diff --git a/craftui/craftui.py b/craftui/craftui.py
index 33753e9..f195dbc 100755
--- a/craftui/craftui.py
+++ b/craftui/craftui.py
@@ -578,43 +578,58 @@
       return False
     return True
 
-  class WelcomeHandler(digest.DigestAuthMixin, tornado.web.RequestHandler):
-    """Displays the Welcome page."""
+  class CraftHandler(digest.DigestAuthMixin, tornado.web.RequestHandler):
+    """Common class to add args to html template."""
+    auth = 'unset'
+
+    def TemplateArgs(self):
+      args = {}
+      args['hidepeer'] = ''
+      args['hidehttps'] = ''
+      args['peer'] = ''
+      if self.request.protocol is 'https':
+        args['hidehttps'] = 'hidden'
+      if self.get_argument('peer', default='0') == '1':
+        args['peer'] = '?peer=1'
+        args['hidepeer'] = 'hidden'
+      print args
+      return args
 
     def get(self):
       ui = self.settings['ui']
-      # no auth required for welcome page
-      print 'GET welcome HTML page'
-      self.render(ui.wwwroot + '/welcome.thtml', ipaddr='xxx')
+      if self.auth is 'any':
+        if not ui.Authenticate(self):
+          return
+      elif self.auth is 'admin':
+        if not ui.AuthenticateAdmin(self):
+          return
+      elif self.auth is not 'none':
+        raise Exception('unknown authentication type "%s"' % self.auth)
 
-  class StatusHandler(digest.DigestAuthMixin, tornado.web.RequestHandler):
-    """Displays the Status page."""
+      path = ui.wwwroot + '/' + self.page + '.thtml'
+      print 'GET %s page' % self.page
+      self.render(path, **self.TemplateArgs())
 
-    def get(self):
-      ui = self.settings['ui']
-      if not ui.Authenticate(self):
-        return
-      print 'GET status HTML page'
-      self.render(ui.wwwroot + '/status.thtml', peerurl='/status/?peer=1')
+  class WelcomeHandler(CraftHandler):
+    page = 'welcome'
+    auth = 'none'
 
-  class ConfigHandler(digest.DigestAuthMixin, tornado.web.RequestHandler):
-    """Displays the Config page."""
+  class StatusHandler(CraftHandler):
+    page = 'status'
+    auth = 'any'
 
-    def get(self):
-      ui = self.settings['ui']
-      if not ui.Authenticate(self):
-        return
-      print 'GET config HTML page'
-      self.render(ui.wwwroot + '/config.thtml', peerurl='/config/?peer=1')
+  class ConfigHandler(CraftHandler):
+    page = 'config'
+    auth = 'admin'
 
-  class JsonHandler(digest.DigestAuthMixin, tornado.web.RequestHandler):
+  class JsonHandler(CraftHandler):
     """Provides JSON-formatted content to be displayed in the UI."""
 
     def get(self):
       ui = self.settings['ui']
       if not ui.Authenticate(self):
         return
-      print 'GET JSON data for craft page'
+      print 'GET json data'
       jsonstring = ui.GetData()
       self.set_header('Content-Type', 'application/json')
       self.write(jsonstring)
diff --git a/craftui/craftui_test.sh b/craftui/craftui_test.sh
index efa921b..5fc11ce 100755
--- a/craftui/craftui_test.sh
+++ b/craftui/craftui_test.sh
@@ -128,10 +128,6 @@
     baduser_auth="--digest --user root:admin"
     badpass_auth="--digest --user guest:admin"
 
-    testname "welcome web page ($url)"
-    $curl $url/ |& grep welcome.thtml
-    check_success
-
     for auth in "" "$baduser_auth" "$badpass_auth"; do
       for n in status config content.json; do
         testname "page $n bad auth ($url, $auth)"
@@ -143,7 +139,33 @@
     admin_auth="--digest --user admin:admin"
     guest_auth="--digest --user guest:guest"
 
-    for auth in "$admin_auth" "$guest_auth"; do
+    # should fail with guest_auth
+    for auth in "$admin_auth"; do
+      testname "config web page ($url, $auth)"
+      $curl $auth $url/config |& grep 'WWW-Authenticate: Digest'
+      check_success
+    done
+
+    # should work with no auth
+    for auth in ""; do
+      testname "welcome web page ($url)"
+      $curl $url/ |& grep welcome.thtml
+      check_success
+    done
+
+    # should work with guest_auth
+    for auth in "$guest_auth"; do
+      testname "status web page ($url, $auth)"
+      $curl $auth $url/status |& grep status.thtml
+      check_success
+
+      testname "json ($url, $auth)"
+      $curl $auth $url/content.json |& grep '"platform": "GFCH100"'
+      check_success
+    done
+
+    # should work with admin_auth
+    for auth in "$admin_auth"; do
       testname "status web page ($url, $auth)"
       $curl $auth $url/status |& grep status.thtml
       check_success
diff --git a/craftui/www/config.thtml b/craftui/www/config.thtml
index 5152015..1227ad0 100644
--- a/craftui/www/config.thtml
+++ b/craftui/www/config.thtml
@@ -14,9 +14,10 @@
       <h1><img src=static/logo.png alt="Google Fiber"></h1>
       <nav>
         <ul>
-          <li ><a href=/status>GFCH100</a></li>
-          <li class=active><a href=/config>Configuration</a></li>
-          <li ><a href={{ peerurl }} target=_blank>Peer</a></li>
+          <li ><a href=/{{peer}}>Welcome</a></li>
+          <li ><a href=/status{{peer}}>Status</a></li>
+          <li class=active><a href=/config{{peer}}>Configuration</a></li>
+          <li ><a {{hidepeer}} href="/?peer=1" target=_blank>Peer</a></li>
         </ul>
       </nav>
     </section>
diff --git a/craftui/www/static/default.css b/craftui/www/static/default.css
index 4de629f..f283f90 100644
--- a/craftui/www/static/default.css
+++ b/craftui/www/static/default.css
@@ -131,7 +131,6 @@
 
   header section,
   footer ul {
-    margin: 0 auto;
     max-width: 978px;
   }
 
diff --git a/craftui/www/status.thtml b/craftui/www/status.thtml
index 2f4d402..3500323 100644
--- a/craftui/www/status.thtml
+++ b/craftui/www/status.thtml
@@ -14,9 +14,10 @@
       <h1><img src=static/logo.png alt="Google Fiber"></h1>
       <nav>
         <ul>
-          <li class=active><a href=/status>GFCH100</a></li>
-          <li ><a href=/config>Configuration</a></li>
-          <li ><a href={{ peerurl }} target=_blank>Peer</a></li>
+          <li ><a href=/?{{peer}}>Welcome</a></li>
+          <li class=active><a href=/status{{peer}}>Status</a></li>
+          <li ><a href=/config{{peer}}>Configuration</a></li>
+          <li ><a {{hidepeer}} href="/?peer=1" target=_blank>Peer</a></li>
         </ul>
       </nav>
     </section>
diff --git a/craftui/www/welcome.thtml b/craftui/www/welcome.thtml
index f3a2b02..de7c098 100644
--- a/craftui/www/welcome.thtml
+++ b/craftui/www/welcome.thtml
@@ -12,19 +12,40 @@
   <header>
     <section>
       <h1><img src=static/logo.png alt="Google Fiber"></h1>
+      <nav>
+        <ul>
+          <li class=active><a href=/{{peer}}>Welcome</a></li>
+          <li ><a href=/status{{peer}}>Status</a></li>
+          <li ><a href=/config{{peer}}>Configuration</a></li>
+          <li ><a {{hidepeer}} href="/?peer=1" target=_blank>Peer</a></li>
+        </ul>
+      </nav>
     </section>
   </header>
   <br>
-  Welcome to the GFCH100.<br>
-
-  To connect securely, use https.  <br>
-  Status: https://{{ipaddr}}/status<br>
-  Configuration: https://{{ipaddr}}/config<br>
-
-  If https is unavailable, you may connect insecurely:<br>
-  Status: http://{{ipaddr}}/status<br>
-  Configuration: http://{{ipaddr}}/config<br>
-
+  <div class="tabs">
+    <div class="tab">
+      <input type="radio" id="tab-1" name="tab-group-1" checked>
+      <label for="tab-1">Authorized Use Only</label>
+      <div class="content">
+        <div {{hidehttps}}>
+          <b>
+            Warning: You are not connected securely.  Consider https://...
+            <br>
+            <br>
+          </b>
+        </div>
+          <p>
+          WARNING:
+          <p>
+          Unauthorized access to this system is forbidden and will be
+          prosecuted by law.
+          <br>
+          By accessing this system, you agree that your actions may be
+          monitored if unauthorized usage is suspected.
+      </div>
+    </div>
+  </div>
 </body>
 </html>
 <!-- end of welcome.thtml (used by unit test) -->