diff --git a/README.md b/README.md
index e279f3a9..9a16a454 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# pst-gui Project
+qu# pst-gui Project
 
 [![main build](https://github.com/orppst/pst-gui/actions/workflows/gradle.yml/badge.svg)](https://github.com/orppst/pst-gui/actions/workflows/gradle.yml/)
 
diff --git a/build.gradle.kts b/build.gradle.kts
index 8b75bd40..a4f863fe 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -7,7 +7,8 @@ version = "0.1"
 dependencies {
     implementation("io.quarkus:quarkus-resteasy-reactive-jackson")
     implementation("io.quarkus:quarkus-rest-client-reactive-jackson")
-    implementation("io.quarkiverse.quinoa:quarkus-quinoa:2.0.8")
+    implementation("io.quarkiverse.quinoa:quarkus-quinoa:2.2.5")
+    implementation("io.quarkus:quarkus-reactive-routes")
     implementation("io.quarkus:quarkus-websockets")
     implementation("io.quarkus:quarkus-smallrye-jwt")
     implementation("io.quarkus:quarkus-oidc")
diff --git a/src/main/java/org/orph2020/pst/gui/info/PathInfo.java b/src/main/java/org/orph2020/pst/gui/info/PathInfo.java
index 94561967..4f360d79 100644
--- a/src/main/java/org/orph2020/pst/gui/info/PathInfo.java
+++ b/src/main/java/org/orph2020/pst/gui/info/PathInfo.java
@@ -12,6 +12,7 @@
 
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.net.URL;
 
 @Path("/api-info")
 public class PathInfo {
@@ -33,7 +34,8 @@ public Response info(@Context UriInfo uriInfo) {
       }
       else {
          //when deployed the api is on same server (as far as the client side can see things).
-         URI uriLoc = UriBuilder.fromUri(requestUri.resolve("../../../")).scheme("https").build();
+
+         URI uriLoc = UriBuilder.fromPath("/").scheme("https").host(requestUri.getHost()).build();
          return Response.ok(uriLoc).build();
       }
    }
diff --git a/src/main/java/org/orph2020/pst/gui/routes/Routing.java b/src/main/java/org/orph2020/pst/gui/routes/Routing.java
new file mode 100644
index 00000000..12f62526
--- /dev/null
+++ b/src/main/java/org/orph2020/pst/gui/routes/Routing.java
@@ -0,0 +1,50 @@
+package org.orph2020.pst.gui.routes;
+
+import io.quarkus.vertx.web.RoutingExchange;
+import io.vertx.ext.web.Router;
+import io.vertx.ext.web.RoutingContext;
+import jakarta.enterprise.context.ApplicationScoped;
+import io.quarkus.vertx.web.Route;
+import jakarta.enterprise.event.Observes;
+import org.jboss.logging.Logger;
+
+
+/*
+ * Created on 18/03/2024 by Paul Harrison (paul.harrison@manchester.ac.uk).
+ */
+
+/**
+ * Mess around with routing to have SPA at non-root path.
+ * TODO - hopefully can be removed when https://github.com/quarkiverse/quarkus-quinoa/issues/302 is implemented.
+ *
+ */
+@ApplicationScoped
+public class Routing {
+
+   private static final Logger log = Logger.getLogger(Routing.class);
+
+   // put some routes before all the others to sort out the spa routing.
+   void spa (@Observes Router router) {
+      router.get("/").order(1).handler(rc ->{
+         rc.reroute("/pst/gui/index.html");
+      });
+      router.get("/tool/*").order(2).handler(rc -> {
+         final String path = rc.normalizedPath();
+         log.debugf("SPA redirection "+ path);
+         if(path.equals("/pst/gui/tool/index.html"))
+            rc.next();
+         else
+            rc.reroute("/pst/gui/tool/index.html");
+      });
+
+      for (var r: router.getRoutes())
+      {
+         log.info(r.toString());
+      }
+
+
+
+   }
+
+
+}
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 1db6af7e..12dac323 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -14,9 +14,12 @@ quarkus.quinoa.package-manager-install=false
 quarkus.quinoa.dev-server.port=5173
 quarkus.quinoa.build-dir=dist
 #see https://docs.quarkiverse.io/quarkus-quinoa/dev/index.html#spa-routing
-quarkus.quinoa.enable-spa-routing=true
-quarkus.quinoa.ignored-path-prefixes=/aai
+%dev.quarkus.quinoa.enable-spa-routing=true
+%prod.quarkus.quinoa.enable-spa-routing=true
+quarkus.quinoa.ignored-path-prefixes=/aai,/logout
 quarkus.quinoa.index-page=/tool/index.html
+quarkus.log.category."io.quarkiverse.quinoa".level=DEBUG
+quarkus.log.category."org.orph2020.pst.gui.routes".level=DEBUG
 
 #want this exposed to outside world
 quarkus.kubernetes.ingress.expose=true
@@ -85,5 +88,5 @@ quarkus.oidc.authentication.java-script-auto-redirect=false
 
 #HTTP logging - see https://quarkus.io/guides/http-reference#configuring-http-access-logs
 %prod.quarkus.http.access-log.enabled=true
-%prod.quarkus.http.access-log.pattern=long
+%prod.quarkus.http.access-log.pattern=combined
 
diff --git a/src/main/webui/README.md b/src/main/webui/README.md
index c21fa1d6..3cb28292 100644
--- a/src/main/webui/README.md
+++ b/src/main/webui/README.md
@@ -34,6 +34,10 @@ Other client side libraries used
 
 * https://reactrouter.com/ - see https://tkdodo.eu/blog/react-query-meets-react-router
 
+## Security
+
+follows  https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps-14#name-token-mediating-backend architecture where the refresh token is not exposed to the javascript.
+
 ## Misc
 
 * see https://github.com/quarkiverse/quarkus-quinoa/issues/299 for issues regarding serving