diff --git a/.gitignore b/.gitignore
index 5328952..af6ce43 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,5 @@
 build
 builddir
 fmongoose
-users.db
\ No newline at end of file
+users.db
+*.swp
diff --git a/src/add_user.c b/src/add_user.c
index 9741e2d..b089abd 100644
--- a/src/add_user.c
+++ b/src/add_user.c
@@ -6,7 +6,7 @@ void add_user(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *requestdata = check_body(hm);
   const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
   if (!valid) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
@@ -18,7 +18,7 @@ void add_user(struct mg_connection *c, struct mg_http_message *hm) {
   cJSON *is_superuser = cJSON_GetObjectItem(jsonbody, "is_superuser");
   if (username == nullptr || password == nullptr || email == nullptr ||
       is_superuser == nullptr || group == nullptr) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have <username>, <password>, <email>, <group, "
                          "optional>, <is_superuser, optional>"));
     return;
@@ -27,7 +27,7 @@ void add_user(struct mg_connection *c, struct mg_http_message *hm) {
   bool jwt_is_superuser =
       cJSON_GetObjectItem(payload, "is_superuser")->valueint;
   if (!jwt_is_superuser) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("not authorized"));
     cJSON_Delete(payload);
     return;
@@ -38,7 +38,7 @@ void add_user(struct mg_connection *c, struct mg_http_message *hm) {
       group->valuestring,
       &user_is_superuser);
   if (!new_db_user) {
-    mg_http_reply(c, 500, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 500, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("failed to create user"));
     cJSON_Delete(payload);
     return;
diff --git a/src/change_password.c b/src/change_password.c
index 8e1aa1b..2eb3c8b 100644
--- a/src/change_password.c
+++ b/src/change_password.c
@@ -6,7 +6,7 @@ void change_password(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *requestdata = check_body(hm);
   const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
   if (!valid) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
@@ -14,7 +14,7 @@ void change_password(struct mg_connection *c, struct mg_http_message *hm) {
   cJSON *old_password = cJSON_GetObjectItem(jsonbody, "old_password");
   cJSON *new_password = cJSON_GetObjectItem(jsonbody, "new_password");
   if (old_password == nullptr || new_password == nullptr) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have <old_password>, <new_password>"));
     return;
   }
@@ -24,7 +24,7 @@ void change_password(struct mg_connection *c, struct mg_http_message *hm) {
   char *password = old_user_data->password;
 
   if (strcmp(password, old_password->valuestring)) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid old password"));
     return;
   }
@@ -33,7 +33,7 @@ void change_password(struct mg_connection *c, struct mg_http_message *hm) {
       old_user_data->id, old_user_data->username, old_user_data->email,
       new_password->valuestring, old_user_data->group, &old_is_superuser);
   if (!new_user_data) {
-    mg_http_reply(c, 500, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 500, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("failed to update user"));
     return;
   }
diff --git a/src/change_user.c b/src/change_user.c
index f64f8d9..e9a2574 100644
--- a/src/change_user.c
+++ b/src/change_user.c
@@ -6,7 +6,7 @@ void change_user(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *requestdata = check_body(hm);
   const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
   if (!valid) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
@@ -17,19 +17,19 @@ void change_user(struct mg_connection *c, struct mg_http_message *hm) {
   cJSON *is_superuser = cJSON_GetObjectItem(jsonbody, "is_superuser");
   User *old_user_data = db_get_user_by_username(username->valuestring);
   if (!old_user_data) {
-    mg_http_reply(c, 404, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 404, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("user not found"));
     return;
   }
   char *password = old_user_data->password;
   if (!password) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("password is required"));
     return;
   }
   if (username == nullptr || email == nullptr ||
       is_superuser == nullptr || group == nullptr) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have <username>, <email>, <group, "
                          "optional>, <is_superuser, optional>"));
     free_user(old_user_data);
@@ -44,7 +44,7 @@ void change_user(struct mg_connection *c, struct mg_http_message *hm) {
       group->valuestring, &user_is_superuser);
 
   if (!updated_user_data) {
-    mg_http_reply(c, 500, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 500, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("failed to update user"));
     cJSON_Delete(payload);
     free_user(old_user_data);
@@ -63,5 +63,5 @@ void change_user(struct mg_connection *c, struct mg_http_message *hm) {
   free_user(updated_user_data);
   free_user(old_user_data);
   cJSON_Delete(payload);
-  free(password);
+  //free(password);
 }
diff --git a/src/delete_user.c b/src/delete_user.c
index afd6e8c..9ad4db6 100644
--- a/src/delete_user.c
+++ b/src/delete_user.c
@@ -6,7 +6,7 @@ void delete_user(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *requestdata = check_body(hm);
   const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
   if (!valid) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
diff --git a/src/get_all_users.c b/src/get_all_users.c
index e8e1308..8163d7d 100644
--- a/src/get_all_users.c
+++ b/src/get_all_users.c
@@ -5,18 +5,18 @@
 void get_all_users(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *data = check_body(hm);
   if (data->error != NULL) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"), MG_ESC(data->error));
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"), MG_ESC(data->error));
     return;
   }
   if (!jwt_verifyJWT(data->token, JWT_DEFAULT_SECRET)) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
   cJSON *payload = jwt_get_payload(data->token);
   bool is_superuser = cJSON_GetObjectItem(payload, "is_superuser")->valueint;
   if (!is_superuser) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("user is not superuser"));
     return;
   }
diff --git a/src/get_token.c b/src/get_token.c
index 5522a10..46c4109 100644
--- a/src/get_token.c
+++ b/src/get_token.c
@@ -3,7 +3,7 @@
 
 void get_token(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have username and password"));
     return;
   }
@@ -13,21 +13,21 @@ void get_token(struct mg_connection *c, struct mg_http_message *hm) {
   if (username == NULL || password == NULL) {
     const char *error_ptr = cJSON_GetErrorPtr();
     if (error_ptr != NULL) {
-      mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"), MG_ESC(error_ptr));
+      mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"), MG_ESC(error_ptr));
       return;
     }
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have username and password"));
     return;
   }
   User *db_user = db_get_user_by_username(username->valuestring);
   if (!db_user) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("couldn't find user"));
     return;
   }
   if (strcmp(db_user->password, password->valuestring)) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("wrong password"));
     return;
   }
@@ -41,7 +41,7 @@ void get_token(struct mg_connection *c, struct mg_http_message *hm) {
            db_user->id, db_user->username, db_user->email, db_user->group,
            db_user->is_superuser ? "true" : "false");
   char *token = jwt_createJWT(header, payload, JWT_DEFAULT_SECRET);
-  mg_http_reply(c, 200, "", "{%m:%m}", MG_ESC("token"), MG_ESC(token));
+  mg_http_reply(c, 200, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("token"), MG_ESC(token));
   free_user(db_user);
   free(token);
 }
diff --git a/src/get_user.c b/src/get_user.c
index 0a26199..3449b7e 100644
--- a/src/get_user.c
+++ b/src/get_user.c
@@ -6,7 +6,7 @@ void get_user(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *requestdata = check_body(hm);
   if (!jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET)) {
     free_request_with_token(requestdata);
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
@@ -18,7 +18,7 @@ void get_user(struct mg_connection *c, struct mg_http_message *hm) {
     free_request_with_token(requestdata);
     cJSON_Delete(payload);
     free(username);
-    mg_http_reply(c, 404, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 404, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("user not found"));
     return;
   }
diff --git a/src/main.c b/src/main.c
index 5a21502..99362e7 100644
--- a/src/main.c
+++ b/src/main.c
@@ -15,9 +15,9 @@ static const struct route routes[] = {
     {"POST", "/api/token/verify", verify_token},
     {"POST", "/api/users", get_all_users},
     {"POST", "/api/users/user", get_user},
-    {"POST", "/api/users/delete", delete_user},
+    {"DELETE", "/api/users", delete_user},
     {"POST", "/api/users/password", change_password},
-    {"POST", "/api/users/change", change_user},
+    {"PUT", "/api/users", change_user},
     {"POST", "/api/users/add", add_user},
     {"POST", "/api/register", register_user},
     {nullptr, nullptr, nullptr}};
diff --git a/src/register_user.c b/src/register_user.c
index 0476f3e..426108f 100644
--- a/src/register_user.c
+++ b/src/register_user.c
@@ -2,7 +2,7 @@
 
 void register_user(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have <username>, <password>, <email>, <group, "
                          "optional>, <is_superuser, optional>"));
     return;
@@ -14,7 +14,7 @@ void register_user(struct mg_connection *c, struct mg_http_message *hm) {
   cJSON *group = cJSON_GetObjectItem(jsonbody, "group");
   cJSON *is_superuser = cJSON_GetObjectItem(jsonbody, "is_superuser");
   if (username == nullptr || password == nullptr || email == nullptr) {
-    mg_http_reply(c, 400, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("must have <username>, <password>, <email>, <group, "
                          "optional>, <is_superuser, optional>"));
     return;
@@ -30,7 +30,7 @@ void register_user(struct mg_connection *c, struct mg_http_message *hm) {
       username->valuestring, email->valuestring, password->valuestring,
       group->valuestring, (const bool*)is_superuser_value);
   if (new_user_data == nullptr) {
-    mg_http_reply(c, 500, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 500, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("failed to create user"));
     return;
   }
diff --git a/src/verify_token.c b/src/verify_token.c
index 4c605e6..e9a5014 100644
--- a/src/verify_token.c
+++ b/src/verify_token.c
@@ -5,14 +5,14 @@
 void verify_token(struct mg_connection *c, struct mg_http_message *hm) {
   const request_with_token *data = check_body(hm);
   if (data->error != nullptr) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"), MG_ESC(data->error));
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"), MG_ESC(data->error));
     return;
   }
   const bool valid = jwt_verifyJWT(data->token, JWT_DEFAULT_SECRET);
   if (!valid) {
-    mg_http_reply(c, 403, "", "{%m:%m}", MG_ESC("error"),
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;
   }
-  mg_http_reply(c, 200, "", "{%m:%m}", MG_ESC("valid"), MG_ESC("true"));
+  mg_http_reply(c, 200, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("valid"), MG_ESC("true"));
 }
diff --git a/web/index.html b/web/index.html
index 647e2a1..7c1b18f 100644
--- a/web/index.html
+++ b/web/index.html
@@ -5,7 +5,28 @@
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>fmongoose</title>
     </head>
+    <style>
+        .login-form {
+            display: flex;
+            flex-direction: column;
+            max-width: 200px;
+            align-items: center;
+        }
+    </style>
     <body>
         <h1>it's work</h1>
+        <div class="login-form" style="display:flex;flex-direction:column;max-width:200px;">
+            <h2>Login</h2>
+            <label for="username_input">Username</label>
+            <input type="text" id="username_input">
+            <label for="password_input">Password</label>
+            <input type="password" id="password_input">
+        </div>
+        <script>
+            console.log("hello world");
+            const username_input = document.querySelector("#username_input");
+            const password_input = document.querySelector("#password_input");
+            console.log(username_input, password_input);
+        </script>
     </body>
 </html>