diff --git a/Client/scripts.js b/Client/scripts.js
index 46d1a54..3db547d 100644
--- a/Client/scripts.js
+++ b/Client/scripts.js
@@ -1,3 +1,4 @@
+// set all the global stuff
 let ip;
 let alertTime = 2;
 let adminPass = "";
@@ -26,7 +27,11 @@ async function getFromServer(bodyInfo, source="",password=adminPass) {
             }
             });
         const data = await response.json();
-        if (data == "401") {
+        if (data == ERR_NO_ADMIN) {
+            // im suprised i didn't comment on this already but this is kinda lame desing
+            // its not wrong but you know
+            // it is easy which i like
+            // and it overrides any other non-async alerts which is nice
             alertText("Error: Admin restricted action")
         }
         return await data;
@@ -36,14 +41,13 @@ async function getFromServer(bodyInfo, source="",password=adminPass) {
         } else if(e == "") {
 
         } else {
-            alertText("error: " + e)
+            alertText("Error: " + e)
         }
         const response=null;
         return response;
     }
 }
 
-
 //cookie reader is taken from internet because cookies ae too complicated for me
 //i still understand how it works though promise just i see no reason to write this from scratch
 function getCookie(cname) {
@@ -63,34 +67,34 @@ function getCookie(cname) {
     }
 //someone more organised than me would have set all these html elements to variables so they dont have to get them 50 times
 async function controlButton(buttonType) {
-    if (buttonType == "pp") {
+    if (buttonType == "pp") { // Play-Pause button
         getFromServer({control: "play-pause"}, "controls")
-    } else if (buttonType == "sk") {
+    } else if (buttonType == "sk") { // Skip button
         getFromServer({control: "skip"}, "controls")
         if (document.getElementById("playlist-mode").style.display == "block") {
             generateVisualPlaylist("skip-button");
         }
-    } else if (buttonType == "pl") {
+    } else if (buttonType == "pl") { // Playlist button
         document.getElementById("songlist").innerHTML = "";
         document.getElementById("playlist").innerHTML = "<h1 id=\"playlist-alert\"></h1>";
         document.getElementById("playlist-mode").style.display = "block";
         document.getElementById("songlist-mode").style.display = "none";
         document.getElementById("settings-mode").style.display = "none";
         generateVisualPlaylist();
-    } else if (buttonType == "se") {
+    } else if (buttonType == "se") { //SearchMode button
         document.getElementById("songlist").innerHTML = "<h1>Search to find songs!</h1>";
         document.getElementById("playlist").innerHTML = "";
         document.getElementById("playlist-mode").style.display = "none";
         document.getElementById("songlist-mode").style.display = "block";
         document.getElementById("settings-mode").style.display = "none";
-    } else if (buttonType == "st") {
+    } else if (buttonType == "st") { //Settings button
         document.getElementById("songlist").innerHTML = "";
         document.getElementById("playlist").innerHTML = "";
         document.getElementById("playlist-mode").style.display = "none";
         document.getElementById("songlist-mode").style.display = "none";
         document.getElementById("settings-mode").style.display = "block";
         checkSettings()
-    } else if (buttonType = "pm") {
+    } else if (buttonType = "pm") { //Partymode toggle (in settings)
         await getFromServer({setting: "partymode-toggle"}, "settings")
         checkSettings(true)
     }
@@ -105,7 +109,6 @@ function searchSongsEnter(e) {
 }
 
 async function searchSongs(searchTerm){
-    let optionslist = []
     document.getElementById("songlist").innerHTML = ""
     searchResults = await getFromServer({search:searchTerm},"search").then()
     //generate the visual song list
@@ -345,7 +348,7 @@ async function submitPerms(e) {
     tempData["SK"] = document.getElementById("skipsongsettingcheckbox").checked;
     tempData["AS"] = document.getElementById("addsongsettingcheckbox").checked;
     tempData["PM"] = document.getElementById("partymodesettingcheckbox").checked;
-    tempData["VOL"] = document.getElementById("partymodesettingcheckbox").checked;
+    tempData["VOL"] = document.getElementById("volumechangesettingcheckbox").checked;
     let returncode = await getFromServer({"setting":"perms","admin":tempData},"settings");
     if (returncode == ERR_NO_ADMIN || returncode == null) {
         // if you aren't allowed to check the box then toggle it again
@@ -366,10 +369,13 @@ document.addEventListener('keydown', function(e){
 }})
 document.getElementById("playlist-mode").style.display = "none";
 document.getElementById("settings-mode").style.display = "none";
-//.ontouch for mobile??
 document.getElementById("volumerange").onchange = async function() {
+    // there is no reason for this not to be a defined function
+    // FIX THIS
     let returnValue = await getFromServer({setting:"volume",level:this.value}, "settings")
-    if (returnValue["volumePassed"] !=0) {
+    if (returnValue == ERR_NO_ADMIN) {
+        alertText("Error: Admin restricted action");
+    } else if (returnValue["volumePassed"] !=0) {
         // i forgot about this, i had to do this because it confused the crap out of me one time
         // vlc doesn't let you change the volume of nothing, which makes sense if you think about it
         alertText("Nothing is playing")
diff --git a/Client/styles.css b/Client/styles.css
index a6c4cdf..fdd3d09 100644
--- a/Client/styles.css
+++ b/Client/styles.css
@@ -72,6 +72,11 @@ h4 {
     text-align: center;
 }
 
+.item {
+    /* Only actually applies to playlist and search because settings item has "inherit" bg-colour */
+    background-color: #DDDDDD;
+}
+
 /* Songlist stuff */
 .songlist {
     width: 80%;
@@ -87,7 +92,6 @@ h4 {
     max-width: 150px;
     margin: 5px auto;
     min-width: 75px;
-    background-color: inherit;
 }
 
 .songlist > .item > img{
@@ -160,7 +164,7 @@ h4 {
 .settings > .item {
     margin-left: 10%;
     width:fit-content;
-    
+    background-color: inherit;
 }
 
 .settings > .item:not(:last-child) {
diff --git a/Server/webbyBits.py b/Server/webbyBits.py
index a70fb93..590ccad 100644
--- a/Server/webbyBits.py
+++ b/Server/webbyBits.py
@@ -20,6 +20,9 @@ ADMIN_PASS = args.admin
 if not(ADMIN_PASS):
     ADMIN_PASS = None
 # True = everyone, False = admin only. Change in client while in use. 
+"""PP,SK,AS,PM,VOL all set to True or False
+False is admin only
+True is all users"""
 controlPerms = {
     "PP":True, #done
     "SK":True, #done
@@ -192,12 +195,12 @@ def searchSongDB():
 @app.route("/songadd", methods=["POST"])
 def songadd():
     recieveData=request.get_json(force=True)
-    if (ADMIN_PASS and ADMIN_PASS == recieveData['password']):
+    if (ADMIN_PASS and ADMIN_PASS == recieveData['password']) or controlPerms["AS"]:
         # Pass exists and is correct, or it's not restricted 
         queueSong(recieveData['song'])
         return "200"
     else:
-        # Pass exists, and the action is restricted 
+        # the pass is incorrect (technically a pass not existing falls into the above case because controlPerms is never changed)
         return ERR_NO_ADMIN
 
 @app.route("/playlist", methods=["POST"])
diff --git a/wishlist.md b/wishlist.md
index 722cc86..75ec375 100644
--- a/wishlist.md
+++ b/wishlist.md
@@ -4,9 +4,16 @@
     * Allows restricting certain features and changing permissions on the fly on the client
 - [ ] Refactoring existing code
     - [ ] Update the SQL -> Server -> Client pipeline when searching and building playlist
+    - [ ] Verify all if-else sequences are correct and not redundant
+    - [ ] Remove old comments
 - [ ] Secure Password
     * Actually use SSL for stuff that should be using it
 - [ ] GUI update for client
     - [ ] Google material design??
     - [ ] Dark mode?
-    - [ ] New Icons
\ No newline at end of file
+    - [ ] New Icons
+- [ ] "Credit" system so each client can only add a set number of songs
+    - Based on time period, number in queue, other possible ideas for credits
+    - Without a login system there's no easy way to give credits to specific clients (and a login is beyond scope of what I want to do)
+        - Potentially a "redemption code" system, which can be tracked client side
+    - All of this is also very hackable without a server-side login.
\ No newline at end of file