authenticate", func(t *testing.T) {
-		r := httptest.NewRequest(gohttp.MethodGet, "/login", nil)
+		r := httptest.NewRequest(gohttp.MethodGet, "/authenticate", nil)
 		w := httptest.NewRecorder()
 		a.Authenticate(w, r)
 	})
@@ -114,7 +114,7 @@ func TestAuth(t *testing.T) {
 	// 	a.Redirect(w, r)
 	// })
 	t.Run("GetUserInfo", func(t *testing.T) {
-		r := httptest.NewRequest(gohttp.MethodGet, "/login", nil)
+		r := httptest.NewRequest(gohttp.MethodGet, "/userinfo", nil)
 		a.GetUserInfo(r)
 	})
 
diff --git a/http/handler.go b/http/handler.go
index 0852242aa..ada6a0f48 100644
--- a/http/handler.go
+++ b/http/handler.go
@@ -363,7 +363,7 @@ func (h *Handler) collectStats(next http.Handler) http.Handler {
 
 // latticeRoutes lists the frontend routes that do not directly correspond to
 // backend routes, and require special handling.
-var latticeRoutes = []string{"/tables", "/query", "/querybuilder", "/login"} // TODO somehow pull this from some metadata in the lattice directory
+var latticeRoutes = []string{"/tables", "/query", "/querybuilder", "/signin"} // TODO somehow pull this from some metadata in the lattice directory
 
 // newRouter creates a new mux http router.
 func newRouter(handler *Handler) http.Handler {
@@ -458,7 +458,7 @@ func newRouter(handler *Handler) http.Handler {
 	router.HandleFunc("/cpu-profile/stop", handler.handleCPUProfileStop).Methods("GET").Name("CPUProfileStop")
 
 	router.HandleFunc("/login", handler.handleLogin).Methods("GET").Name("Login")
-	router.HandleFunc("/logout", handler.handleLogout).Methods("GET").Name("Login")
+	router.HandleFunc("/logout", handler.handleLogout).Methods("GET").Name("Logout")
 	router.HandleFunc("/redirect", handler.handleRedirect).Methods("GET").Name("Redirect")
 	router.HandleFunc("/auth", handler.handleCheckAuthentication).Methods("GET").Name("CheckAuthentication")
 	router.HandleFunc("/userinfo", handler.handleUserInfo).Methods("GET").Name("UserInfo")
diff --git a/server/config.go b/server/config.go
index 1a37ff5d1..01492f248 100644
--- a/server/config.go
+++ b/server/config.go
@@ -631,6 +631,12 @@ func (c *Config) ValidateAuth() ([]error, error) {
 			continue
 		}
 
+		if name == "HashKey" || name == "BlockKey" {
+			if len(value) != 32 {
+				errors = append(errors, fmt.Errorf("invalid key length for %s", name))
+			}
+		}
+
 		if strings.Contains(name, "URL") {
 			_, err := url.ParseRequestURI(value)
 			if err != nil {
@@ -640,7 +646,7 @@ func (c *Config) ValidateAuth() ([]error, error) {
 		}
 	}
 	if len(c.Auth.Scopes) == 0 {
-		errors = append(errors, fmt.Errorf("must provide scope for authentication with IdP"))
+		errors = append(errors, fmt.Errorf("must provide scope for authentication with IdP - for access and refresh token"))
 	}
 	if len(errors) > 0 {
 		return errors, fmt.Errorf("there were errors validating config")