diff --git a/Duplicati/GUI/Duplicati.GUI.TrayIcon/HostedInstanceKeeper.cs b/Duplicati/GUI/Duplicati.GUI.TrayIcon/HostedInstanceKeeper.cs
index 3c58521e6..a8ac0dd1d 100644
--- a/Duplicati/GUI/Duplicati.GUI.TrayIcon/HostedInstanceKeeper.cs
+++ b/Duplicati/GUI/Duplicati.GUI.TrayIcon/HostedInstanceKeeper.cs
@@ -20,8 +20,8 @@ namespace Duplicati.GUI.TrayIcon
                 {
                     //When running the hosted instance we do not really care what port we are using,
                     // so we just throw a few out there and try them
-                    if (args == null || !args.Any(x => x.Trim().StartsWith("--" + Duplicati.Server.WebServer.OPTION_PORT + "=", StringComparison.InvariantCultureIgnoreCase)))
-                        args = (args ?? new string[0]).Union(new string[] { "--" + Duplicati.Server.WebServer.OPTION_PORT + "=8200,8300,8400,8500,8600,8700,8800,8900,8989" }).ToArray();
+                    if (args == null || !args.Any(x => x.Trim().StartsWith("--" + Duplicati.Server.WebServer.Server.OPTION_PORT + "=", StringComparison.InvariantCultureIgnoreCase)))
+                        args = (args ?? new string[0]).Union(new string[] { "--" + Duplicati.Server.WebServer.Server.OPTION_PORT + "=8200,8300,8400,8500,8600,8700,8800,8900,8989" }).ToArray();
                         
                     Duplicati.Server.Program.Main(args);
                 } catch (Exception ex) {
diff --git a/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs b/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs
index c2c1ea5eb..a23c5bb72 100644
--- a/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs
+++ b/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs
@@ -10,12 +10,16 @@ namespace Duplicati.GUI.TrayIcon
     public class HttpServerConnection : IDisposable
     {
         private const string CONTROL_SCRIPT = "control.cgi";
+        private const string LOGIN_SCRIPT = "login.cgi";
         private const string STATUS_WINDOW = "index.html";
         private const string EDIT_WINDOW = "edit-window.html";
+        private const string AUTH_COOKIE = "session_auth";
         
         private Uri m_controlUri;
         private string m_baseUri;
-        //private System.Net.NetworkCredential m_credentials;
+        private string m_password;
+        private bool m_saltedpassword;
+        private string m_authtoken;
         private static readonly System.Text.Encoding ENCODING = System.Text.Encoding.GetEncoding("utf-8");
         public delegate void StatusUpdate(IServerStatus status);
         public event StatusUpdate StatusUpdated;
@@ -34,13 +38,16 @@ namespace Duplicati.GUI.TrayIcon
         private object m_lock = new object();
         private Queue<Dictionary<string, string>> m_workQueue = new Queue<Dictionary<string,string>>();
 
-        public HttpServerConnection(Uri server, System.Net.NetworkCredential credentials)
+        public HttpServerConnection(Uri server, string password, bool saltedpassword)
         {
             m_baseUri = server.ToString();
             if (!m_baseUri.EndsWith("/"))
                 m_baseUri += "/";
             
             m_controlUri = new Uri(m_baseUri + CONTROL_SCRIPT);
+            m_password = password;
+            m_saltedpassword = saltedpassword;
+
             m_updateRequest = new Dictionary<string, string>();
             m_updateRequest["action"] = "get-current-state";
             m_updateRequest["longpoll"] = "false";
@@ -145,7 +152,92 @@ namespace Duplicati.GUI.TrayIcon
             return string.Join("&", Array.ConvertAll(dict.Keys.ToArray(), key => string.Format("{0}={1}", Uri.EscapeUriString(key), Uri.EscapeUriString(dict[key]))));
         }
 
+        private class SaltAndNonce
+        {
+            public string Salt;
+            public string Nonce;
+        }
+
+        private SaltAndNonce GetSaltAndNonce()
+        {
+            var req = (System.Net.HttpWebRequest)System.Net.WebRequest.Create(m_baseUri + LOGIN_SCRIPT + "?get-nonce=1");
+            req.Method = "GET";
+            req.UserAgent = "Duplicati TrayIcon Monitor, v" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString();
+
+            Duplicati.Library.Utility.AsyncHttpRequest areq = new Library.Utility.AsyncHttpRequest(req);
+            using(var r = (System.Net.HttpWebResponse)areq.GetResponse())
+            using(var s = r.GetResponseStream())
+            using (var sr = new System.IO.StreamReader(s, ENCODING, true))
+                return Serializer.Deserialize<SaltAndNonce>(sr);
+        }
+
+        private string PerformLogin(string password, string nonce)
+        {
+            System.Net.HttpWebRequest req = (System.Net.HttpWebRequest)System.Net.WebRequest.Create(m_baseUri + LOGIN_SCRIPT + "?password=" + Duplicati.Library.Utility.Uri.UrlEncode(password));
+            req.Method = "GET";
+            req.UserAgent = "Duplicati TrayIcon Monitor, v" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString();
+            if (req.CookieContainer == null)
+                req.CookieContainer = new System.Net.CookieContainer();
+            req.CookieContainer.Add(new System.Net.Cookie("session_nonce", nonce, "/", req.RequestUri.Host));
+
+            //Wrap it all in async stuff
+            Duplicati.Library.Utility.AsyncHttpRequest areq = new Library.Utility.AsyncHttpRequest(req);
+            using(var r = (System.Net.HttpWebResponse)areq.GetResponse())
+            if (r.StatusCode == System.Net.HttpStatusCode.OK)
+                return r.Cookies["session_auth"].Value;
+
+            return null;
+        }
+
+        private string GetAuthToken()
+        {
+            var salt_nonce = GetSaltAndNonce();
+            var sha256 = System.Security.Cryptography.SHA256.Create();
+            var password = m_password;
+
+            if (!m_saltedpassword)
+            {
+                var str = System.Text.Encoding.UTF8.GetBytes(m_password);
+                var buf = Convert.FromBase64String(salt_nonce.Salt);
+                sha256.TransformBlock(str, 0, str.Length, str, 0);
+                sha256.TransformFinalBlock(buf, 0, buf.Length);
+                password = Convert.ToBase64String(sha256.Hash);
+                sha256.Initialize();
+            }
+
+            var nonce = Convert.FromBase64String(salt_nonce.Nonce);
+            sha256.TransformBlock(nonce, 0, nonce.Length, nonce, 0);
+            var pwdbuf = Convert.FromBase64String(password);
+            sha256.TransformFinalBlock(pwdbuf, 0, pwdbuf.Length);
+            var pwd = Convert.ToBase64String(sha256.Hash);
+
+            return PerformLogin(pwd, salt_nonce.Nonce);
+        }
+
+
         private T PerformRequest<T>(Dictionary<string, string> queryparams)
+        {
+            try
+            {
+                return PerformRequestInternal<T>(queryparams);
+            }
+            catch (System.Net.WebException wex)
+            {
+                if (
+                    wex.Status == System.Net.WebExceptionStatus.ProtocolError && 
+                    ((System.Net.HttpWebResponse)wex.Response).StatusCode == System.Net.HttpStatusCode.Unauthorized &&
+                    !string.IsNullOrWhiteSpace(m_password)
+                )
+                {
+                    m_authtoken = GetAuthToken();
+                    return PerformRequestInternal<T>(queryparams);
+                }
+                else
+                    throw;
+            }
+        }
+
+        private T PerformRequestInternal<T>(Dictionary<string, string> queryparams)
         {
             queryparams["format"] = "json";
 
@@ -158,6 +250,12 @@ namespace Duplicati.GUI.TrayIcon
             req.ContentType = "application/x-www-form-urlencoded ; charset=" + ENCODING.BodyName;
             req.Headers.Add("Accept-Charset", ENCODING.BodyName);
             req.UserAgent = "Duplicati TrayIcon Monitor, v" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString();
+            if (m_authtoken != null)
+            {   
+                if (req.CookieContainer == null)
+                    req.CookieContainer = new System.Net.CookieContainer();
+                req.CookieContainer.Add(new System.Net.Cookie(AUTH_COOKIE, m_authtoken, "/", req.RequestUri.Host));
+            }
             
             //Wrap it all in async stuff
             Duplicati.Library.Utility.AsyncHttpRequest areq = new Library.Utility.AsyncHttpRequest(req);
@@ -265,7 +363,19 @@ namespace Duplicati.GUI.TrayIcon
         
         public string StatusWindowURL
         {
-            get { return m_baseUri + STATUS_WINDOW; }
+            get 
+            { 
+                try
+                {
+                    if (m_authtoken != null)
+                        return m_baseUri + STATUS_WINDOW + "?auth-token=" + GetAuthToken();
+                }
+                catch
+                {
+                }
+                
+                return m_baseUri + STATUS_WINDOW; 
+            }
         }
 
         public string EditWindowURL
diff --git a/Duplicati/GUI/Duplicati.GUI.TrayIcon/Program.cs b/Duplicati/GUI/Duplicati.GUI.TrayIcon/Program.cs
index 2da96a5f6..376c375d3 100644
--- a/Duplicati/GUI/Duplicati.GUI.TrayIcon/Program.cs
+++ b/Duplicati/GUI/Duplicati.GUI.TrayIcon/Program.cs
@@ -124,6 +124,8 @@ namespace Duplicati.GUI.TrayIcon
 
             HostedInstanceKeeper hosted = null;
             bool openui = false;
+            string password = null;
+            bool saltedpassword = false;
             if (!Library.Utility.Utility.ParseBoolOption(options, NOHOSTEDSERVER_OPTION))
             {
                 try
@@ -138,6 +140,8 @@ namespace Duplicati.GUI.TrayIcon
                 // We have a hosted server, if this is the first run, 
                 // we should open the main page
                 openui = Duplicati.Server.Program.IsFirstRun || Duplicati.Server.Program.ServerPortChanged;
+                password = Duplicati.Server.Program.DataConnection.ApplicationSettings.WebserverPassword;
+                saltedpassword = true;
             }
 
             using (hosted)
@@ -156,7 +160,14 @@ namespace Duplicati.GUI.TrayIcon
                     }
                 }
 
-                using (Connection = new HttpServerConnection(new Uri(url), null))
+                string pwd;
+                if (options.TryGetValue("webserver-password", out pwd))
+                {
+                    password = pwd;
+                    saltedpassword = false;
+                }
+
+                using (Connection = new HttpServerConnection(new Uri(url), password, saltedpassword))
                 {
                     using(var tk = RunTrayIcon(toolkit))
                     {
diff --git a/Duplicati/Server/Database/ApplicationSettings.cs b/Duplicati/Server/Database/ApplicationSettings.cs
index 8bebcfd86..f7fd75c54 100644
--- a/Duplicati/Server/Database/ApplicationSettings.cs
+++ b/Duplicati/Server/Database/ApplicationSettings.cs
@@ -32,6 +32,8 @@ namespace Duplicati.Server.Database
             public const string LAST_WEBSERVER_PORT = "last-webserver-port";
             public const string IS_FIRST_RUN = "is-first-run";
             public const string SERVER_PORT_CHANGED = "server-port-changed";
+            public const string SERVER_PASSPHRASE = "server-passphrase";
+            public const string SERVER_PASSPHRASE_SALT = "server-passphras-salt";
         }
         
         private Dictionary<string, string> m_values;
@@ -166,6 +168,51 @@ namespace Duplicati.Server.Database
                 SaveSettings();
             }
         }
+
+        public string WebserverPassword
+        {
+            get 
+            {
+                return m_values[CONST.SERVER_PASSPHRASE];
+            }
+        }
+
+        public string WebserverPasswordSalt
+        {
+            get 
+            {
+                return m_values[CONST.SERVER_PASSPHRASE_SALT];
+            }
+        }
+
+        public void SetWebserverPassword(string password)
+        {
+            if (string.IsNullOrWhiteSpace(password))
+            {
+                m_values[CONST.SERVER_PASSPHRASE] = "";
+                m_values[CONST.SERVER_PASSPHRASE_SALT] = "";
+                SaveSettings();
+            }
+            else
+            {
+                var prng = System.Security.Cryptography.RNGCryptoServiceProvider.Create();
+                var buf = new byte[32];
+                prng.GetBytes(buf);
+                var salt = Convert.ToBase64String(buf);
+
+                var sha256 = System.Security.Cryptography.SHA256.Create();
+                var str = System.Text.Encoding.UTF8.GetBytes(password);
+
+                sha256.TransformBlock(str, 0, str.Length, str, 0);
+                sha256.TransformFinalBlock(buf, 0, buf.Length);
+                var pwd = Convert.ToBase64String(sha256.Hash);
+
+                m_values[CONST.SERVER_PASSPHRASE] = pwd;
+                m_values[CONST.SERVER_PASSPHRASE_SALT] = salt;
+
+                SaveSettings();
+            }
+        }
     }
 }
 
diff --git a/Duplicati/Server/Database/Connection.cs b/Duplicati/Server/Database/Connection.cs
index 36c195204..41bc7a6da 100644
--- a/Duplicati/Server/Database/Connection.cs
+++ b/Duplicati/Server/Database/Connection.cs
@@ -196,7 +196,7 @@ namespace Duplicati.Server.Database
                         values,
                         @"INSERT INTO ""Option"" (""BackupID"", ""Filter"", ""Name"", ""Value"") VALUES (?, ?, ?, ?)",
                         (f) => {
-                            if (WebServer.PASSWORD_PLACEHOLDER.Equals(f.Value))
+                            if (Duplicati.Server.WebServer.Server.PASSWORD_PLACEHOLDER.Equals(f.Value))
                                 throw new Exception("Attempted to save a property with the placeholder password");
                             return new object[] { id, f.Filter ?? "", f.Name, f.Value ?? "" };
                         }
@@ -392,7 +392,7 @@ namespace Duplicati.Server.Database
                             @"INSERT INTO ""Backup"" (""Name"", ""Tags"", ""TargetURL"", ""DBPath"") VALUES (?,?,?,?)",
                         (n) => {
                         
-                            if (n.TargetURL.IndexOf(WebServer.PASSWORD_PLACEHOLDER) >= 0)
+                        if (n.TargetURL.IndexOf(Duplicati.Server.WebServer.Server.PASSWORD_PLACEHOLDER) >= 0)
                                 throw new Exception("Attempted to save a backup with the password placeholder");
                         
                             return new object[] {
diff --git a/Duplicati/Server/Duplicati.Server.csproj b/Duplicati/Server/Duplicati.Server.csproj
index e1ba1fb45..5cdaf46a3 100644
--- a/Duplicati/Server/Duplicati.Server.csproj
+++ b/Duplicati/Server/Duplicati.Server.csproj
@@ -93,7 +93,6 @@
       <AutoGen>True</AutoGen>
       <DesignTime>True</DesignTime>
     </Compile>
-    <Compile Include="WebServer.cs" />
     <Compile Include="Serializable\ServerStatus.cs" />
     <Compile Include="Database\Backup.cs" />
     <Compile Include="Serializable\ServerSettings.cs" />
@@ -104,6 +103,18 @@
     <Compile Include="Runner.cs" />
     <Compile Include="Database\Schedule.cs" />
     <Compile Include="SpecialFolders.cs" />
+    <Compile Include="WebServer\AuthenticationHandler.cs" />
+    <Compile Include="WebServer\Server.cs" />
+    <Compile Include="WebServer\BodyWriter.cs" />
+    <Compile Include="WebServer\IndexHtmlHandler.cs" />
+    <Compile Include="WebServer\ControlHandler.cs" />
+    <Compile Include="WebServer\ControlMethods\ListFolderAsNodes.cs" />
+    <Compile Include="WebServer\ControlMethods\ReadLogData.cs" />
+    <Compile Include="WebServer\ControlMethods\SearchBackupFiles.cs" />
+    <Compile Include="WebServer\ControlMethods\GetFolderContents.cs" />
+    <Compile Include="WebServer\ControlMethods\DeleteBackup.cs" />
+    <Compile Include="WebServer\ControlMethods\AddOrUpdateBackup.cs" />
+    <Compile Include="WebServer\ControlMethods\GetBackup.cs" />
   </ItemGroup>
   <ItemGroup>
     <None Include="app.config" />
@@ -241,6 +252,8 @@
     <Folder Include="webroot\" />
     <Folder Include="Database\" />
     <Folder Include="Database\Database schema\" />
+    <Folder Include="WebServer\" />
+    <Folder Include="WebServer\ControlMethods\" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
diff --git a/Duplicati/Server/Program.cs b/Duplicati/Server/Program.cs
index 47c2d21a5..2d52f0567 100644
--- a/Duplicati/Server/Program.cs
+++ b/Duplicati/Server/Program.cs
@@ -80,7 +80,7 @@ namespace Duplicati.Server
         /// <summary>
         /// The webserver instance
         /// </summary>
-        public static WebServer WebServer;
+        public static WebServer.Server WebServer;
         
         /// <summary>
         /// An event that is set once the server is ready to respond to requests
@@ -95,7 +95,7 @@ namespace Duplicati.Server
         /// <summary>
         /// A delegate method for creating a copy of the current progress state
         /// </summary>
-        public static Func<Server.Serialization.Interface.IProgressEventData> GenerateProgressState;
+        public static Func<Duplicati.Server.Serialization.Interface.IProgressEventData> GenerateProgressState;
 
         /// <summary>
         /// An event ID that increases whenever the database is updated
@@ -344,6 +344,9 @@ namespace Duplicati.Server
 
                 DataConnection = new Duplicati.Server.Database.Connection(con);
 
+                if (commandlineOptions.ContainsKey("webserver-password"))
+                    Program.DataConnection.ApplicationSettings.SetWebserverPassword(commandlineOptions["webserver-password"]);
+
                 ApplicationExitEvent = new System.Threading.ManualResetEvent(false);
 
                 LiveControl = new LiveControls(DataConnection.ApplicationSettings);
@@ -359,7 +362,7 @@ namespace Duplicati.Server
                 Program.WorkThread.WorkQueueChanged += new EventHandler(SignalNewEvent);
                 Program.Scheduler.NewSchedule += new EventHandler(SignalNewEvent);
 
-                Program.WebServer = new Server.WebServer(commandlineOptions);
+                Program.WebServer = new WebServer.Server(commandlineOptions);
 
                 if (Program.WebServer.Port != DataConnection.ApplicationSettings.LastWebserverPort)
                     ServerPortChanged = true;
@@ -462,19 +465,19 @@ namespace Duplicati.Server
         /// </summary>
         /// <param name="type"></param>
         /// <returns></returns>
-        public static string LocalizeTaskType(Server.Serialization.DuplicatiOperation type)
+        public static string LocalizeTaskType(Duplicati.Server.Serialization.DuplicatiOperation type)
         {
             switch (type)
             {
-                case Server.Serialization.DuplicatiOperation.Backup:
+                case Duplicati.Server.Serialization.DuplicatiOperation.Backup:
                     return Strings.TaskType.FullBackup;
-                case Server.Serialization.DuplicatiOperation.List:
+                case Duplicati.Server.Serialization.DuplicatiOperation.List:
                     return Strings.TaskType.IncrementalBackup;
-                case Server.Serialization.DuplicatiOperation.Remove:
+                case Duplicati.Server.Serialization.DuplicatiOperation.Remove:
                     return Strings.TaskType.ListActualFiles;
-                case Server.Serialization.DuplicatiOperation.Verify:
+                case Duplicati.Server.Serialization.DuplicatiOperation.Verify:
                     return Strings.TaskType.ListBackupEntries;
-                case Server.Serialization.DuplicatiOperation.Restore:
+                case Duplicati.Server.Serialization.DuplicatiOperation.Restore:
                     return Strings.TaskType.ListBackups;
                 default:
                     return type.ToString();
@@ -549,7 +552,11 @@ namespace Duplicati.Server
                     new Duplicati.Library.Interface.CommandLineArgument("unencrypted-database", Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Boolean, Strings.Program.UnencrypteddatabaseCommandDescription, Strings.Program.UnencrypteddatabaseCommandDescription),
                     new Duplicati.Library.Interface.CommandLineArgument("portable-mode", Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Boolean, Strings.Program.PortablemodeCommandDescription, Strings.Program.PortablemodeCommandDescription),
                     new Duplicati.Library.Interface.CommandLineArgument("log-file", Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Path, Strings.Program.LogfileCommandDescription, Strings.Program.LogfileCommandDescription),
-                    new Duplicati.Library.Interface.CommandLineArgument("log-level", Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Enumeration, Strings.Program.LoglevelCommandDescription, Strings.Program.LoglevelCommandDescription, "Warning", null, Enum.GetNames(typeof(Duplicati.Library.Logging.LogMessageType)))
+                    new Duplicati.Library.Interface.CommandLineArgument("log-level", Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Enumeration, Strings.Program.LoglevelCommandDescription, Strings.Program.LoglevelCommandDescription, "Warning", null, Enum.GetNames(typeof(Duplicati.Library.Logging.LogMessageType))),
+                    new Duplicati.Library.Interface.CommandLineArgument(Duplicati.Server.WebServer.Server.OPTION_WEBROOT, Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Path, Strings.Program.WebserverWebrootDescription, Strings.Program.WebserverWebrootDescription, Duplicati.Server.WebServer.Server.DEFAULT_OPTION_WEBROOT),
+                    new Duplicati.Library.Interface.CommandLineArgument(Duplicati.Server.WebServer.Server.OPTION_PORT, Duplicati.Library.Interface.CommandLineArgument.ArgumentType.String, Strings.Program.WebserverPortDescription, Strings.Program.WebserverPortDescription, Duplicati.Server.WebServer.Server.DEFAULT_OPTION_PORT.ToString()),
+                    new Duplicati.Library.Interface.CommandLineArgument(Duplicati.Server.WebServer.Server.OPTION_INTERFACE, Duplicati.Library.Interface.CommandLineArgument.ArgumentType.String, Strings.Program.WebserverInterfaceDescription, Strings.Program.WebserverInterfaceDescription, Duplicati.Server.WebServer.Server.DEFAULT_OPTION_INTERFACE),
+                    new Duplicati.Library.Interface.CommandLineArgument("webserver-password", Duplicati.Library.Interface.CommandLineArgument.ArgumentType.Password, Strings.Program.WebserverPasswordDescription, Strings.Program.WebserverPasswordDescription),
                 };
             }
         }
diff --git a/Duplicati/Server/Strings/Program.Designer.cs b/Duplicati/Server/Strings/Program.Designer.cs
index 068d8cb61..c420df12d 100644
--- a/Duplicati/Server/Strings/Program.Designer.cs
+++ b/Duplicati/Server/Strings/Program.Designer.cs
@@ -1,193 +1,157 @@
-//------------------------------------------------------------------------------
-// <auto-generated>
-//     This code was generated by a tool.
-//     Runtime Version:4.0.30319.269
-//
-//     Changes to this file may cause incorrect behavior and will be lost if
-//     the code is regenerated.
-// </auto-generated>
-//------------------------------------------------------------------------------
-
-namespace Duplicati.Server.Strings {
-    using System;
-    
-    
-    /// <summary>
-    ///   A strongly-typed resource class, for looking up localized strings, etc.
-    /// </summary>
-    // This class was auto-generated by the StronglyTypedResourceBuilder
-    // class via a tool like ResGen or Visual Studio.
-    // To add or remove a member, edit your .ResX file then rerun ResGen
-    // with the /str option, or rebuild your VS project.
-    [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
-    [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
-    [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
-    internal class Program {
-        
-        private static global::System.Resources.ResourceManager resourceMan;
-        
-        private static global::System.Globalization.CultureInfo resourceCulture;
-        
-        [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
-        internal Program() {
-        }
-        
-        /// <summary>
-        ///   Returns the cached ResourceManager instance used by this class.
-        /// </summary>
-        [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
-        internal static global::System.Resources.ResourceManager ResourceManager {
-            get {
-                if (object.ReferenceEquals(resourceMan, null)) {
-                    global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Duplicati.Server.Strings.Program", typeof(Program).Assembly);
-                    resourceMan = temp;
-                }
-                return resourceMan;
-            }
-        }
-        
-        /// <summary>
-        ///   Overrides the current thread's CurrentUICulture property for all
-        ///   resource lookups using this strongly typed resource class.
-        /// </summary>
-        [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
-        internal static global::System.Globalization.CultureInfo Culture {
-            get {
-                return resourceCulture;
-            }
-            set {
-                resourceCulture = value;
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Another instance is running, and was notified.
-        /// </summary>
-        internal static string AnotherInstanceDetected {
-            get {
-                return ResourceManager.GetString("AnotherInstanceDetected", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Failed to create, open or upgrade the database.
-        ///Error message: {0}.
-        /// </summary>
-        internal static string DatabaseOpenError {
-            get {
-                return ResourceManager.GetString("DatabaseOpenError", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Displays this help.
-        /// </summary>
-        internal static string HelpCommandDescription {
-            get {
-                return ResourceManager.GetString("HelpCommandDescription", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Supported commandline arguments:
-        ///
-        ///{0}.
-        /// </summary>
-        internal static string HelpDisplayDialog {
-            get {
-                return ResourceManager.GetString("HelpDisplayDialog", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to --{0}: {1}.
-        /// </summary>
-        internal static string HelpDisplayFormat {
-            get {
-                return ResourceManager.GetString("HelpDisplayFormat", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Failed to set the user interface language: {0}.
-        /// </summary>
-        internal static string LanguageSelectionError {
-            get {
-                return ResourceManager.GetString("LanguageSelectionError", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Outputs log information to the file given.
-        /// </summary>
-        internal static string LogfileCommandDescription {
-            get {
-                return ResourceManager.GetString("LogfileCommandDescription", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Determines the amount of information written in the log file.
-        /// </summary>
-        internal static string LoglevelCommandDescription {
-            get {
-                return ResourceManager.GetString("LoglevelCommandDescription", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Activates portable mode where the database is placed below the program executable.
-        /// </summary>
-        internal static string PortablemodeCommandDescription {
-            get {
-                return ResourceManager.GetString("PortablemodeCommandDescription", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to A serious error occured in Duplicati: {0}.
-        /// </summary>
-        internal static string SeriousError {
-            get {
-                return ResourceManager.GetString("SeriousError", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Displays the status window.
-        /// </summary>
-        internal static string ShowstausCommandDescription {
-            get {
-                return ResourceManager.GetString("ShowstausCommandDescription", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Unable to start up, perhaps another process is already running?
-        ///Error message: {0}.
-        /// </summary>
-        internal static string StartupFailure {
-            get {
-                return ResourceManager.GetString("StartupFailure", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Disables database encryption.
-        /// </summary>
-        internal static string UnencrypteddatabaseCommandDescription {
-            get {
-                return ResourceManager.GetString("UnencrypteddatabaseCommandDescription", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Unsupported version of SQLite detected ({0}), must be {1} or higher.
-        /// </summary>
-        internal static string WrongSQLiteVersion {
-            get {
-                return ResourceManager.GetString("WrongSQLiteVersion", resourceCulture);
-            }
-        }
-    }
-}
+// ------------------------------------------------------------------------------
+//  <autogenerated>
+//      This code was generated by a tool.
+//      Mono Runtime Version: 4.0.30319.17020
+// 
+//      Changes to this file may cause incorrect behavior and will be lost if 
+//      the code is regenerated.
+//  </autogenerated>
+// ------------------------------------------------------------------------------
+
+namespace Duplicati.Server.Strings {
+    using System;
+    
+    
+    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+    [System.Diagnostics.DebuggerNonUserCodeAttribute()]
+    [System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
+    internal class Program {
+        
+        private static System.Resources.ResourceManager resourceMan;
+        
+        private static System.Globalization.CultureInfo resourceCulture;
+        
+        [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
+        internal Program() {
+        }
+        
+        [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static System.Resources.ResourceManager ResourceManager {
+            get {
+                if (object.Equals(null, resourceMan)) {
+                    System.Resources.ResourceManager temp = new System.Resources.ResourceManager("Duplicati.Server.Strings.Program", typeof(Program).Assembly);
+                    resourceMan = temp;
+                }
+                return resourceMan;
+            }
+        }
+        
+        [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static System.Globalization.CultureInfo Culture {
+            get {
+                return resourceCulture;
+            }
+            set {
+                resourceCulture = value;
+            }
+        }
+        
+        internal static string WebserverWebrootDescription {
+            get {
+                return ResourceManager.GetString("WebserverWebrootDescription", resourceCulture);
+            }
+        }
+        
+        internal static string WebserverPortDescription {
+            get {
+                return ResourceManager.GetString("WebserverPortDescription", resourceCulture);
+            }
+        }
+        
+        internal static string HelpCommandDescription {
+            get {
+                return ResourceManager.GetString("HelpCommandDescription", resourceCulture);
+            }
+        }
+        
+        internal static string AnotherInstanceDetected {
+            get {
+                return ResourceManager.GetString("AnotherInstanceDetected", resourceCulture);
+            }
+        }
+        
+        internal static string DatabaseOpenError {
+            get {
+                return ResourceManager.GetString("DatabaseOpenError", resourceCulture);
+            }
+        }
+        
+        internal static string ShowstausCommandDescription {
+            get {
+                return ResourceManager.GetString("ShowstausCommandDescription", resourceCulture);
+            }
+        }
+        
+        internal static string WebserverPasswordDescription {
+            get {
+                return ResourceManager.GetString("WebserverPasswordDescription", resourceCulture);
+            }
+        }
+        
+        internal static string LanguageSelectionError {
+            get {
+                return ResourceManager.GetString("LanguageSelectionError", resourceCulture);
+            }
+        }
+        
+        internal static string LogfileCommandDescription {
+            get {
+                return ResourceManager.GetString("LogfileCommandDescription", resourceCulture);
+            }
+        }
+        
+        internal static string WebserverInterfaceDescription {
+            get {
+                return ResourceManager.GetString("WebserverInterfaceDescription", resourceCulture);
+            }
+        }
+        
+        internal static string WrongSQLiteVersion {
+            get {
+                return ResourceManager.GetString("WrongSQLiteVersion", resourceCulture);
+            }
+        }
+        
+        internal static string UnencrypteddatabaseCommandDescription {
+            get {
+                return ResourceManager.GetString("UnencrypteddatabaseCommandDescription", resourceCulture);
+            }
+        }
+        
+        internal static string PortablemodeCommandDescription {
+            get {
+                return ResourceManager.GetString("PortablemodeCommandDescription", resourceCulture);
+            }
+        }
+        
+        internal static string HelpDisplayDialog {
+            get {
+                return ResourceManager.GetString("HelpDisplayDialog", resourceCulture);
+            }
+        }
+        
+        internal static string SeriousError {
+            get {
+                return ResourceManager.GetString("SeriousError", resourceCulture);
+            }
+        }
+        
+        internal static string LoglevelCommandDescription {
+            get {
+                return ResourceManager.GetString("LoglevelCommandDescription", resourceCulture);
+            }
+        }
+        
+        internal static string HelpDisplayFormat {
+            get {
+                return ResourceManager.GetString("HelpDisplayFormat", resourceCulture);
+            }
+        }
+        
+        internal static string StartupFailure {
+            get {
+                return ResourceManager.GetString("StartupFailure", resourceCulture);
+            }
+        }
+    }
+}
diff --git a/Duplicati/Server/Strings/Program.resx b/Duplicati/Server/Strings/Program.resx
index 8a7522ece..8b9b2f185 100644
--- a/Duplicati/Server/Strings/Program.resx
+++ b/Duplicati/Server/Strings/Program.resx
@@ -169,4 +169,16 @@ Error message: {0}</value>
     <value>Unsupported version of SQLite detected ({0}), must be {1} or higher</value>
     <comment>An error message displayed when the wrong version of SQLite is detected</comment>
   </data>
+  <data name="WebserverWebrootDescription" xml:space="preserve">
+    <value>The path to the folder where the static files for the webserver is present. The folder must be located beneath the installation folder</value>
+  </data>
+  <data name="WebserverPortDescription" xml:space="preserve">
+    <value>The port the webserver listens on. Multiple values may be supplied with a comma in between.</value>
+  </data>
+  <data name="WebserverInterfaceDescription" xml:space="preserve">
+    <value>The interface the webserver listens on. The special values &quot;*&quot; and &quot;any&quot; means any interface. The special value &quot;loopback&quot; means the loopback adapter.</value>
+  </data>
+  <data name="WebserverPasswordDescription" xml:space="preserve">
+    <value>The password required to access the webserver. This option is saved so you do not need to set it on each run. Setting an empty value disables the password.</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Duplicati/Server/WebServer.cs b/Duplicati/Server/WebServer.cs
deleted file mode 100644
index 21bc4bbed..000000000
--- a/Duplicati/Server/WebServer.cs
+++ /dev/null
@@ -1,1442 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using HttpServer.HttpModules;
-using System.IO;
-using Duplicati.Server.Serialization;
-
-namespace Duplicati.Server
-{
-    public class WebServer
-    {
-        /// <summary>
-        /// Option for changing the webroot folder
-        /// </summary>
-        public const string OPTION_WEBROOT = "webservice-webroot";
-        /// <summary>
-        /// Option for changing the webservice listen port
-        /// </summary>
-        public const string OPTION_PORT = "webservice-port";
-
-        /// <summary>
-        /// The single webserver instance
-        /// </summary>
-        private HttpServer.HttpServer m_server;
-        
-        /// <summary>
-        /// The webserver listening port
-        /// </summary>
-        public readonly int Port;
-        
-        /// <summary>
-        /// A string that is sent out instead of password values
-        /// </summary>
-        public const string PASSWORD_PLACEHOLDER = "**********";
-
-        /// <summary>
-        /// Sets up the webserver and starts it
-        /// </summary>
-        /// <param name="options">A set of options</param>
-        public WebServer(IDictionary<string, string> options)
-        {
-            int port;
-            string portstring;
-            IEnumerable<int> ports = null;
-            options.TryGetValue(OPTION_PORT, out portstring);
-            if (!string.IsNullOrEmpty(portstring))
-                ports = 
-                    from n in portstring.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries)
-                                where int.TryParse(n, out port)
-                                select int.Parse(n);
-
-            if (ports == null || !ports.Any())
-                ports = new int[] { 8080 };                                
-
-            // If we are in hosted mode with no specified port, 
-            // then try different ports
-            foreach(var p in ports)
-                try
-                {
-                    // Due to the way the server is initialized, 
-                    // we cannot try to start it again on another port, 
-                    // so we create a new server for each attempt
-                
-                    var server = CreateServer(options);
-                    server.Start(System.Net.IPAddress.Any, p);
-                    m_server = server;
-                    m_server.ServerName = "Duplicati v" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString();
-                    this.Port = p;
-                    return;
-                }
-                catch (System.Net.Sockets.SocketException)
-                {
-                }
-                
-            throw new Exception("Unable to open a socket for listening, tried ports: " + string.Join(",", from n in ports select n.ToString()));
-        }
-        
-        private static HttpServer.HttpServer CreateServer(IDictionary<string, string> options)
-        {
-            HttpServer.HttpServer server = new HttpServer.HttpServer();
-
-            server.Add(new DynamicHandler());
-
-            string webroot = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
-#if DEBUG
-            //For debug we go "../../../.." to get out of "GUI/Duplicati.GUI.TrayIcon/bin/debug"
-            string tmpwebroot = System.IO.Path.GetFullPath(System.IO.Path.Combine(webroot, "..", "..", "..", ".."));
-            tmpwebroot = System.IO.Path.Combine(tmpwebroot, "Server");
-            if (System.IO.Directory.Exists(System.IO.Path.Combine(tmpwebroot, "webroot")))
-                webroot = tmpwebroot;
-            else
-            {
-                //If we are running the server standalone, we only need to exit "bin/Debug"
-                tmpwebroot = System.IO.Path.GetFullPath(System.IO.Path.Combine(webroot, "..", ".."));
-                if (System.IO.Directory.Exists(System.IO.Path.Combine(tmpwebroot, "webroot")))
-                    webroot = tmpwebroot;
-            }
-
-            if (Library.Utility.Utility.IsClientOSX)
-            {
-                string osxTmpWebRoot = System.IO.Path.GetFullPath(System.IO.Path.Combine(webroot, "..", "..", "..", "..", "..", "..", ".."));
-                osxTmpWebRoot = System.IO.Path.Combine(osxTmpWebRoot, "Server");
-                if (System.IO.Directory.Exists(System.IO.Path.Combine(osxTmpWebRoot, "webroot")))
-                    webroot = osxTmpWebRoot;
-            }
-#endif
-
-            webroot = System.IO.Path.Combine(webroot, "webroot");
-
-            if (options.ContainsKey(OPTION_WEBROOT))
-            {
-                string userroot = options[OPTION_WEBROOT];
-#if DEBUG
-                //In debug mode we do not care where the path points
-#else
-                //In release mode we check that the user supplied path is located
-                // in the same folders as the running application, to avoid users
-                // that inadvertently expose top level folders
-                if (!string.IsNullOrWhiteSpace(userroot)
-                    &&
-                    (
-                        userroot.StartsWith(Library.Utility.Utility.AppendDirSeparator(System.Reflection.Assembly.GetExecutingAssembly().Location), Library.Utility.Utility.ClientFilenameStringComparision)
-                        ||
-                        userroot.StartsWith(Library.Utility.Utility.AppendDirSeparator(Program.StartupPath), Library.Utility.Utility.ClientFilenameStringComparision)
-                    )
-                )
-#endif
-                {
-                    webroot = userroot;
-                }
-            }
-
-            FileModule fh = new FileModule("/", webroot);
-            fh.AddDefaultMimeTypes();
-            fh.MimeTypes.Add("htc", "text/x-component");
-            fh.MimeTypes.Add("json", "application/json");
-            fh.MimeTypes.Add("map", "application/json");
-            server.Add(fh);
-            server.Add(new IndexHtmlHandler(System.IO.Path.Combine(webroot, "index.html")));
-#if DEBUG
-            //For debugging, it is nice to know when we get a 404
-            server.Add(new DebugReportHandler());
-#endif
-            
-            return server;
-        }
-
-        private class BodyWriter : System.IO.StreamWriter, IDisposable
-        {
-            private HttpServer.IHttpResponse m_resp;
-
-            // We override the format provider so all JSON output uses US format
-            public override IFormatProvider FormatProvider
-            {
-                get { return System.Globalization.CultureInfo.InvariantCulture; }
-            }
-
-            public BodyWriter(HttpServer.IHttpResponse resp)
-                : base(resp.Body,  resp.Encoding)
-            {
-                m_resp = resp;
-            }
-
-            protected override void Dispose (bool disposing)
-            {
-                if (!m_resp.HeadersSent)
-                {
-                    base.Flush();
-                    m_resp.ContentLength = base.BaseStream.Length;
-                    m_resp.Send();
-                }
-                base.Dispose(disposing);
-            }
-        }
-
-        private class IndexHtmlHandler : HttpModule
-        {
-            private string m_defaultdoc;
-
-            public IndexHtmlHandler(string defaultdoc) { m_defaultdoc = defaultdoc; }
-
-            public override bool Process(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
-            {
-                if ((request.Uri.AbsolutePath == "/" || request.Uri.AbsolutePath == "/index.html" || request.Uri.AbsolutePath == "/index.htm") && System.IO.File.Exists(m_defaultdoc))
-                {
-                    response.Status = System.Net.HttpStatusCode.OK;
-                    response.Reason = "OK";
-                    response.ContentType = "text/html";
-
-                    using (var fs = System.IO.File.OpenRead(m_defaultdoc))
-                    {
-                        response.ContentLength = fs.Length;
-                        response.Body = fs;
-                        response.Send();
-                    }
-
-                    return true;
-                }
-
-                return false;
-            }
-        }
-
-        private class DebugReportHandler : HttpModule
-        {
-            public override bool Process(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
-            {
-                System.Diagnostics.Trace.WriteLine(string.Format("Rejecting request for {0}", request.Uri));
-                return false;
-            }
-        }
-
-        private class DynamicHandler : HttpModule
-        {
-            private delegate void ProcessSub(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter writer);
-            private readonly Dictionary<string, ProcessSub> SUPPORTED_METHODS;
-
-            public DynamicHandler()
-            {
-                SUPPORTED_METHODS = new Dictionary<string, ProcessSub>(System.StringComparer.InvariantCultureIgnoreCase);
-             
-                //Make a list of all supported actions
-                SUPPORTED_METHODS.Add("supported-actions", ListSupportedActions);
-                SUPPORTED_METHODS.Add("system-info", ListSystemInfo);
-                SUPPORTED_METHODS.Add("list-backups", ListBackups);
-                SUPPORTED_METHODS.Add("get-current-state", GetCurrentState);
-                SUPPORTED_METHODS.Add("get-progress-state", GetProgressState);
-                SUPPORTED_METHODS.Add("list-application-settings", ListApplicationSettings);
-                SUPPORTED_METHODS.Add("list-options", ListCoreOptions);
-                SUPPORTED_METHODS.Add("send-command", SendCommand);
-                SUPPORTED_METHODS.Add("get-backup-defaults", GetBackupDefaults);
-                SUPPORTED_METHODS.Add("get-folder-contents", GetFolderContents);
-                SUPPORTED_METHODS.Add("get-backup", GetBackup);
-                SUPPORTED_METHODS.Add("add-backup", AddBackup);
-                SUPPORTED_METHODS.Add("update-backup", UpdateBackup);
-                SUPPORTED_METHODS.Add("delete-backup", DeleteBackup);
-                SUPPORTED_METHODS.Add("validate-path", ValidatePath);
-                SUPPORTED_METHODS.Add("list-tags", ListTags);
-                SUPPORTED_METHODS.Add("test-backend", TestBackend);
-                SUPPORTED_METHODS.Add("list-remote-folder", ListRemoteFolder);
-                SUPPORTED_METHODS.Add("list-backup-sets", ListBackupSets);
-                SUPPORTED_METHODS.Add("search-backup-files", SearchBackupFiles);
-                SUPPORTED_METHODS.Add("restore-files", RestoreFiles);
-                SUPPORTED_METHODS.Add("read-log", ReadLogData);
-                SUPPORTED_METHODS.Add("get-license-data", GetLicenseData);
-            }
-
-            public override bool Process (HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
-            {
-                //We use the fake entry point /control.cgi to listen for requests
-                //This ensures that the rest of the webserver can just serve plain files
-                if (!request.Uri.AbsolutePath.Equals("/control.cgi", StringComparison.InvariantCultureIgnoreCase))
-                    return false;
-
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-
-                string action = input["action"].Value ?? "";
-             
-                //Lookup the actual handler method
-                ProcessSub method;
-                SUPPORTED_METHODS.TryGetValue(action, out method);
-
-                if (method == null) {
-                    response.Status = System.Net.HttpStatusCode.NotImplemented;
-                    response.Reason = "Unsupported action: " + (action == null ? "<null>" : "");
-                    response.Send();
-                } else {
-                    //Default setup
-                    response.Status = System.Net.HttpStatusCode.OK;
-                    response.Reason = "OK";
-#if DEBUG
-                    response.ContentType = "text/plain";
-#else
-                    response.ContentType = "text/json";
-#endif
-                    using (BodyWriter bw = new BodyWriter(response))
-                    {
-                        try
-                        {
-                            method(request, response, session, bw);
-                        }
-                        catch (Exception ex)
-                        {
-                            try
-                            {
-                                if (!response.HeadersSent)
-                                {
-                                    response.Status = System.Net.HttpStatusCode.InternalServerError;
-                                    response.Reason = "Error";
-                                    response.ContentType = "text/plain";
-
-                                    OutputObject(bw, new
-                                    {
-                                        Message = ex.Message,
-                                        Type = ex.GetType().Name,
-#if DEBUG
-                                        Stacktrace = ex.ToString()
-#endif
-                                    });
-                                    bw.Flush();
-                                }
-                            }
-                            catch (Exception flex)
-                            {
-                                Program.DataConnection.LogError("", "Handling outer ex", ex);
-                                Program.DataConnection.LogError("", "Gaver inner ex", flex);
-                            }
-                        }
-                    }
-                }
-
-                return true;
-            }
-
-            private void ReportError(HttpServer.IHttpResponse response, BodyWriter bw, string message)
-            {
-                response.Status = System.Net.HttpStatusCode.InternalServerError;
-                response.Reason = message;
-
-                OutputObject(bw, new { Error = message });
-            }
-            
-            private void OutputObject (BodyWriter b, object o)
-            {
-                Serializer.SerializeJson(b, o);
-            }
-            
-            private List<Dictionary<string, object>> DumpTable(System.Data.IDbCommand cmd, string tablename, string pagingfield, string offset_str, string pagesize_str)
-            {
-                var result = new List<Dictionary<string, object>>();
-                
-                long pagesize;
-                if (!long.TryParse(pagesize_str, out pagesize))
-                    pagesize = 100;
-                
-                pagesize = Math.Max(10, Math.Min(500, pagesize));
-                
-                cmd.CommandText = "SELECT * FROM \"" + tablename + "\"";
-                long offset = 0;
-                if (!string.IsNullOrWhiteSpace(offset_str) && long.TryParse(offset_str, out offset) && !string.IsNullOrEmpty(pagingfield))
-                {
-                    var p = cmd.CreateParameter();
-                    p.Value = offset;
-                    cmd.Parameters.Add(p);
-                    
-                    cmd.CommandText += " WHERE \"" + pagingfield + "\" < ?";
-                }
-                
-                if (!string.IsNullOrEmpty(pagingfield))
-                    cmd.CommandText += " ORDER BY \"" + pagingfield + "\" DESC";
-                cmd.CommandText += " LIMIT " + pagesize.ToString();
-                
-                using(var rd = cmd.ExecuteReader())
-                {
-                    var names = new List<string>();
-                    for(var i = 0; i < rd.FieldCount; i++)
-                        names.Add(rd.GetName(i));
-                    
-                    while (rd.Read())
-                    {
-                        var dict = new Dictionary<string, object>();
-                        for(int i = 0; i < names.Count; i++)
-                            dict[names[i]] = rd.GetValue(i);
-                        
-                        result.Add(dict);                                    
-                    }
-                }
-                
-                return result;
-            }
-            
-            private void GetLicenseData(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                OutputObject(bw, License.LicenseReader.ReadLicenses(System.IO.Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetEntryAssembly().Location), "licenses")));
-            }
-            
-            private void ReadLogData(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                var backupid = input["id"].Value;
-                
-                if (string.IsNullOrWhiteSpace(backupid))
-                {
-                    List<Dictionary<string, object>> res = null;
-                    Program.DataConnection.ExecuteWithCommand(x =>
-                    {
-                        res = DumpTable(x, "ErrorLog", "Timestamp", input["offset"].Value, input["pagesize"].Value);
-                    });
-                    
-                    OutputObject(bw, res);
-                }
-                else
-                {
-                    var backup = Program.DataConnection.GetBackup(backupid);
-                    if (backup == null)
-                    {
-                        ReportError(response, bw, "Invalid or missing backup id");
-                        return;
-                    }
-                    
-                    using(var con = (System.Data.IDbConnection)Activator.CreateInstance(Duplicati.Library.SQLiteHelper.SQLiteLoader.SQLiteConnectionType))
-                    {
-                        con.ConnectionString = "Data Source=" + backup.DBPath;
-                        con.Open();
-                        
-                        using(var cmd = con.CreateCommand())
-                        {
-                            if (Duplicati.Library.Utility.Utility.ParseBool(input["remotelog"].Value, false))
-                            {
-                                var dt = DumpTable(cmd, "RemoteOperation", "ID", input["offset"].Value, input["pagesize"].Value);
-
-                                // Unwrap raw data to a string
-                                foreach(var n in dt)
-                                    try { n["Data"] = System.Text.Encoding.UTF8.GetString((byte[])n["Data"]); }
-                                    catch { }
-
-                                OutputObject(bw, dt);
-                            }
-                            else
-                            {
-                                var dt = DumpTable(cmd, "LogData", "ID", input["offset"].Value, input["pagesize"].Value);
-                                OutputObject(bw, dt);
-                            }
-                        }
-                    }
-                }
-            }
-            
-            private void RestoreFiles(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                var bk = Program.DataConnection.GetBackup(input["id"].Value);
-                if (bk == null)
-                {
-                    ReportError(response, bw, "Invalid or missing backup id");
-                    return;
-                }
-
-                var filters = input["paths"].Value.Split(new string[] { System.IO.Path.PathSeparator.ToString() }, StringSplitOptions.RemoveEmptyEntries);
-                var time = Duplicati.Library.Utility.Timeparser.ParseTimeInterval(input["time"].Value, DateTime.Now);
-                var restoreTarget = input["restore-path"].Value;
-                var overwrite = Duplicati.Library.Utility.Utility.ParseBool(input["overwrite"].Value, false);
-                var task = Runner.CreateRestoreTask(bk, filters, time, restoreTarget, overwrite);
-                Program.WorkThread.AddTask(task);
-                
-                OutputObject(bw, new { TaskID = task.TaskID });
-                
-            }
-            
-            private void ListBackupSets(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                var bk = Program.DataConnection.GetBackup(input["id"].Value);
-                if (bk == null)
-                {
-                    ReportError(response, bw, "Invalid or missing backup id");
-                    return;
-                }
-                
-                
-                var r = Runner.Run(Runner.CreateTask(DuplicatiOperation.List, bk), false) as Duplicati.Library.Interface.IListResults;
-                
-                OutputObject(bw, r.Filesets);
-            }
-            
-            private void SearchBackupFiles(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                                
-                var filter = (input["filter"].Value ?? "").Split(new string[] { System.IO.Path.PathSeparator.ToString() }, StringSplitOptions.RemoveEmptyEntries);
-                var timestring = input["time"].Value;
-                var allversion = Duplicati.Library.Utility.Utility.ParseBool(input["all-versions"].Value, false);
-                
-                if (string.IsNullOrWhiteSpace(timestring) && !allversion)
-                {
-                    ReportError(response, bw, "Invalid or missing time");
-                    return;
-                }
-                var bk = Program.DataConnection.GetBackup(input["id"].Value);
-                if (bk == null)
-                {
-                    ReportError(response, bw, "Invalid or missing backup id");
-                    return;
-                }
-                
-                var prefixonly = Duplicati.Library.Utility.Utility.ParseBool(input["prefix-only"].Value, false);
-                var foldercontents = Duplicati.Library.Utility.Utility.ParseBool(input["folder-contents"].Value, false);
-                var time = new DateTime();
-                if (!allversion)
-                    time = Duplicati.Library.Utility.Timeparser.ParseTimeInterval(timestring, DateTime.Now);
-                                
-                var r = Runner.Run(Runner.CreateListTask(bk, filter, prefixonly, allversion, foldercontents, time), false) as Duplicati.Library.Interface.IListResults;
-                
-                var result = new Dictionary<string, object>();
-                
-                foreach(HttpServer.HttpInputItem n in input)
-                    result[n.Name] = n.Value;
-                
-                result["Filesets"] = r.Filesets;
-                result["Files"] = r.Files;
-                
-                OutputObject(bw, result);
-            }
-            
-            
-            private void ListRemoteFolder(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                if (input["url"] == null || input["url"].Value == null)
-                {
-                    ReportError(response, bw, "The url parameter was not set");
-                    return;
-                }
-                
-                try
-                {
-                    using(var b = Duplicati.Library.DynamicLoader.BackendLoader.GetBackend(input["url"].Value, new Dictionary<string, string>()))
-                        OutputObject(bw, new { Status = "OK", Folders = b.List() });
-                    
-                }
-                catch (Exception ex)
-                {
-                    ReportError(response, bw, ex.Message);
-                }
-            }
-
-            private void TestBackend(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                if (input["url"] == null || input["url"].Value == null)
-                {
-                    ReportError(response, bw, "The url parameter was not set");
-                    return;
-                }
-                
-                try
-                {
-                    using(var b = Duplicati.Library.DynamicLoader.BackendLoader.GetBackend(input["url"].Value, new Dictionary<string, string>()))
-                        b.Test();
-                    
-                    OutputObject(bw, new { Status = "OK" });
-                }
-                catch (Exception ex)
-                {
-                    ReportError(response, bw, ex.Message);
-                }
-            }
-
-            private void ListSystemInfo(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                OutputObject(bw, new
-                {
-                    APIVersion = 1,
-                    PasswordPlaceholder = PASSWORD_PLACEHOLDER,
-                    ServerVersion = System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString(),
-                    ServerVersionName = License.VersionNumbers.Version,
-                    ServerTime = DateTime.Now,
-                    OSType = Library.Utility.Utility.IsClientLinux ? (Library.Utility.Utility.IsClientOSX ? "OSX" : "Linux") : "Windows",
-                    DirectorySeparator = System.IO.Path.DirectorySeparatorChar,
-                    PathSeparator = System.IO.Path.PathSeparator,
-                    CaseSensitiveFilesystem = Duplicati.Library.Utility.Utility.IsFSCaseSensitive,
-                    MonoVersion = Duplicati.Library.Utility.Utility.IsMono ? Duplicati.Library.Utility.Utility.MonoVersion.ToString() : null,
-                    MachineName = System.Environment.MachineName,
-                    NewLine = System.Environment.NewLine,
-                    CLRVersion = System.Environment.Version.ToString(),
-                    CLROSInfo = new
-                    {
-                        Platform = System.Environment.OSVersion.Platform.ToString(),
-                        ServicePack = System.Environment.OSVersion.ServicePack,
-                        Version = System.Environment.OSVersion.Version.ToString(),
-                        VersionString = System.Environment.OSVersion.VersionString
-                    },
-                    Options = Serializable.ServerSettings.Options,
-                    CompressionModules =  Serializable.ServerSettings.CompressionModules,
-                    EncryptionModules = Serializable.ServerSettings.EncryptionModules,
-                    BackendModules = Serializable.ServerSettings.BackendModules,
-                    GenericModules = Serializable.ServerSettings.GenericModules,
-                    WebModules = Serializable.ServerSettings.WebModules
-                });
-            }
-
-            private void ListSupportedActions(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                OutputObject(bw, new { Version = 1, Methods = SUPPORTED_METHODS.Keys });
-            }
-
-            private void ListBackups (HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                var schedules = Program.DataConnection.Schedules;
-                var backups = Program.DataConnection.Backups;
-                
-                var all = from n in backups
-                select new AddOrUpdateBackupData() {
-                    Backup = (Database.Backup)n,
-                    Schedule = 
-                        (from x in schedules
-                            where x.Tags != null && x.Tags.Contains("ID=" + n.ID)
-                            select (Database.Schedule)x).FirstOrDefault()
-                };
-                
-                OutputObject(bw, all.ToArray());
-            }
-
-            private void ListTags(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                var r = 
-                    from n in 
-                    Serializable.ServerSettings.CompressionModules
-                        .Union(Serializable.ServerSettings.EncryptionModules)
-                        .Union(Serializable.ServerSettings.BackendModules)
-                        .Union(Serializable.ServerSettings.GenericModules)
-                        select n.Key.ToLower();
-                
-                // Append all known tags
-                r = r.Union(from n in Program.DataConnection.Backups select n.Tags into p from x in p select x.ToLower());
-                OutputObject(bw, r);
-            }
-
-            private void ValidatePath(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                if (input["path"] == null || input["path"].Value == null)
-                {
-                    ReportError(response, bw, "The path parameter was not set");
-                    return;
-                }
-                
-                try
-                {
-                    string path = SpecialFolders.ExpandEnvironmentVariables(input["path"].Value);                
-                    if (System.IO.Path.IsPathRooted(path) && System.IO.Directory.Exists(path))
-                    {
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-                    }
-                }
-                catch
-                {
-                }
-                
-                ReportError(response, bw, "File or folder not found");
-                return;
-            }
-
-            private static IEnumerable<Serializable.TreeNode> ListFolderAsNodes(string entrypath, bool skipFiles)
-            {
-                //Helper function for finding out if a folder has sub elements
-                Func<string, bool> hasSubElements = (p) => skipFiles ? Directory.EnumerateDirectories(p).Any() : Directory.EnumerateFileSystemEntries(p).Any();
-
-                //Helper function for dealing with exceptions when accessing off-limits folders
-                Func<string, bool> isEmptyFolder = (p) =>
-                {
-                    try { return !hasSubElements(p); }
-                    catch { }
-                    return true;
-                };
-
-                //Helper function for dealing with exceptions when accessing off-limits folders
-                Func<string, bool> canAccess = (p) =>
-                {
-                    try { hasSubElements(p); return true; }
-                    catch { }
-                    return false;
-                }; 
-                
-                var systemIO = Library.Utility.Utility.IsClientLinux
-                    ? (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOLinux() 
-                    : (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOWindows();
-
-                foreach (var s in System.IO.Directory.EnumerateFileSystemEntries(entrypath))
-                {
-                    Serializable.TreeNode tn = null;
-                    try
-                    {
-                        var attr = systemIO.GetFileAttributes(s);
-                        //var isSymlink = (attr & FileAttributes.ReparsePoint) != 0;
-                        var isFolder = (attr & FileAttributes.Directory) != 0;
-                        var isFile = !isFolder;
-                        //var isHidden = (attr & FileAttributes.Hidden) != 0;
-
-                        var accesible = isFile || canAccess(s);
-                        var isLeaf = isFile || !accesible || isEmptyFolder(s);
-
-                        var rawid = isFolder ? Library.Utility.Utility.AppendDirSeparator(s) : s;
-                        if (!skipFiles || isFolder)
-                            tn = new Serializable.TreeNode()
-                            {
-                                id = rawid,
-                                text = systemIO.PathGetFileName(s),
-                                iconCls = isFolder ? (accesible ? "x-tree-icon-parent" : "x-tree-icon-locked") : "x-tree-icon-leaf",
-                                leaf = isLeaf
-                            };
-                    }
-                    catch
-                    {
-                    }
-
-                    if (tn != null)
-                        yield return tn;
-                }
-            }
-
-            private void GetFolderContents(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                if (input["path"] == null || input["path"].Value == null)
-                {
-                    ReportError(response, bw, "The path parameter was not set");
-                    return;
-                }
-
-                bool skipFiles = Library.Utility.Utility.ParseBool(input["onlyfolders"].Value, false);
-
-                var path = input["path"].Value;
-                string specialpath = null;
-                string specialtoken = null;
-                
-                if (path.StartsWith("%"))
-                {
-                    var ix = path.IndexOf("%", 1);
-                    if (ix > 0)
-                    {
-                        var tk = path.Substring(0, ix + 1);
-                        var node = SpecialFolders.Nodes.Where(x => x.id.Equals(tk, StringComparison.InvariantCultureIgnoreCase)).FirstOrDefault();
-                        if (node != null)
-                        {
-                            specialpath = node.resolvedpath;
-                            specialtoken = node.id;
-                        }
-                    }
-                }
-                
-                path = SpecialFolders.ExpandEnvironmentVariables(path);
-                
-                if (Duplicati.Library.Utility.Utility.IsClientLinux && !path.StartsWith("/"))
-                {
-                    ReportError(response, bw, "The path parameter must start with a forward-slash");
-                    return;
-                }
-
-                try
-                {
-                    if (path != "" && path != "/")
-                        path = Duplicati.Library.Utility.Utility.AppendDirSeparator(path);
-
-                    IEnumerable<Serializable.TreeNode> res;
-
-                    if (!Library.Utility.Utility.IsClientLinux && (path.Equals("/") || path.Equals("")))
-                    {
-                        res = 
-                            from di in System.IO.DriveInfo.GetDrives()
-                            where di.DriveType == DriveType.Fixed || di.DriveType == DriveType.Network || di.DriveType == DriveType.Removable
-                            select new Serializable.TreeNode()
-                            {
-                                id = di.RootDirectory.FullName,
-                                text = di.RootDirectory.FullName.Replace('\\', ' ') + "(" + di.DriveType + ")",
-                                iconCls = "x-tree-icon-drive"
-                            };
-                    }
-                    else
-                    {
-                        res = ListFolderAsNodes(path, skipFiles);                        
-                    }
-
-                    if ((path.Equals("/") || path.Equals("")) && specialtoken == null) 
-                    {
-                        // Prepend special folders
-                        res = SpecialFolders.Nodes.Union(res);
-                    }
-                    
-                    if (specialtoken != null)
-                    {
-                        res = from n in res
-                            select new Serializable.TreeNode() {
-                            id = specialtoken + n.id.Substring(specialpath.Length),
-                            text = n.text,
-                            iconCls = n.iconCls,
-                            leaf = n.leaf,
-                            resolvedpath = n.id
-                            };
-                    }
-                    
-                    OutputObject(bw, res);
-                }
-                catch (Exception ex)
-                {
-                    ReportError(response, bw, "Failed to process the path: " + ex.Message);
-                }
-            }       
-
-            private bool LongPollCheck(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, BodyWriter bw, EventPollNotify poller, ref long id, out bool isError)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                if (Library.Utility.Utility.ParseBool(input["longpoll"].Value, false))
-                {
-                    long lastEventId;
-                    if (!long.TryParse(input["lasteventid"].Value, out lastEventId))
-                    {
-                        ReportError(response, bw, "When activating long poll, the request must include the last event id");
-                        isError = true;
-                        return false;
-                    }
-
-                    TimeSpan ts;
-                    try { ts = Library.Utility.Timeparser.ParseTimeSpan(input["duration"].Value); }
-                    catch (Exception ex)
-                    {
-                        ReportError(response, bw, "Invalid duration: " + ex.Message);
-                        isError = true;
-                        return false;
-                    }
-
-                    if (ts <= TimeSpan.FromSeconds(10) || ts.TotalMilliseconds > int.MaxValue)
-                    {
-                        ReportError(response, bw, "Invalid duration, must be at least 10 seconds, and less than " + int.MaxValue + " milliseconds");
-                        isError = true;
-                        return false;
-                    }
-
-                    isError = false;
-                    id = poller.Wait(lastEventId, (int)ts.TotalMilliseconds);
-                    return true;
-                }
-
-                isError = false;
-                return false;
-            }
-
-            private void GetProgressState(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                if (Program.GenerateProgressState == null)
-                {
-                    ReportError(response, bw, "No active backup");
-                }
-                else
-                {
-                    var ev = Program.GenerateProgressState();
-                    OutputObject(bw, ev);
-                }
-            }
-
-            private void GetCurrentState (HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                bool isError;
-                long id = 0;
-                if (LongPollCheck(request, response, bw, Program.StatusEventNotifyer, ref id, out isError))
-                {
-                    //Make sure we do not report a higher number than the eventnotifyer says
-                    var st = new Serializable.ServerStatus();
-                    st.LastEventID = id;
-                    OutputObject(bw, st);
-                }
-                else if (!isError)
-                {
-                    OutputObject(bw, new Serializable.ServerStatus());
-                }
-            }
-
-            private void ListCoreOptions(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                OutputObject(bw, new Duplicati.Library.Main.Options(new Dictionary<string, string>()).SupportedCommands);
-            }
-
-            private void ListApplicationSettings(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                OutputObject(bw, Program.DataConnection.ApplicationSettings);
-            }
-            
-            private static void MergeJsonObjects(Newtonsoft.Json.Linq.JObject self, Newtonsoft.Json.Linq.JObject other)
-            {
-                foreach(var p in other.Properties())
-                {
-                    var sp = self.Property(p.Name);
-                    if (sp == null)
-                        self.Add(p);
-                    else
-                    {
-                        switch (p.Type)
-                        {
-                            // Primitives override
-                            case Newtonsoft.Json.Linq.JTokenType.Boolean:
-                            case Newtonsoft.Json.Linq.JTokenType.Bytes:
-                            case Newtonsoft.Json.Linq.JTokenType.Comment:
-                            case Newtonsoft.Json.Linq.JTokenType.Constructor:
-                            case Newtonsoft.Json.Linq.JTokenType.Date:
-                            case Newtonsoft.Json.Linq.JTokenType.Float:
-                            case Newtonsoft.Json.Linq.JTokenType.Guid:
-                            case Newtonsoft.Json.Linq.JTokenType.Integer:
-                            case Newtonsoft.Json.Linq.JTokenType.String:
-                            case Newtonsoft.Json.Linq.JTokenType.TimeSpan:
-                            case Newtonsoft.Json.Linq.JTokenType.Uri:
-                            case Newtonsoft.Json.Linq.JTokenType.None:
-                            case Newtonsoft.Json.Linq.JTokenType.Null:
-                            case Newtonsoft.Json.Linq.JTokenType.Undefined:
-                                self.Replace(p);
-                                break;
-
-                            // Arrays merge
-                            case Newtonsoft.Json.Linq.JTokenType.Array:
-                                if (sp.Type == Newtonsoft.Json.Linq.JTokenType.Array)
-                                    sp.Value = new Newtonsoft.Json.Linq.JArray(((Newtonsoft.Json.Linq.JArray)sp.Value).Union((Newtonsoft.Json.Linq.JArray)p.Value));
-                                else
-                                {
-                                    var a = new Newtonsoft.Json.Linq.JArray(sp.Value);
-                                    sp.Value = new Newtonsoft.Json.Linq.JArray(a.Union((Newtonsoft.Json.Linq.JArray)p.Value));
-                                }
-                                
-                                break;
-                                
-                            // Objects merge
-                            case Newtonsoft.Json.Linq.JTokenType.Object:
-                                if (sp.Type == Newtonsoft.Json.Linq.JTokenType.Object)
-                                    MergeJsonObjects((Newtonsoft.Json.Linq.JObject)sp.Value, (Newtonsoft.Json.Linq.JObject)p.Value);
-                                else
-                                    sp.Value = p.Value;
-                                break;
-                                
-                            // Ignore other stuff                                
-                            default:
-                                break;
-                        }
-                    }
-                }
-            }
-
-            private void GetBackupDefaults(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {   
-                // Start with a scratch object
-                var o = new Newtonsoft.Json.Linq.JObject();
-                
-                // Add application wide settings
-                o.Add("ApplicationOptions", new Newtonsoft.Json.Linq.JArray(Program.DataConnection.Settings));
-                
-                try
-                {
-                    // Add built-in defaults
-                    Newtonsoft.Json.Linq.JObject n;
-                    using(var s = new System.IO.StreamReader(System.Reflection.Assembly.GetExecutingAssembly().GetManifestResourceStream(System.Reflection.Assembly.GetExecutingAssembly().GetName().Name + ".newbackup.json")))
-                        n = (Newtonsoft.Json.Linq.JObject)Newtonsoft.Json.JsonConvert.DeserializeObject(s.ReadToEnd());
-                    
-                    MergeJsonObjects(o, n);
-                }
-                catch
-                {
-                }
-
-                try
-                {
-                    // Add install defaults/overrides, if present
-                    var path = System.IO.Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "newbackup.json");
-                    if (System.IO.File.Exists(path))
-                    {
-                        Newtonsoft.Json.Linq.JObject n;
-                        n = (Newtonsoft.Json.Linq.JObject)Newtonsoft.Json.JsonConvert.DeserializeObject(System.IO.File.ReadAllText(path));
-                        
-                        MergeJsonObjects(o, n);
-                    }
-                }
-                catch
-                {
-                }
-
-                OutputObject(bw, new
-                {
-                    success = true,
-                    data = o
-                });
-            }
-
-            private void GetBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                var bk = Program.DataConnection.GetBackup(input["id"].Value);
-                if (bk == null)
-                    ReportError(response, bw, "Invalid or missing backup id");
-                else
-                {
-                    var systemIO = Library.Utility.Utility.IsClientLinux
-                        ? (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOLinux()
-                        : (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOWindows();
-
-                    var scheduleId = Program.DataConnection.GetScheduleIDsFromTags(new string[] { "ID=" + bk.ID });
-                    var schedule = scheduleId.Any() ? Program.DataConnection.GetSchedule(scheduleId.First()) : null;
-                    var sourcenames = bk.Sources.Distinct().Select(x => {
-                        var sp = SpecialFolders.TranslateToDisplayString(x);
-                        if (sp != null)
-                            return new KeyValuePair<string, string>(x, sp);
-
-                        x = SpecialFolders.ExpandEnvironmentVariables(x);
-                        try {
-                            var nx = x;
-                            if (nx.EndsWith(System.IO.Path.DirectorySeparatorChar.ToString()))
-                                nx = nx.Substring(0, nx.Length - 1);
-                            var n = systemIO.PathGetFileName(nx);
-                            if (!string.IsNullOrWhiteSpace(n))
-                                return new KeyValuePair<string, string>(x, n);
-                        } catch {
-                        }
-                        
-                        if (x.EndsWith(System.IO.Path.DirectorySeparatorChar.ToString()) && x.Length > 1)
-                            return new KeyValuePair<string, string>(x, x.Substring(0, x.Length - 1).Substring(x.Substring(0, x.Length - 1).LastIndexOf("/") + 1));
-                        else
-                            return new KeyValuePair<string, string>(x, x);
-                        
-                    }).ToDictionary(x => x.Key, x => x.Value);
-                    
-                    //TODO: Filter out the password in both settings and the target url
-                    
-                    OutputObject(bw, new
-                    {
-                        success = true,
-                        data = new {
-                            Schedule = schedule,
-                            Backup = bk,
-                            DisplayNames = sourcenames
-                        }
-                    });
-                }
-            }
-
-            private void UpdateBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                string str = request.Form["data"].Value;
-                if (string.IsNullOrWhiteSpace(str))
-                {
-                    ReportError(response, bw, "Missing backup object");
-                    return;
-                }
-
-                AddOrUpdateBackupData data = null;
-                try
-                {
-                    data = Serializer.Deserialize<AddOrUpdateBackupData>(new StringReader(str));
-                    if (data.Backup == null)
-                    {
-                        ReportError(response, bw, "Data object had no backup entry");
-                        return;
-                    }
-                    
-                    if (data.Backup.ID == null)
-                    {
-                        ReportError(response, bw, "Invalid or missing backup id");
-                        return;
-                    }                    
-                    
-                    if (data.Backup.IsTemporary)
-                    {
-                        var backup = Program.DataConnection.GetBackup(data.Backup.ID);
-                        if (backup.IsTemporary)
-                            throw new InvalidDataException("External is temporary but internal is not?");
-                        
-                        Program.DataConnection.UpdateTemporaryBackup(backup);
-                        OutputObject(bw, new { status = "OK" });
-                    }
-                    else
-                    {                    
-                        lock(Program.DataConnection.m_lock)
-                        {
-                            var backup = Program.DataConnection.GetBackup(data.Backup.ID);
-                            if (backup == null)
-                            {
-                                ReportError(response, bw, "Invalid or missing backup id");
-                                return;
-                            }
-        
-                            if (Program.DataConnection.Backups.Where(x => x.Name.Equals(data.Backup.Name, StringComparison.InvariantCultureIgnoreCase) && x.ID != data.Backup.ID).Any())
-                            {
-                                ReportError(response, bw, "There already exists a backup with the name: " + data.Backup.Name);
-                                return;
-                            }
-                            
-                            //TODO: Merge in real passwords where the placeholder is found
-                            Program.DataConnection.AddOrUpdateBackupAndSchedule(data.Backup, data.Schedule);
-    
-                        }
-                        
-                        OutputObject(bw, new { status = "OK" });
-                    }
-                }
-                catch (Exception ex)
-                {
-                    if (data == null)
-                        ReportError(response, bw, string.Format("Unable to parse backup or schedule object: {0}", ex.Message));
-                    else
-                        ReportError(response, bw, string.Format("Unable to save backup or schedule: {0}", ex.Message));
-                        
-                }
-            }
-            
-            private class AddOrUpdateBackupData
-            {
-                public Database.Schedule Schedule {get; set;}
-                public Database.Backup Backup {get; set;}
-            }
-
-            private void AddBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                var str = request.Form["data"].Value;
-                if (string.IsNullOrWhiteSpace(str))
-                {
-                    ReportError(response, bw, "Missing backup object");
-                    return;
-                }
-
-                AddOrUpdateBackupData data = null;
-                try
-                {
-                    data = Serializer.Deserialize<AddOrUpdateBackupData>(new StringReader(str));
-                    if (data.Backup == null)
-                    {
-                        ReportError(response, bw, "Data object had no backup entry");
-                        return;
-                    }
-                        
-                    data.Backup.ID = null;
-                    
-                    if (Duplicati.Library.Utility.Utility.ParseBool(request.Form["temporary"].Value, false))
-                    {
-                        Program.DataConnection.RegisterTemporaryBackup(data.Backup);
-                        
-                        OutputObject(bw, new { status = "OK", ID = data.Backup.ID });
-                    }
-                    else
-                    {
-                        lock(Program.DataConnection.m_lock)
-                        {
-                            if (Program.DataConnection.Backups.Where(x => x.Name.Equals(data.Backup.Name, StringComparison.InvariantCultureIgnoreCase)).Any())
-                            {
-                                ReportError(response, bw, "There already exists a backup with the name: " + data.Backup.Name);
-                                return;
-                            }
-                            
-                            Program.DataConnection.AddOrUpdateBackupAndSchedule(data.Backup, data.Schedule);
-                        }
-                        
-                        OutputObject(bw, new { status = "OK", ID = data.Backup.ID });
-                    }
-                }
-                catch (Exception ex)
-                {
-                    if (data == null)
-                        ReportError(response, bw, string.Format("Unable to parse backup or schedule object: {0}", ex.Message));
-                    else
-                        ReportError(response, bw, string.Format("Unable to save schedule or backup object: {0}", ex.Message));
-                }
-            }
-
-            private void DeleteBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-                var backup = Program.DataConnection.GetBackup(input["id"].Value);
-                if (backup == null)
-                {
-                    ReportError(response, bw, "Invalid or missing backup id");
-                    return;
-                }
-
-                if (Program.WorkThread.Active)
-                {
-                    try
-                    {
-                        //TODO: It's not safe to access the values like this, 
-                        //because the runner thread might interfere
-                        var nt = Program.WorkThread.CurrentTask;
-                        if (backup.Equals(nt == null ? null : nt.Backup))
-                        {
-                            bool force;
-                            if (!bool.TryParse(input["force"].Value, out force))
-                                force = false;
-                            
-                            if (!force)
-                            {
-                                OutputObject(bw, new { status = "failed", reason = "backup-in-progress" });
-                                return;
-                            }
-
-                            bool hasPaused = Program.LiveControl.State == LiveControls.LiveControlState.Paused;
-                            Program.LiveControl.Pause();
-
-                            try
-                            {
-                                for (int i = 0; i < 10; i++)
-                                    if (Program.WorkThread.Active)
-                                    {
-                                        var t = Program.WorkThread.CurrentTask;
-                                        if (backup.Equals(t == null ? null : t.Backup))
-                                            System.Threading.Thread.Sleep(1000);
-                                        else
-                                            break;
-                                    }
-                                    else
-                                        break;
-                            }
-                            finally
-                            {
-                            }
-
-                            if (Program.WorkThread.Active)
-                            {
-                                var t = Program.WorkThread.CurrentTask;
-                                if (backup.Equals(t == null ? null : t.Backup))
-                                {
-                                    if (hasPaused)
-                                        Program.LiveControl.Resume();
-                                    OutputObject(bw, new { status = "failed", reason = "backup-unstoppable" });
-                                    return;
-                                }
-                            }
-
-                            if (hasPaused)
-                                Program.LiveControl.Resume();
-                        }
-                    }
-                    catch (Exception ex)
-                    {
-                        OutputObject(bw, new { status = "error", message = ex.Message });
-                        return;
-                    }
-                }
-                
-                Program.DataConnection.DeleteBackup(backup);
-
-                //We have fiddled with the schedules
-                Program.Scheduler.Reschedule();
-
-                OutputObject(bw, new { status = "OK" });
-            }
-
-            private void SendCommand(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
-            {
-                HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-
-                string command = input["command"].Value ?? "";
-                
-                switch (command.ToLowerInvariant())
-                {
-                    case "pause":
-                        if (input.Contains("duration") && !string.IsNullOrWhiteSpace(input["duration"].Value))
-                        {
-                            TimeSpan ts;
-                            try
-                            {
-                                ts = Library.Utility.Timeparser.ParseTimeSpan(input["duration"].Value);
-                            }
-                            catch (Exception ex)
-                            {
-                                ReportError(response, bw, ex.Message);
-                                return;
-                            }
-                            if (ts.TotalMilliseconds > 0)
-                                Program.LiveControl.Pause(ts);
-                            else
-                                Program.LiveControl.Pause();
-                        }
-                        else
-                        {
-                            Program.LiveControl.Pause();
-                        }
-
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-                    case "resume":
-                        Program.LiveControl.Resume();
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-
-                    case "stop":
-                    case "abort":
-                        {
-                            var task = Program.WorkThread.CurrentTask;
-                            var tasks = Program.WorkThread.CurrentTasks;
-                            long taskid;
-                            if (!input.Contains("taskid") || !long.TryParse(input["taskid"].Value ?? "", out taskid))
-                            {
-                                ReportError(response, bw, "Invalid or missing taskid");
-                                return;
-                            }
-
-                            if (task != null)
-                                tasks.Insert(0, task);
-                        
-                            task = tasks.Where(x => x.TaskID == taskid).FirstOrDefault();
-                            if (task == null)
-                            {
-                                ReportError(response, bw, "No such task");
-                                return;
-                            }
-                            
-                            if (string.Equals(command, "abort", StringComparison.InvariantCultureIgnoreCase))
-                                task.Abort();
-                            else
-                                task.Stop();
-                                                    
-                            OutputObject(bw, new { Status = "OK" });
-                            return;
-                        }
-
-                    case "is-backup-active":
-                        {
-                            var backup = Program.DataConnection.GetBackup(input["id"].Value);
-                            if (backup == null)
-                            {
-                                ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
-                                return;
-                            }
-
-                            var t = Program.WorkThread.CurrentTask;
-                            var bt = t == null ? null : t.Backup;
-                            if (bt != null && backup.ID == bt.ID)
-                            {
-                                OutputObject(bw, new { Status = "OK", Active = true });
-                                return;
-                            }
-                            else if (Program.WorkThread.CurrentTasks.Where(x =>
-                            { 
-                                var bn = x == null ? null : x.Backup;
-                                return bn == null || bn.ID == backup.ID;
-                            }).Any())
-                            {
-                                OutputObject(bw, new { Status = "OK", Active = true });
-                                return;
-                            }
-                            else
-                            {
-                                OutputObject(bw, new { Status = "OK", Active = false });
-                                return;
-                            }
-                        }
-
-                    case "run":
-                    case "run-backup":
-                        {
-                            
-                            var backup = Program.DataConnection.GetBackup(input["id"].Value);
-                            if (backup == null)
-                            {
-                                ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
-                                return;
-                            }
-
-                            var t = Program.WorkThread.CurrentTask;
-                            var bt = t == null ? null : t.Backup;
-                            if (bt != null && backup.ID == bt.ID)
-                            {
-                                // Already running
-                            }
-                            else if (Program.WorkThread.CurrentTasks.Where(x => { 
-                                var bn = x == null ? null : x.Backup;
-                                return bn == null || bn.ID == backup.ID;
-                                }).Any())
-                            {
-                                // Already in queue
-                            }
-                            else
-                            {
-                                Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.Backup, backup));
-                                Program.StatusEventNotifyer.SignalNewEvent();
-                            }
-                        }
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-
-                    case "run-verify":
-                        {
-                            var backup = Program.DataConnection.GetBackup(input["id"].Value);
-                            if (backup == null)
-                            {
-                                ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
-                                return;
-                            }
-
-                            Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.Verify, backup));
-                            Program.StatusEventNotifyer.SignalNewEvent();
-                        }
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-
-                    case "run-repair":
-                        {
-                            var backup = Program.DataConnection.GetBackup(input["id"].Value);
-                            if (backup == null)
-                            {
-                                ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
-                                return;
-                            }
-
-                            Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.Repair, backup));
-                            Program.StatusEventNotifyer.SignalNewEvent();
-                        }
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-                    case "create-report":
-                        {
-                            var backup = Program.DataConnection.GetBackup(input["id"].Value);
-                            if (backup == null)
-                            {
-                                ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
-                                return;
-                            }
-
-                            Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.CreateReport, backup));
-                            Program.StatusEventNotifyer.SignalNewEvent();
-                        }
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-
-                    case "clear-warning":
-                        Program.HasWarning = false;
-                        Program.StatusEventNotifyer.SignalNewEvent();
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-                    case "clear-error":
-                        Program.HasError = false;
-                        Program.StatusEventNotifyer.SignalNewEvent();
-                        OutputObject(bw, new { Status = "OK" });
-                        return;
-                    
-                    default:
-                        
-                        var m = Duplicati.Library.DynamicLoader.WebLoader.Modules.Where(x => x.Key.Equals(command, StringComparison.InvariantCultureIgnoreCase)).FirstOrDefault();
-                        if (m == null)
-                        {
-                            ReportError(response, bw, string.Format("Unsupported command {0}", command));
-                            return;
-                        }
-                        
-                        OutputObject(bw, new { 
-                            Status = "OK", 
-                            Result = m.Execute(input.Where(x => 
-                                    !x.Name.Equals("command", StringComparison.InvariantCultureIgnoreCase)
-                                    &&
-                                    !x.Name.Equals("action", StringComparison.InvariantCultureIgnoreCase)
-                                ).ToDictionary(x => x.Name, x => x.Value))
-                        });
-                        return;
-                }
-            }
-            
-        }
-    }
-}
diff --git a/Duplicati/Server/WebServer/AuthenticationHandler.cs b/Duplicati/Server/WebServer/AuthenticationHandler.cs
new file mode 100644
index 000000000..729644436
--- /dev/null
+++ b/Duplicati/Server/WebServer/AuthenticationHandler.cs
@@ -0,0 +1,179 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Linq;
+using HttpServer;
+using HttpServer.HttpModules;
+using System.Collections.Generic;
+
+namespace Duplicati.Server.WebServer
+{
+    internal class AuthenticationHandler : HttpModule
+    {
+        private const string AUTH_COOKIE_NAME = "session_auth";
+        private const string NONCE_COOKIE_NAME = "session_nonce";
+
+        private Dictionary<string, DateTime> m_activeTokens = new Dictionary<string, DateTime>();
+        private Dictionary<string, Tuple<DateTime, string>> m_activeNonces = new Dictionary<string, Tuple<DateTime, string>>();
+        System.Security.Cryptography.RandomNumberGenerator m_prng = System.Security.Cryptography.RNGCryptoServiceProvider.Create();
+
+        public override bool Process(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            var auth_token = request.Cookies[AUTH_COOKIE_NAME] == null || string.IsNullOrWhiteSpace(request.Cookies[AUTH_COOKIE_NAME].Value) ? null : request.Cookies[AUTH_COOKIE_NAME].Value;
+            if (input["auth-token"] != null && !string.IsNullOrWhiteSpace(input["auth-token"].Value))
+                auth_token = input["auth-token"].Value;
+
+            if (request.Uri.AbsolutePath == "/logout.cgi")
+            {
+                if (!string.IsNullOrWhiteSpace(auth_token))
+                {
+                    if (m_activeTokens.ContainsKey(auth_token))
+                        m_activeTokens.Remove(auth_token);
+                }
+
+                response.Status = System.Net.HttpStatusCode.NoContent;
+                response.Reason = "OK";
+
+                return true;
+            }
+            else if (request.Uri.AbsolutePath == "/login.cgi")
+            {
+                foreach(var k in (from n in m_activeNonces where DateTime.UtcNow > n.Value.Item1 select n.Key).ToList())
+                    m_activeNonces.Remove(k);
+
+                if (input["get-nonce"] != null && !string.IsNullOrWhiteSpace(input["get-nonce"].Value))
+                {
+                    if (m_activeNonces.Count > 50)
+                    {
+                        response.Status = System.Net.HttpStatusCode.ServiceUnavailable;
+                        response.Reason = "Too many active login attempts";
+                        return true;
+                    }
+
+                    var buf = new byte[32];
+                    var expires = DateTime.UtcNow.AddMinutes(10);
+                    m_prng.GetBytes(buf);
+                    var nonce = Convert.ToBase64String(buf);
+
+                    var sha256 = System.Security.Cryptography.SHA256.Create();
+                    sha256.TransformBlock(buf, 0, buf.Length, buf, 0);
+                    buf = Convert.FromBase64String(Program.DataConnection.ApplicationSettings.WebserverPassword);
+                    sha256.TransformFinalBlock(buf, 0, buf.Length);
+                    var pwd = Convert.ToBase64String(sha256.Hash);
+
+                    m_activeNonces.Add(nonce, new Tuple<DateTime, string>(expires, pwd));
+
+                    response.Cookies.Add(new HttpServer.ResponseCookie(NONCE_COOKIE_NAME, nonce, expires));
+                    using(var bw = new BodyWriter(response))
+                    {
+                        bw.SetOK();
+                        bw.WriteJsonObject(new {
+                            Status = "OK",
+                            Nonce = nonce,
+                            Salt = Program.DataConnection.ApplicationSettings.WebserverPasswordSalt
+                        });
+                    }
+                    return true;
+                }
+                else
+                {
+                    if (input["password"] != null && !string.IsNullOrWhiteSpace(input["password"].Value))
+                    {
+                        var nonce = request.Cookies[NONCE_COOKIE_NAME];
+                        if (nonce == null || string.IsNullOrWhiteSpace(nonce.Value) || !m_activeNonces.ContainsKey(nonce.Value))
+                        {
+                            response.Status = System.Net.HttpStatusCode.Unauthorized;
+                            response.Reason = "Unauthorized";
+                            response.ContentType = "application/json";
+                            return true;
+                        }
+
+                        var pwd = m_activeNonces[nonce.Value].Item2;
+                        m_activeNonces.Remove(nonce.Value);
+
+                        if (pwd != input["password"].Value)
+                        {
+                            response.Status = System.Net.HttpStatusCode.Unauthorized;
+                            response.Reason = "Unauthorized";
+                            response.ContentType = "application/json";
+                            return true;
+                        }
+
+                        var buf = new byte[32];
+                        var expires = DateTime.UtcNow.AddHours(1);
+                        m_prng.GetBytes(buf);
+                        var token = Duplicati.Library.Utility.Utility.Base64UrlEncode(buf);
+                        while (token.Length > 0 && token.EndsWith("="))
+                            token = token.Substring(0, token.Length - 1);
+
+                        Console.WriteLine("Added token: {0}", token);
+                        m_activeTokens.Add(token, expires);
+                        response.Cookies.Add(new  HttpServer.ResponseCookie(AUTH_COOKIE_NAME, token, expires));
+
+                        response.Status = System.Net.HttpStatusCode.OK;
+                        response.Reason = "OK";
+                        return true;
+                    }
+                }
+            }
+
+            if (string.IsNullOrWhiteSpace(Program.DataConnection.ApplicationSettings.WebserverPassword))
+                return false;
+
+            foreach(var k in (from n in m_activeTokens where DateTime.UtcNow > n.Value select n.Key).ToList())
+            {
+                Console.WriteLine("Removed token: {0}", k);
+                m_activeTokens.Remove(k);
+            }
+
+
+            // If we have a valid token, proceeed
+            if (!string.IsNullOrWhiteSpace(auth_token))
+            {
+                DateTime expires;
+                if (m_activeTokens.TryGetValue(auth_token, out expires) && DateTime.UtcNow < expires)
+                {
+                    Console.WriteLine("Approved token: {0}", auth_token);
+                    expires = DateTime.UtcNow.AddHours(1);
+                    m_activeTokens[auth_token] = expires;
+                    response.Cookies.Add(new ResponseCookie(AUTH_COOKIE_NAME, auth_token, expires));
+                    return false;
+                }
+            }
+
+            if (request.Uri.AbsolutePath == "/" || request.Uri.AbsolutePath == "/index.html")
+            {
+                response.Redirect("/login.html");
+                return true;
+            }
+                
+            if (request.Uri.AbsolutePath == "/control.cgi")
+            {
+                response.Status = System.Net.HttpStatusCode.Unauthorized;
+                response.Reason = "Not logged in";
+                response.AddHeader("Location", "login.html");
+
+                return true;
+            }
+
+            return false;
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/BodyWriter.cs b/Duplicati/Server/WebServer/BodyWriter.cs
new file mode 100644
index 000000000..20f2c02a8
--- /dev/null
+++ b/Duplicati/Server/WebServer/BodyWriter.cs
@@ -0,0 +1,65 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using Duplicati.Server.Serialization;
+
+namespace Duplicati.Server.WebServer
+{
+    internal class BodyWriter : System.IO.StreamWriter, IDisposable
+    {
+        private HttpServer.IHttpResponse m_resp;
+
+        // We override the format provider so all JSON output uses US format
+        public override IFormatProvider FormatProvider
+        {
+            get { return System.Globalization.CultureInfo.InvariantCulture; }
+        }
+
+        public BodyWriter(HttpServer.IHttpResponse resp)
+            : base(resp.Body,  resp.Encoding)
+        {
+            m_resp = resp;
+        }
+
+        protected override void Dispose (bool disposing)
+        {
+            if (!m_resp.HeadersSent)
+            {
+                base.Flush();
+                m_resp.ContentLength = base.BaseStream.Length;
+                m_resp.Send();
+            }
+            base.Dispose(disposing);
+        }
+
+        public void SetOK()
+        {
+            m_resp.Reason = "OK";
+            m_resp.Status = System.Net.HttpStatusCode.OK;
+        }
+
+        public void WriteJsonObject(object o)
+        {
+            if (!m_resp.HeadersSent)
+                m_resp.ContentType = "application/json";
+            Serializer.SerializeJson(this, o);
+        }
+    }
+
+}
+
diff --git a/Duplicati/Server/WebServer/ControlHandler.cs b/Duplicati/Server/WebServer/ControlHandler.cs
new file mode 100644
index 000000000..c270f64e1
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlHandler.cs
@@ -0,0 +1,753 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Linq;
+using HttpServer;
+using HttpServer.HttpModules;
+using System.Collections.Generic;
+using Duplicati.Server.Serialization;
+
+namespace Duplicati.Server.WebServer
+{
+    internal partial class ControlHandler : HttpModule
+    {
+        private delegate void ProcessSub(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter writer);
+        private readonly Dictionary<string, ProcessSub> SUPPORTED_METHODS;
+
+        public ControlHandler()
+        {
+            SUPPORTED_METHODS = new Dictionary<string, ProcessSub>(System.StringComparer.InvariantCultureIgnoreCase);
+
+            //Make a list of all supported actions
+            SUPPORTED_METHODS.Add("supported-actions", ListSupportedActions);
+            SUPPORTED_METHODS.Add("system-info", ListSystemInfo);
+            SUPPORTED_METHODS.Add("list-backups", ListBackups);
+            SUPPORTED_METHODS.Add("get-current-state", GetCurrentState);
+            SUPPORTED_METHODS.Add("get-progress-state", GetProgressState);
+            SUPPORTED_METHODS.Add("list-application-settings", ListApplicationSettings);
+            SUPPORTED_METHODS.Add("list-options", ListCoreOptions);
+            SUPPORTED_METHODS.Add("send-command", SendCommand);
+            SUPPORTED_METHODS.Add("get-backup-defaults", GetBackupDefaults);
+            SUPPORTED_METHODS.Add("get-folder-contents", GetFolderContents);
+            SUPPORTED_METHODS.Add("get-backup", GetBackup);
+            SUPPORTED_METHODS.Add("add-backup", AddBackup);
+            SUPPORTED_METHODS.Add("update-backup", UpdateBackup);
+            SUPPORTED_METHODS.Add("delete-backup", DeleteBackup);
+            SUPPORTED_METHODS.Add("validate-path", ValidatePath);
+            SUPPORTED_METHODS.Add("list-tags", ListTags);
+            SUPPORTED_METHODS.Add("test-backend", TestBackend);
+            SUPPORTED_METHODS.Add("list-remote-folder", ListRemoteFolder);
+            SUPPORTED_METHODS.Add("list-backup-sets", ListBackupSets);
+            SUPPORTED_METHODS.Add("search-backup-files", SearchBackupFiles);
+            SUPPORTED_METHODS.Add("restore-files", RestoreFiles);
+            SUPPORTED_METHODS.Add("read-log", ReadLogData);
+            SUPPORTED_METHODS.Add("get-license-data", GetLicenseData);
+        }
+
+        public override bool Process (HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
+        {
+            //We use the fake entry point /control.cgi to listen for requests
+            //This ensures that the rest of the webserver can just serve plain files
+            if (!request.Uri.AbsolutePath.Equals("/control.cgi", StringComparison.InvariantCultureIgnoreCase))
+                return false;
+
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+
+            string action = input["action"].Value ?? "";
+
+            //Lookup the actual handler method
+            ProcessSub method;
+            SUPPORTED_METHODS.TryGetValue(action, out method);
+
+            if (method == null) {
+                response.Status = System.Net.HttpStatusCode.NotImplemented;
+                response.Reason = "Unsupported action: " + (action == null ? "<null>" : "");
+                response.Send();
+            } else {
+                //Default setup
+                response.Status = System.Net.HttpStatusCode.OK;
+                response.Reason = "OK";
+                #if DEBUG
+                response.ContentType = "text/plain";
+                #else
+                response.ContentType = "text/json";
+                #endif
+                using (BodyWriter bw = new BodyWriter(response))
+                {
+                    try
+                    {
+                        method(request, response, session, bw);
+                    }
+                    catch (Exception ex)
+                    {
+                        try
+                        {
+                            if (!response.HeadersSent)
+                            {
+                                response.Status = System.Net.HttpStatusCode.InternalServerError;
+                                response.Reason = "Error";
+                                response.ContentType = "text/plain";
+
+                                bw.WriteJsonObject(new
+                                {
+                                    Message = ex.Message,
+                                    Type = ex.GetType().Name,
+                                    #if DEBUG
+                                    Stacktrace = ex.ToString()
+                                    #endif
+                                });
+                                bw.Flush();
+                            }
+                        }
+                        catch (Exception flex)
+                        {
+                            Program.DataConnection.LogError("", "Handling outer ex", ex);
+                            Program.DataConnection.LogError("", "Gaver inner ex", flex);
+                        }
+                    }
+                }
+            }
+
+            return true;
+        }
+
+        private void ReportError(HttpServer.IHttpResponse response, BodyWriter bw, string message)
+        {
+            response.Status = System.Net.HttpStatusCode.InternalServerError;
+            response.Reason = message;
+
+            bw.WriteJsonObject(new { Error = message });
+        }
+
+        private List<Dictionary<string, object>> DumpTable(System.Data.IDbCommand cmd, string tablename, string pagingfield, string offset_str, string pagesize_str)
+        {
+            var result = new List<Dictionary<string, object>>();
+
+            long pagesize;
+            if (!long.TryParse(pagesize_str, out pagesize))
+                pagesize = 100;
+
+            pagesize = Math.Max(10, Math.Min(500, pagesize));
+
+            cmd.CommandText = "SELECT * FROM \"" + tablename + "\"";
+            long offset = 0;
+            if (!string.IsNullOrWhiteSpace(offset_str) && long.TryParse(offset_str, out offset) && !string.IsNullOrEmpty(pagingfield))
+            {
+                var p = cmd.CreateParameter();
+                p.Value = offset;
+                cmd.Parameters.Add(p);
+
+                cmd.CommandText += " WHERE \"" + pagingfield + "\" < ?";
+            }
+
+            if (!string.IsNullOrEmpty(pagingfield))
+                cmd.CommandText += " ORDER BY \"" + pagingfield + "\" DESC";
+            cmd.CommandText += " LIMIT " + pagesize.ToString();
+
+            using(var rd = cmd.ExecuteReader())
+            {
+                var names = new List<string>();
+                for(var i = 0; i < rd.FieldCount; i++)
+                    names.Add(rd.GetName(i));
+
+                while (rd.Read())
+                {
+                    var dict = new Dictionary<string, object>();
+                    for(int i = 0; i < names.Count; i++)
+                        dict[names[i]] = rd.GetValue(i);
+
+                    result.Add(dict);                                    
+                }
+            }
+
+            return result;
+        }
+
+        private void GetLicenseData(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            bw.WriteJsonObject(License.LicenseReader.ReadLicenses(System.IO.Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetEntryAssembly().Location), "licenses")));
+        }
+
+        private void RestoreFiles(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            var bk = Program.DataConnection.GetBackup(input["id"].Value);
+            if (bk == null)
+            {
+                ReportError(response, bw, "Invalid or missing backup id");
+                return;
+            }
+
+            var filters = input["paths"].Value.Split(new string[] { System.IO.Path.PathSeparator.ToString() }, StringSplitOptions.RemoveEmptyEntries);
+            var time = Duplicati.Library.Utility.Timeparser.ParseTimeInterval(input["time"].Value, DateTime.Now);
+            var restoreTarget = input["restore-path"].Value;
+            var overwrite = Duplicati.Library.Utility.Utility.ParseBool(input["overwrite"].Value, false);
+            var task = Runner.CreateRestoreTask(bk, filters, time, restoreTarget, overwrite);
+            Program.WorkThread.AddTask(task);
+
+            bw.WriteJsonObject(new { TaskID = task.TaskID });
+
+        }
+
+        private void ListBackupSets(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            var bk = Program.DataConnection.GetBackup(input["id"].Value);
+            if (bk == null)
+            {
+                ReportError(response, bw, "Invalid or missing backup id");
+                return;
+            }
+
+
+            var r = Runner.Run(Runner.CreateTask(DuplicatiOperation.List, bk), false) as Duplicati.Library.Interface.IListResults;
+
+            bw.WriteJsonObject(r.Filesets);
+        }
+
+        private void ListRemoteFolder(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            if (input["url"] == null || input["url"].Value == null)
+            {
+                ReportError(response, bw, "The url parameter was not set");
+                return;
+            }
+
+            try
+            {
+                using(var b = Duplicati.Library.DynamicLoader.BackendLoader.GetBackend(input["url"].Value, new Dictionary<string, string>()))
+                    bw.WriteJsonObject(new { Status = "OK", Folders = b.List() });
+
+            }
+            catch (Exception ex)
+            {
+                ReportError(response, bw, ex.Message);
+            }
+        }
+
+        private void TestBackend(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            if (input["url"] == null || input["url"].Value == null)
+            {
+                ReportError(response, bw, "The url parameter was not set");
+                return;
+            }
+
+            try
+            {
+                using(var b = Duplicati.Library.DynamicLoader.BackendLoader.GetBackend(input["url"].Value, new Dictionary<string, string>()))
+                    b.Test();
+
+                bw.WriteJsonObject(new { Status = "OK" });
+            }
+            catch (Exception ex)
+            {
+                ReportError(response, bw, ex.Message);
+            }
+        }
+
+        private void ListSystemInfo(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            bw.WriteJsonObject(new
+            {
+                APIVersion = 1,
+                PasswordPlaceholder = Duplicati.Server.WebServer.Server.PASSWORD_PLACEHOLDER,
+                ServerVersion = System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString(),
+                ServerVersionName = License.VersionNumbers.Version,
+                ServerTime = DateTime.Now,
+                OSType = Library.Utility.Utility.IsClientLinux ? (Library.Utility.Utility.IsClientOSX ? "OSX" : "Linux") : "Windows",
+                DirectorySeparator = System.IO.Path.DirectorySeparatorChar,
+                PathSeparator = System.IO.Path.PathSeparator,
+                CaseSensitiveFilesystem = Duplicati.Library.Utility.Utility.IsFSCaseSensitive,
+                MonoVersion = Duplicati.Library.Utility.Utility.IsMono ? Duplicati.Library.Utility.Utility.MonoVersion.ToString() : null,
+                MachineName = System.Environment.MachineName,
+                NewLine = System.Environment.NewLine,
+                CLRVersion = System.Environment.Version.ToString(),
+                CLROSInfo = new
+                {
+                    Platform = System.Environment.OSVersion.Platform.ToString(),
+                    ServicePack = System.Environment.OSVersion.ServicePack,
+                    Version = System.Environment.OSVersion.Version.ToString(),
+                    VersionString = System.Environment.OSVersion.VersionString
+                },
+                Options = Serializable.ServerSettings.Options,
+                CompressionModules =  Serializable.ServerSettings.CompressionModules,
+                EncryptionModules = Serializable.ServerSettings.EncryptionModules,
+                BackendModules = Serializable.ServerSettings.BackendModules,
+                GenericModules = Serializable.ServerSettings.GenericModules,
+                WebModules = Serializable.ServerSettings.WebModules
+            });
+        }
+
+        private void ListSupportedActions(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            bw.WriteJsonObject(new { Version = 1, Methods = SUPPORTED_METHODS.Keys });
+        }
+
+        private void ListBackups (HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            var schedules = Program.DataConnection.Schedules;
+            var backups = Program.DataConnection.Backups;
+
+            var all = from n in backups
+                select new AddOrUpdateBackupData() {
+                Backup = (Database.Backup)n,
+                Schedule = 
+                    (from x in schedules
+                        where x.Tags != null && x.Tags.Contains("ID=" + n.ID)
+                        select (Database.Schedule)x).FirstOrDefault()
+                };
+
+            bw.WriteJsonObject(all.ToArray());
+        }
+
+        private void ListTags(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            var r = 
+                from n in 
+                Serializable.ServerSettings.CompressionModules
+                    .Union(Serializable.ServerSettings.EncryptionModules)
+                    .Union(Serializable.ServerSettings.BackendModules)
+                    .Union(Serializable.ServerSettings.GenericModules)
+                    select n.Key.ToLower();
+
+            // Append all known tags
+            r = r.Union(from n in Program.DataConnection.Backups select n.Tags into p from x in p select x.ToLower());
+            bw.WriteJsonObject(r);
+        }
+
+        private void ValidatePath(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            if (input["path"] == null || input["path"].Value == null)
+            {
+                ReportError(response, bw, "The path parameter was not set");
+                return;
+            }
+
+            try
+            {
+                string path = SpecialFolders.ExpandEnvironmentVariables(input["path"].Value);                
+                if (System.IO.Path.IsPathRooted(path) && System.IO.Directory.Exists(path))
+                {
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+                }
+            }
+            catch
+            {
+            }
+
+            ReportError(response, bw, "File or folder not found");
+            return;
+        }
+
+        private bool LongPollCheck(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, BodyWriter bw, EventPollNotify poller, ref long id, out bool isError)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            if (Library.Utility.Utility.ParseBool(input["longpoll"].Value, false))
+            {
+                long lastEventId;
+                if (!long.TryParse(input["lasteventid"].Value, out lastEventId))
+                {
+                    ReportError(response, bw, "When activating long poll, the request must include the last event id");
+                    isError = true;
+                    return false;
+                }
+
+                TimeSpan ts;
+                try { ts = Library.Utility.Timeparser.ParseTimeSpan(input["duration"].Value); }
+                catch (Exception ex)
+                {
+                    ReportError(response, bw, "Invalid duration: " + ex.Message);
+                    isError = true;
+                    return false;
+                }
+
+                if (ts <= TimeSpan.FromSeconds(10) || ts.TotalMilliseconds > int.MaxValue)
+                {
+                    ReportError(response, bw, "Invalid duration, must be at least 10 seconds, and less than " + int.MaxValue + " milliseconds");
+                    isError = true;
+                    return false;
+                }
+
+                isError = false;
+                id = poller.Wait(lastEventId, (int)ts.TotalMilliseconds);
+                return true;
+            }
+
+            isError = false;
+            return false;
+        }
+
+        private void GetProgressState(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            if (Program.GenerateProgressState == null)
+            {
+                ReportError(response, bw, "No active backup");
+            }
+            else
+            {
+                var ev = Program.GenerateProgressState();
+                bw.WriteJsonObject(ev);
+            }
+        }
+
+        private void GetCurrentState (HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            bool isError;
+            long id = 0;
+            if (LongPollCheck(request, response, bw, Program.StatusEventNotifyer, ref id, out isError))
+            {
+                //Make sure we do not report a higher number than the eventnotifyer says
+                var st = new Serializable.ServerStatus();
+                st.LastEventID = id;
+                bw.WriteJsonObject(st);
+            }
+            else if (!isError)
+            {
+                bw.WriteJsonObject(new Serializable.ServerStatus());
+            }
+        }
+
+        private void ListCoreOptions(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            bw.WriteJsonObject(new Duplicati.Library.Main.Options(new Dictionary<string, string>()).SupportedCommands);
+        }
+
+        private void ListApplicationSettings(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            bw.WriteJsonObject(Program.DataConnection.ApplicationSettings);
+        }
+
+        private static void MergeJsonObjects(Newtonsoft.Json.Linq.JObject self, Newtonsoft.Json.Linq.JObject other)
+        {
+            foreach(var p in other.Properties())
+            {
+                var sp = self.Property(p.Name);
+                if (sp == null)
+                    self.Add(p);
+                else
+                {
+                    switch (p.Type)
+                    {
+                        // Primitives override
+                        case Newtonsoft.Json.Linq.JTokenType.Boolean:
+                        case Newtonsoft.Json.Linq.JTokenType.Bytes:
+                        case Newtonsoft.Json.Linq.JTokenType.Comment:
+                        case Newtonsoft.Json.Linq.JTokenType.Constructor:
+                        case Newtonsoft.Json.Linq.JTokenType.Date:
+                        case Newtonsoft.Json.Linq.JTokenType.Float:
+                        case Newtonsoft.Json.Linq.JTokenType.Guid:
+                        case Newtonsoft.Json.Linq.JTokenType.Integer:
+                        case Newtonsoft.Json.Linq.JTokenType.String:
+                        case Newtonsoft.Json.Linq.JTokenType.TimeSpan:
+                        case Newtonsoft.Json.Linq.JTokenType.Uri:
+                        case Newtonsoft.Json.Linq.JTokenType.None:
+                        case Newtonsoft.Json.Linq.JTokenType.Null:
+                        case Newtonsoft.Json.Linq.JTokenType.Undefined:
+                            self.Replace(p);
+                            break;
+
+                            // Arrays merge
+                        case Newtonsoft.Json.Linq.JTokenType.Array:
+                            if (sp.Type == Newtonsoft.Json.Linq.JTokenType.Array)
+                                sp.Value = new Newtonsoft.Json.Linq.JArray(((Newtonsoft.Json.Linq.JArray)sp.Value).Union((Newtonsoft.Json.Linq.JArray)p.Value));
+                            else
+                            {
+                                var a = new Newtonsoft.Json.Linq.JArray(sp.Value);
+                                sp.Value = new Newtonsoft.Json.Linq.JArray(a.Union((Newtonsoft.Json.Linq.JArray)p.Value));
+                            }
+
+                            break;
+
+                            // Objects merge
+                        case Newtonsoft.Json.Linq.JTokenType.Object:
+                            if (sp.Type == Newtonsoft.Json.Linq.JTokenType.Object)
+                                MergeJsonObjects((Newtonsoft.Json.Linq.JObject)sp.Value, (Newtonsoft.Json.Linq.JObject)p.Value);
+                            else
+                                sp.Value = p.Value;
+                            break;
+
+                            // Ignore other stuff                                
+                        default:
+                            break;
+                    }
+                }
+            }
+        }
+
+        private void GetBackupDefaults(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {   
+            // Start with a scratch object
+            var o = new Newtonsoft.Json.Linq.JObject();
+
+            // Add application wide settings
+            o.Add("ApplicationOptions", new Newtonsoft.Json.Linq.JArray(Program.DataConnection.Settings));
+
+            try
+            {
+                // Add built-in defaults
+                Newtonsoft.Json.Linq.JObject n;
+                using(var s = new System.IO.StreamReader(System.Reflection.Assembly.GetExecutingAssembly().GetManifestResourceStream(System.Reflection.Assembly.GetExecutingAssembly().GetName().Name + ".newbackup.json")))
+                    n = (Newtonsoft.Json.Linq.JObject)Newtonsoft.Json.JsonConvert.DeserializeObject(s.ReadToEnd());
+
+                MergeJsonObjects(o, n);
+            }
+            catch
+            {
+            }
+
+            try
+            {
+                // Add install defaults/overrides, if present
+                var path = System.IO.Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "newbackup.json");
+                if (System.IO.File.Exists(path))
+                {
+                    Newtonsoft.Json.Linq.JObject n;
+                    n = (Newtonsoft.Json.Linq.JObject)Newtonsoft.Json.JsonConvert.DeserializeObject(System.IO.File.ReadAllText(path));
+
+                    MergeJsonObjects(o, n);
+                }
+            }
+            catch
+            {
+            }
+
+            bw.WriteJsonObject(new
+            {
+                success = true,
+                data = o
+            });
+        }
+
+        private void SendCommand(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+
+            string command = input["command"].Value ?? "";
+
+            switch (command.ToLowerInvariant())
+            {
+                case "pause":
+                    if (input.Contains("duration") && !string.IsNullOrWhiteSpace(input["duration"].Value))
+                    {
+                        TimeSpan ts;
+                        try
+                        {
+                            ts = Library.Utility.Timeparser.ParseTimeSpan(input["duration"].Value);
+                        }
+                        catch (Exception ex)
+                        {
+                            ReportError(response, bw, ex.Message);
+                            return;
+                        }
+                        if (ts.TotalMilliseconds > 0)
+                            Program.LiveControl.Pause(ts);
+                        else
+                            Program.LiveControl.Pause();
+                    }
+                    else
+                    {
+                        Program.LiveControl.Pause();
+                    }
+
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+                case "resume":
+                    Program.LiveControl.Resume();
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+
+                case "stop":
+                case "abort":
+                    {
+                        var task = Program.WorkThread.CurrentTask;
+                        var tasks = Program.WorkThread.CurrentTasks;
+                        long taskid;
+                        if (!input.Contains("taskid") || !long.TryParse(input["taskid"].Value ?? "", out taskid))
+                        {
+                            ReportError(response, bw, "Invalid or missing taskid");
+                            return;
+                        }
+
+                        if (task != null)
+                            tasks.Insert(0, task);
+
+                        task = tasks.Where(x => x.TaskID == taskid).FirstOrDefault();
+                        if (task == null)
+                        {
+                            ReportError(response, bw, "No such task");
+                            return;
+                        }
+
+                        if (string.Equals(command, "abort", StringComparison.InvariantCultureIgnoreCase))
+                            task.Abort();
+                        else
+                            task.Stop();
+
+                        bw.WriteJsonObject(new { Status = "OK" });
+                        return;
+                    }
+
+                case "is-backup-active":
+                    {
+                        var backup = Program.DataConnection.GetBackup(input["id"].Value);
+                        if (backup == null)
+                        {
+                            ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
+                            return;
+                        }
+
+                        var t = Program.WorkThread.CurrentTask;
+                        var bt = t == null ? null : t.Backup;
+                        if (bt != null && backup.ID == bt.ID)
+                        {
+                            bw.WriteJsonObject(new { Status = "OK", Active = true });
+                            return;
+                        }
+                        else if (Program.WorkThread.CurrentTasks.Where(x =>
+                        { 
+                            var bn = x == null ? null : x.Backup;
+                            return bn == null || bn.ID == backup.ID;
+                        }).Any())
+                        {
+                            bw.WriteJsonObject(new { Status = "OK", Active = true });
+                            return;
+                        }
+                        else
+                        {
+                            bw.WriteJsonObject(new { Status = "OK", Active = false });
+                            return;
+                        }
+                    }
+
+                case "run":
+                case "run-backup":
+                    {
+
+                        var backup = Program.DataConnection.GetBackup(input["id"].Value);
+                        if (backup == null)
+                        {
+                            ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
+                            return;
+                        }
+
+                        var t = Program.WorkThread.CurrentTask;
+                        var bt = t == null ? null : t.Backup;
+                        if (bt != null && backup.ID == bt.ID)
+                        {
+                            // Already running
+                        }
+                        else if (Program.WorkThread.CurrentTasks.Where(x => { 
+                            var bn = x == null ? null : x.Backup;
+                            return bn == null || bn.ID == backup.ID;
+                        }).Any())
+                        {
+                            // Already in queue
+                        }
+                        else
+                        {
+                            Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.Backup, backup));
+                            Program.StatusEventNotifyer.SignalNewEvent();
+                        }
+                    }
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+
+                case "run-verify":
+                    {
+                        var backup = Program.DataConnection.GetBackup(input["id"].Value);
+                        if (backup == null)
+                        {
+                            ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
+                            return;
+                        }
+
+                        Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.Verify, backup));
+                        Program.StatusEventNotifyer.SignalNewEvent();
+                    }
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+
+                case "run-repair":
+                    {
+                        var backup = Program.DataConnection.GetBackup(input["id"].Value);
+                        if (backup == null)
+                        {
+                            ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
+                            return;
+                        }
+
+                        Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.Repair, backup));
+                        Program.StatusEventNotifyer.SignalNewEvent();
+                    }
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+                case "create-report":
+                    {
+                        var backup = Program.DataConnection.GetBackup(input["id"].Value);
+                        if (backup == null)
+                        {
+                            ReportError(response, bw, string.Format("No backup found for id: {0}", input["id"].Value));
+                            return;
+                        }
+
+                        Program.WorkThread.AddTask(Runner.CreateTask(DuplicatiOperation.CreateReport, backup));
+                        Program.StatusEventNotifyer.SignalNewEvent();
+                    }
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+
+                case "clear-warning":
+                    Program.HasWarning = false;
+                    Program.StatusEventNotifyer.SignalNewEvent();
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+                case "clear-error":
+                    Program.HasError = false;
+                    Program.StatusEventNotifyer.SignalNewEvent();
+                    bw.WriteJsonObject(new { Status = "OK" });
+                    return;
+
+                default:
+
+                    var m = Duplicati.Library.DynamicLoader.WebLoader.Modules.Where(x => x.Key.Equals(command, StringComparison.InvariantCultureIgnoreCase)).FirstOrDefault();
+                    if (m == null)
+                    {
+                        ReportError(response, bw, string.Format("Unsupported command {0}", command));
+                        return;
+                    }
+
+                    bw.WriteJsonObject(new { 
+                        Status = "OK", 
+                        Result = m.Execute(input.Where(x => 
+                            !x.Name.Equals("command", StringComparison.InvariantCultureIgnoreCase)
+                            &&
+                            !x.Name.Equals("action", StringComparison.InvariantCultureIgnoreCase)
+                        ).ToDictionary(x => x.Name, x => x.Value))
+                    });
+                    return;
+            }
+        }
+
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/AddOrUpdateBackup.cs b/Duplicati/Server/WebServer/ControlMethods/AddOrUpdateBackup.cs
new file mode 100644
index 000000000..35d683e60
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/AddOrUpdateBackup.cs
@@ -0,0 +1,155 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Linq;
+using Duplicati.Server.Serialization;
+using System.IO;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private class AddOrUpdateBackupData
+        {
+            public Database.Schedule Schedule {get; set;}
+            public Database.Backup Backup {get; set;}
+        }
+
+        private void UpdateBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            string str = request.Form["data"].Value;
+            if (string.IsNullOrWhiteSpace(str))
+            {
+                ReportError(response, bw, "Missing backup object");
+                return;
+            }
+
+            AddOrUpdateBackupData data = null;
+            try
+            {
+                data = Serializer.Deserialize<AddOrUpdateBackupData>(new StringReader(str));
+                if (data.Backup == null)
+                {
+                    ReportError(response, bw, "Data object had no backup entry");
+                    return;
+                }
+
+                if (data.Backup.ID == null)
+                {
+                    ReportError(response, bw, "Invalid or missing backup id");
+                    return;
+                }                    
+
+                if (data.Backup.IsTemporary)
+                {
+                    var backup = Program.DataConnection.GetBackup(data.Backup.ID);
+                    if (backup.IsTemporary)
+                        throw new InvalidDataException("External is temporary but internal is not?");
+
+                    Program.DataConnection.UpdateTemporaryBackup(backup);
+                    bw.WriteJsonObject(new { status = "OK" });
+                }
+                else
+                {                    
+                    lock(Program.DataConnection.m_lock)
+                    {
+                        var backup = Program.DataConnection.GetBackup(data.Backup.ID);
+                        if (backup == null)
+                        {
+                            ReportError(response, bw, "Invalid or missing backup id");
+                            return;
+                        }
+
+                        if (Program.DataConnection.Backups.Where(x => x.Name.Equals(data.Backup.Name, StringComparison.InvariantCultureIgnoreCase) && x.ID != data.Backup.ID).Any())
+                        {
+                            ReportError(response, bw, "There already exists a backup with the name: " + data.Backup.Name);
+                            return;
+                        }
+
+                        //TODO: Merge in real passwords where the placeholder is found
+                        Program.DataConnection.AddOrUpdateBackupAndSchedule(data.Backup, data.Schedule);
+
+                    }
+
+                    bw.WriteJsonObject(new { status = "OK" });
+                }
+            }
+            catch (Exception ex)
+            {
+                if (data == null)
+                    ReportError(response, bw, string.Format("Unable to parse backup or schedule object: {0}", ex.Message));
+                else
+                    ReportError(response, bw, string.Format("Unable to save backup or schedule: {0}", ex.Message));
+
+            }
+        }
+
+        private void AddBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            var str = request.Form["data"].Value;
+            if (string.IsNullOrWhiteSpace(str))
+            {
+                ReportError(response, bw, "Missing backup object");
+                return;
+            }
+
+            AddOrUpdateBackupData data = null;
+            try
+            {
+                data = Serializer.Deserialize<AddOrUpdateBackupData>(new StringReader(str));
+                if (data.Backup == null)
+                {
+                    ReportError(response, bw, "Data object had no backup entry");
+                    return;
+                }
+
+                data.Backup.ID = null;
+
+                if (Duplicati.Library.Utility.Utility.ParseBool(request.Form["temporary"].Value, false))
+                {
+                    Program.DataConnection.RegisterTemporaryBackup(data.Backup);
+
+                    bw.WriteJsonObject(new { status = "OK", ID = data.Backup.ID });
+                }
+                else
+                {
+                    lock(Program.DataConnection.m_lock)
+                    {
+                        if (Program.DataConnection.Backups.Where(x => x.Name.Equals(data.Backup.Name, StringComparison.InvariantCultureIgnoreCase)).Any())
+                        {
+                            ReportError(response, bw, "There already exists a backup with the name: " + data.Backup.Name);
+                            return;
+                        }
+
+                        Program.DataConnection.AddOrUpdateBackupAndSchedule(data.Backup, data.Schedule);
+                    }
+
+                    bw.WriteJsonObject(new { status = "OK", ID = data.Backup.ID });
+                }
+            }
+            catch (Exception ex)
+            {
+                if (data == null)
+                    ReportError(response, bw, string.Format("Unable to parse backup or schedule object: {0}", ex.Message));
+                else
+                    ReportError(response, bw, string.Format("Unable to save schedule or backup object: {0}", ex.Message));
+            }
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/DeleteBackup.cs b/Duplicati/Server/WebServer/ControlMethods/DeleteBackup.cs
new file mode 100644
index 000000000..d405304b9
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/DeleteBackup.cs
@@ -0,0 +1,106 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private void DeleteBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            var backup = Program.DataConnection.GetBackup(input["id"].Value);
+            if (backup == null)
+            {
+                ReportError(response, bw, "Invalid or missing backup id");
+                return;
+            }
+
+            if (Program.WorkThread.Active)
+            {
+                try
+                {
+                    //TODO: It's not safe to access the values like this, 
+                    //because the runner thread might interfere
+                    var nt = Program.WorkThread.CurrentTask;
+                    if (backup.Equals(nt == null ? null : nt.Backup))
+                    {
+                        bool force;
+                        if (!bool.TryParse(input["force"].Value, out force))
+                            force = false;
+
+                        if (!force)
+                        {
+                            bw.WriteJsonObject(new { status = "failed", reason = "backup-in-progress" });
+                            return;
+                        }
+
+                        bool hasPaused = Program.LiveControl.State == LiveControls.LiveControlState.Paused;
+                        Program.LiveControl.Pause();
+
+                        try
+                        {
+                            for (int i = 0; i < 10; i++)
+                                if (Program.WorkThread.Active)
+                                {
+                                    var t = Program.WorkThread.CurrentTask;
+                                    if (backup.Equals(t == null ? null : t.Backup))
+                                        System.Threading.Thread.Sleep(1000);
+                                    else
+                                        break;
+                                }
+                                else
+                                    break;
+                        }
+                        finally
+                        {
+                        }
+
+                        if (Program.WorkThread.Active)
+                        {
+                            var t = Program.WorkThread.CurrentTask;
+                            if (backup.Equals(t == null ? null : t.Backup))
+                            {
+                                if (hasPaused)
+                                    Program.LiveControl.Resume();
+                                bw.WriteJsonObject(new { status = "failed", reason = "backup-unstoppable" });
+                                return;
+                            }
+                        }
+
+                        if (hasPaused)
+                            Program.LiveControl.Resume();
+                    }
+                }
+                catch (Exception ex)
+                {
+                    bw.WriteJsonObject(new { status = "error", message = ex.Message });
+                    return;
+                }
+            }
+
+            Program.DataConnection.DeleteBackup(backup);
+
+            //We have fiddled with the schedules
+            Program.Scheduler.Reschedule();
+
+            bw.WriteJsonObject(new { status = "OK" });
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/GetBackup.cs b/Duplicati/Server/WebServer/ControlMethods/GetBackup.cs
new file mode 100644
index 000000000..ba5ae727c
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/GetBackup.cs
@@ -0,0 +1,78 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Linq;
+using System.Collections.Generic;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private void GetBackup(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            var bk = Program.DataConnection.GetBackup(input["id"].Value);
+            if (bk == null)
+                ReportError(response, bw, "Invalid or missing backup id");
+            else
+            {
+                var systemIO = Library.Utility.Utility.IsClientLinux
+                    ? (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOLinux()
+                    : (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOWindows();
+
+                var scheduleId = Program.DataConnection.GetScheduleIDsFromTags(new string[] { "ID=" + bk.ID });
+                var schedule = scheduleId.Any() ? Program.DataConnection.GetSchedule(scheduleId.First()) : null;
+                var sourcenames = bk.Sources.Distinct().Select(x => {
+                    var sp = SpecialFolders.TranslateToDisplayString(x);
+                    if (sp != null)
+                        return new KeyValuePair<string, string>(x, sp);
+
+                    x = SpecialFolders.ExpandEnvironmentVariables(x);
+                    try {
+                        var nx = x;
+                        if (nx.EndsWith(System.IO.Path.DirectorySeparatorChar.ToString()))
+                            nx = nx.Substring(0, nx.Length - 1);
+                        var n = systemIO.PathGetFileName(nx);
+                        if (!string.IsNullOrWhiteSpace(n))
+                            return new KeyValuePair<string, string>(x, n);
+                    } catch {
+                    }
+
+                    if (x.EndsWith(System.IO.Path.DirectorySeparatorChar.ToString()) && x.Length > 1)
+                        return new KeyValuePair<string, string>(x, x.Substring(0, x.Length - 1).Substring(x.Substring(0, x.Length - 1).LastIndexOf("/") + 1));
+                    else
+                        return new KeyValuePair<string, string>(x, x);
+
+                }).ToDictionary(x => x.Key, x => x.Value);
+
+                //TODO: Filter out the password in both settings and the target url
+
+                bw.WriteJsonObject(new
+                {
+                    success = true,
+                    data = new {
+                        Schedule = schedule,
+                        Backup = bk,
+                        DisplayNames = sourcenames
+                    }
+                });
+            }
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/GetFolderContents.cs b/Duplicati/Server/WebServer/ControlMethods/GetFolderContents.cs
new file mode 100644
index 000000000..a771e139b
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/GetFolderContents.cs
@@ -0,0 +1,116 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Linq;
+using System.Collections.Generic;
+using System.IO;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private void GetFolderContents(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            if (input["path"] == null || input["path"].Value == null)
+            {
+                ReportError(response, bw, "The path parameter was not set");
+                return;
+            }
+
+            bool skipFiles = Library.Utility.Utility.ParseBool(input["onlyfolders"].Value, false);
+
+            var path = input["path"].Value;
+            string specialpath = null;
+            string specialtoken = null;
+
+            if (path.StartsWith("%"))
+            {
+                var ix = path.IndexOf("%", 1);
+                if (ix > 0)
+                {
+                    var tk = path.Substring(0, ix + 1);
+                    var node = SpecialFolders.Nodes.Where(x => x.id.Equals(tk, StringComparison.InvariantCultureIgnoreCase)).FirstOrDefault();
+                    if (node != null)
+                    {
+                        specialpath = node.resolvedpath;
+                        specialtoken = node.id;
+                    }
+                }
+            }
+
+            path = SpecialFolders.ExpandEnvironmentVariables(path);
+
+            if (Duplicati.Library.Utility.Utility.IsClientLinux && !path.StartsWith("/"))
+            {
+                ReportError(response, bw, "The path parameter must start with a forward-slash");
+                return;
+            }
+
+            try
+            {
+                if (path != "" && path != "/")
+                    path = Duplicati.Library.Utility.Utility.AppendDirSeparator(path);
+
+                IEnumerable<Serializable.TreeNode> res;
+
+                if (!Library.Utility.Utility.IsClientLinux && (path.Equals("/") || path.Equals("")))
+                {
+                    res = 
+                        from di in System.IO.DriveInfo.GetDrives()
+                            where di.DriveType == DriveType.Fixed || di.DriveType == DriveType.Network || di.DriveType == DriveType.Removable
+                        select new Serializable.TreeNode()
+                    {
+                        id = di.RootDirectory.FullName,
+                        text = di.RootDirectory.FullName.Replace('\\', ' ') + "(" + di.DriveType + ")",
+                        iconCls = "x-tree-icon-drive"
+                    };
+                }
+                else
+                {
+                    res = ListFolderAsNodes(path, skipFiles);                        
+                }
+
+                if ((path.Equals("/") || path.Equals("")) && specialtoken == null) 
+                {
+                    // Prepend special folders
+                    res = SpecialFolders.Nodes.Union(res);
+                }
+
+                if (specialtoken != null)
+                {
+                    res = from n in res
+                        select new Serializable.TreeNode() {
+                        id = specialtoken + n.id.Substring(specialpath.Length),
+                        text = n.text,
+                        iconCls = n.iconCls,
+                        leaf = n.leaf,
+                        resolvedpath = n.id
+                    };
+                }
+
+                bw.WriteJsonObject(res);
+            }
+            catch (Exception ex)
+            {
+                ReportError(response, bw, "Failed to process the path: " + ex.Message);
+            }
+        }       
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/ListFolderAsNodes.cs b/Duplicati/Server/WebServer/ControlMethods/ListFolderAsNodes.cs
new file mode 100644
index 000000000..b41d574cc
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/ListFolderAsNodes.cs
@@ -0,0 +1,86 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Linq;
+using System.Collections.Generic;
+using System.IO;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private static IEnumerable<Serializable.TreeNode> ListFolderAsNodes(string entrypath, bool skipFiles)
+        {
+            //Helper function for finding out if a folder has sub elements
+            Func<string, bool> hasSubElements = (p) => skipFiles ? Directory.EnumerateDirectories(p).Any() : Directory.EnumerateFileSystemEntries(p).Any();
+
+            //Helper function for dealing with exceptions when accessing off-limits folders
+            Func<string, bool> isEmptyFolder = (p) =>
+            {
+                try { return !hasSubElements(p); }
+                catch { }
+                return true;
+            };
+
+            //Helper function for dealing with exceptions when accessing off-limits folders
+            Func<string, bool> canAccess = (p) =>
+            {
+                try { hasSubElements(p); return true; }
+                catch { }
+                return false;
+            }; 
+
+            var systemIO = Library.Utility.Utility.IsClientLinux
+                ? (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOLinux() 
+                : (Duplicati.Library.Snapshots.ISystemIO)new Duplicati.Library.Snapshots.SystemIOWindows();
+
+            foreach (var s in System.IO.Directory.EnumerateFileSystemEntries(entrypath))
+            {
+                Serializable.TreeNode tn = null;
+                try
+                {
+                    var attr = systemIO.GetFileAttributes(s);
+                    //var isSymlink = (attr & FileAttributes.ReparsePoint) != 0;
+                    var isFolder = (attr & FileAttributes.Directory) != 0;
+                    var isFile = !isFolder;
+                    //var isHidden = (attr & FileAttributes.Hidden) != 0;
+
+                    var accesible = isFile || canAccess(s);
+                    var isLeaf = isFile || !accesible || isEmptyFolder(s);
+
+                    var rawid = isFolder ? Library.Utility.Utility.AppendDirSeparator(s) : s;
+                    if (!skipFiles || isFolder)
+                        tn = new Serializable.TreeNode()
+                    {
+                        id = rawid,
+                        text = systemIO.PathGetFileName(s),
+                        iconCls = isFolder ? (accesible ? "x-tree-icon-parent" : "x-tree-icon-locked") : "x-tree-icon-leaf",
+                        leaf = isLeaf
+                    };
+                }
+                catch
+                {
+                }
+
+                if (tn != null)
+                    yield return tn;
+            }
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/ReadLogData.cs b/Duplicati/Server/WebServer/ControlMethods/ReadLogData.cs
new file mode 100644
index 000000000..a9d9af1da
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/ReadLogData.cs
@@ -0,0 +1,78 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Collections.Generic;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private void ReadLogData(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+            var backupid = input["id"].Value;
+
+            if (string.IsNullOrWhiteSpace(backupid))
+            {
+                List<Dictionary<string, object>> res = null;
+                Program.DataConnection.ExecuteWithCommand(x =>
+                {
+                    res = DumpTable(x, "ErrorLog", "Timestamp", input["offset"].Value, input["pagesize"].Value);
+                });
+
+                bw.WriteJsonObject(res);
+            }
+            else
+            {
+                var backup = Program.DataConnection.GetBackup(backupid);
+                if (backup == null)
+                {
+                    ReportError(response, bw, "Invalid or missing backup id");
+                    return;
+                }
+
+                using(var con = (System.Data.IDbConnection)Activator.CreateInstance(Duplicati.Library.SQLiteHelper.SQLiteLoader.SQLiteConnectionType))
+                {
+                    con.ConnectionString = "Data Source=" + backup.DBPath;
+                    con.Open();
+
+                    using(var cmd = con.CreateCommand())
+                    {
+                        if (Duplicati.Library.Utility.Utility.ParseBool(input["remotelog"].Value, false))
+                        {
+                            var dt = DumpTable(cmd, "RemoteOperation", "ID", input["offset"].Value, input["pagesize"].Value);
+
+                            // Unwrap raw data to a string
+                            foreach(var n in dt)
+                                try { n["Data"] = System.Text.Encoding.UTF8.GetString((byte[])n["Data"]); }
+                            catch { }
+
+                            bw.WriteJsonObject(dt);
+                        }
+                        else
+                        {
+                            var dt = DumpTable(cmd, "LogData", "ID", input["offset"].Value, input["pagesize"].Value);
+                            bw.WriteJsonObject(dt);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/ControlMethods/SearchBackupFiles.cs b/Duplicati/Server/WebServer/ControlMethods/SearchBackupFiles.cs
new file mode 100644
index 000000000..797a09169
--- /dev/null
+++ b/Duplicati/Server/WebServer/ControlMethods/SearchBackupFiles.cs
@@ -0,0 +1,65 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using System.Collections.Generic;
+
+namespace Duplicati.Server.WebServer
+{
+    partial class ControlHandler
+    {
+        private void SearchBackupFiles(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session, BodyWriter bw)
+        {
+            HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
+
+            var filter = (input["filter"].Value ?? "").Split(new string[] { System.IO.Path.PathSeparator.ToString() }, StringSplitOptions.RemoveEmptyEntries);
+            var timestring = input["time"].Value;
+            var allversion = Duplicati.Library.Utility.Utility.ParseBool(input["all-versions"].Value, false);
+
+            if (string.IsNullOrWhiteSpace(timestring) && !allversion)
+            {
+                ReportError(response, bw, "Invalid or missing time");
+                return;
+            }
+            var bk = Program.DataConnection.GetBackup(input["id"].Value);
+            if (bk == null)
+            {
+                ReportError(response, bw, "Invalid or missing backup id");
+                return;
+            }
+
+            var prefixonly = Duplicati.Library.Utility.Utility.ParseBool(input["prefix-only"].Value, false);
+            var foldercontents = Duplicati.Library.Utility.Utility.ParseBool(input["folder-contents"].Value, false);
+            var time = new DateTime();
+            if (!allversion)
+                time = Duplicati.Library.Utility.Timeparser.ParseTimeInterval(timestring, DateTime.Now);
+
+            var r = Runner.Run(Runner.CreateListTask(bk, filter, prefixonly, allversion, foldercontents, time), false) as Duplicati.Library.Interface.IListResults;
+
+            var result = new Dictionary<string, object>();
+
+            foreach(HttpServer.HttpInputItem n in input)
+                result[n.Name] = n.Value;
+
+            result["Filesets"] = r.Filesets;
+            result["Files"] = r.Files;
+
+            bw.WriteJsonObject(result);
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/IndexHtmlHandler.cs b/Duplicati/Server/WebServer/IndexHtmlHandler.cs
new file mode 100644
index 000000000..d1481f9c6
--- /dev/null
+++ b/Duplicati/Server/WebServer/IndexHtmlHandler.cs
@@ -0,0 +1,52 @@
+//  Copyright (C) 2014, Kenneth Skovhede
+
+//  http://www.hexad.dk, opensource@hexad.dk
+//
+//  This library is free software; you can redistribute it and/or modify
+//  it under the terms of the GNU Lesser General Public License as
+//  published by the Free Software Foundation; either version 2.1 of the
+//  License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful, but
+//  WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+using System;
+using HttpServer;
+using HttpServer.HttpModules;
+
+namespace Duplicati.Server.WebServer
+{
+    internal class IndexHtmlHandler : HttpModule
+    {
+        private string m_defaultdoc;
+
+        public IndexHtmlHandler(string defaultdoc) { m_defaultdoc = defaultdoc; }
+
+        public override bool Process(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
+        {
+            if ((request.Uri.AbsolutePath == "/" || request.Uri.AbsolutePath == "/index.html" || request.Uri.AbsolutePath == "/index.htm") && System.IO.File.Exists(m_defaultdoc))
+            {
+                response.Status = System.Net.HttpStatusCode.OK;
+                response.Reason = "OK";
+                response.ContentType = "text/html";
+
+                using (var fs = System.IO.File.OpenRead(m_defaultdoc))
+                {
+                    response.ContentLength = fs.Length;
+                    response.Body = fs;
+                    response.Send();
+                }
+
+                return true;
+            }
+
+            return false;
+        }
+    }
+}
+
diff --git a/Duplicati/Server/WebServer/Server.cs b/Duplicati/Server/WebServer/Server.cs
new file mode 100644
index 000000000..a000b82df
--- /dev/null
+++ b/Duplicati/Server/WebServer/Server.cs
@@ -0,0 +1,194 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using HttpServer.HttpModules;
+using System.IO;
+using Duplicati.Server.Serialization;
+
+namespace Duplicati.Server.WebServer
+{
+    public class Server
+    {
+        /// <summary>
+        /// Option for changing the webroot folder
+        /// </summary>
+        public const string OPTION_WEBROOT = "webservice-webroot";
+        /// <summary>
+        /// Option for changing the webservice listen port
+        /// </summary>
+        public const string OPTION_PORT = "webservice-port";
+        /// <summary>
+        /// Option for changing the webservice listen interface
+        /// </summary>
+        public const string OPTION_INTERFACE = "webservice-interface";
+
+        /// <summary>
+        /// The default path to the web root
+        /// </summary>
+        public const string DEFAULT_OPTION_WEBROOT = "webroot";
+
+        /// <summary>
+        /// The default listening port
+        /// </summary>
+        public const int DEFAULT_OPTION_PORT = 8200;
+
+        /// <summary>
+        /// The default listening interface
+        /// </summary>
+        public const string DEFAULT_OPTION_INTERFACE = "loopback";
+
+        /// <summary>
+        /// The single webserver instance
+        /// </summary>
+        private HttpServer.HttpServer m_server;
+        
+        /// <summary>
+        /// The webserver listening port
+        /// </summary>
+        public readonly int Port;
+        
+        /// <summary>
+        /// A string that is sent out instead of password values
+        /// </summary>
+        public const string PASSWORD_PLACEHOLDER = "**********";
+
+        /// <summary>
+        /// Sets up the webserver and starts it
+        /// </summary>
+        /// <param name="options">A set of options</param>
+        public Server(IDictionary<string, string> options)
+        {
+            int port;
+            string portstring;
+            IEnumerable<int> ports = null;
+            options.TryGetValue(OPTION_PORT, out portstring);
+            if (!string.IsNullOrEmpty(portstring))
+                ports = 
+                    from n in portstring.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries)
+                                where int.TryParse(n, out port)
+                                select int.Parse(n);
+
+            if (ports == null || !ports.Any())
+                ports = new int[] { DEFAULT_OPTION_PORT };
+
+            string interfacestring;
+            System.Net.IPAddress listenInterface;
+            options.TryGetValue(OPTION_INTERFACE, out interfacestring);
+            if (string.IsNullOrWhiteSpace(interfacestring))
+                interfacestring = DEFAULT_OPTION_INTERFACE;
+            
+            if (interfacestring.Trim() == "*" || interfacestring.Trim().Equals("any", StringComparison.InvariantCultureIgnoreCase))
+                listenInterface = System.Net.IPAddress.Any;
+            else if (interfacestring.Trim() == "loopback")
+                listenInterface = System.Net.IPAddress.Loopback;
+            else
+                listenInterface = System.Net.IPAddress.Parse(interfacestring);
+
+
+            // If we are in hosted mode with no specified port, 
+            // then try different ports
+            foreach(var p in ports)
+                try
+                {
+                    // Due to the way the server is initialized, 
+                    // we cannot try to start it again on another port, 
+                    // so we create a new server for each attempt
+                
+                    var server = CreateServer(options);
+                    //TODO: Add promiscuous mode and default to loopback only
+                    server.Start(listenInterface, p);
+                    m_server = server;
+                    m_server.ServerName = "Duplicati v" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString();
+                    this.Port = p;
+                    return;
+                }
+                catch (System.Net.Sockets.SocketException)
+                {
+                }
+                
+            throw new Exception("Unable to open a socket for listening, tried ports: " + string.Join(",", from n in ports select n.ToString()));
+        }
+        
+        private static HttpServer.HttpServer CreateServer(IDictionary<string, string> options)
+        {
+            HttpServer.HttpServer server = new HttpServer.HttpServer();
+
+            server.Add(new AuthenticationHandler());
+
+            server.Add(new ControlHandler());
+
+            string webroot = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
+#if DEBUG
+            //For debug we go "../../../.." to get out of "GUI/Duplicati.GUI.TrayIcon/bin/debug"
+            string tmpwebroot = System.IO.Path.GetFullPath(System.IO.Path.Combine(webroot, "..", "..", "..", ".."));
+            tmpwebroot = System.IO.Path.Combine(tmpwebroot, "Server");
+            if (System.IO.Directory.Exists(System.IO.Path.Combine(tmpwebroot, "webroot")))
+                webroot = tmpwebroot;
+            else
+            {
+                //If we are running the server standalone, we only need to exit "bin/Debug"
+                tmpwebroot = System.IO.Path.GetFullPath(System.IO.Path.Combine(webroot, "..", ".."));
+                if (System.IO.Directory.Exists(System.IO.Path.Combine(tmpwebroot, "webroot")))
+                    webroot = tmpwebroot;
+            }
+
+            if (Library.Utility.Utility.IsClientOSX)
+            {
+                string osxTmpWebRoot = System.IO.Path.GetFullPath(System.IO.Path.Combine(webroot, "..", "..", "..", "..", "..", "..", ".."));
+                osxTmpWebRoot = System.IO.Path.Combine(osxTmpWebRoot, "Server");
+                if (System.IO.Directory.Exists(System.IO.Path.Combine(osxTmpWebRoot, "webroot")))
+                    webroot = osxTmpWebRoot;
+            }
+#endif
+
+            webroot = System.IO.Path.Combine(webroot, "webroot");
+
+            if (options.ContainsKey(OPTION_WEBROOT))
+            {
+                string userroot = options[OPTION_WEBROOT];
+#if DEBUG
+                //In debug mode we do not care where the path points
+#else
+                //In release mode we check that the user supplied path is located
+                // in the same folders as the running application, to avoid users
+                // that inadvertently expose top level folders
+                if (!string.IsNullOrWhiteSpace(userroot)
+                    &&
+                    (
+                        userroot.StartsWith(Library.Utility.Utility.AppendDirSeparator(System.Reflection.Assembly.GetExecutingAssembly().Location), Library.Utility.Utility.ClientFilenameStringComparision)
+                        ||
+                        userroot.StartsWith(Library.Utility.Utility.AppendDirSeparator(Program.StartupPath), Library.Utility.Utility.ClientFilenameStringComparision)
+                    )
+                )
+#endif
+                {
+                    webroot = userroot;
+                }
+            }
+
+            FileModule fh = new FileModule("/", webroot);
+            fh.AddDefaultMimeTypes();
+            fh.MimeTypes.Add("htc", "text/x-component");
+            fh.MimeTypes.Add("json", "application/json");
+            fh.MimeTypes.Add("map", "application/json");
+            server.Add(fh);
+            server.Add(new IndexHtmlHandler(System.IO.Path.Combine(webroot, "index.html")));
+#if DEBUG
+            //For debugging, it is nice to know when we get a 404
+            server.Add(new DebugReportHandler());
+#endif
+            
+            return server;
+        }
+
+        private class DebugReportHandler : HttpModule
+        {
+            public override bool Process(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
+            {
+                System.Diagnostics.Trace.WriteLine(string.Format("Rejecting request for {0}", request.Uri));
+                return false;
+            }
+        }
+    }
+}