diff --git a/snikket_web/__init__.py b/snikket_web/__init__.py
index 657c690..de4832a 100644
--- a/snikket_web/__init__.py
+++ b/snikket_web/__init__.py
@@ -111,11 +111,11 @@ async def generic_http_error(
     return quart.Response(
         await render_template(
             "generic_http_error.html",
-            status=exc.status_code,
+            status=exc.code,
             description=exc.description,
             name=exc.name,
         ),
-        status=exc.status_code,
+        status=exc.code,
     )
 
 
@@ -196,25 +196,25 @@ def create_app() -> quart.Quart:
     app.context_processor(proc)
     app.register_error_handler(
         aiohttp.ClientConnectorError,
-        backend_error_handler,  # type:ignore
+        backend_error_handler,
     )
     app.register_error_handler(
         werkzeug.exceptions.HTTPException,
-        generic_http_error,  # type:ignore
+        generic_http_error,
     )
     app.register_error_handler(
         Exception,
-        generic_error_handler,  # type:ignore
+        generic_error_handler,
     )
 
-    @app.route("/")
+    @app.route("/")  # type: ignore
     async def index() -> quart.Response:
         if infra.client.has_session:
             return redirect(url_for('user.index'))
 
         return redirect(url_for('main.login'))
 
-    @app.route("/site.webmanifest")
+    @app.route("/site.webmanifest")  # type: ignore
     def site_manifest() -> quart.Response:
         # this is needed for icons
         return jsonify(
diff --git a/snikket_web/admin.py b/snikket_web/admin.py
index fd1bef8..fbe0a1b 100644
--- a/snikket_web/admin.py
+++ b/snikket_web/admin.py
@@ -28,7 +28,7 @@ from .infra import client, circle_name, BaseForm
 bp = Blueprint("admin", __name__, url_prefix="/admin")
 
 
-@bp.route("/")
+@bp.route("/")  # type:ignore
 @client.require_admin_session()
 async def index() -> str:
     return await render_template("admin_home.html")
@@ -38,7 +38,7 @@ class PasswordResetLinkPost(BaseForm):
     action_revoke = wtforms.StringField()
 
 
-@bp.route("/users")
+@bp.route("/users")  # type:ignore
 @client.require_admin_session()
 async def users() -> str:
     users = sorted(
@@ -73,7 +73,7 @@ class EditUserForm(BaseForm):
         choices=[
             # NOTE: enable this only after something has been done which
             # actually enforces the described restrictions :).
-            # ("prosody:restricted", _l("Limited")),
+            ("prosody:restricted", _LIMITED_ROLE_NAME),
             ("prosody:normal", _l("Normal user")),
             ("prosody:admin", _l("Administrator")),
         ],
@@ -88,7 +88,7 @@ class EditUserForm(BaseForm):
     )
 
 
-@bp.route("/user/<localpart>/", methods=["GET", "POST"])
+@bp.route("/user/<localpart>/", methods=["GET", "POST"])  # type:ignore
 @client.require_admin_session()
 async def edit_user(localpart: str) -> typing.Union[quart.Response, str]:
     target_user_info = await client.get_user_by_localpart(localpart)
@@ -143,7 +143,7 @@ class DeleteUserForm(BaseForm):
     )
 
 
-@bp.route("/user/<localpart>/delete", methods=["GET", "POST"])
+@bp.route("/user/<localpart>/delete", methods=["GET", "POST"])  # type:ignore
 @client.require_admin_session()
 async def delete_user(localpart: str) -> typing.Union[str, quart.Response]:
     target_user_info = await client.get_user_by_localpart(localpart)
@@ -164,7 +164,7 @@ async def delete_user(localpart: str) -> typing.Union[str, quart.Response]:
     )
 
 
-@bp.route("/user/<localpart>/debug")
+@bp.route("/user/<localpart>/debug")  # type:ignore
 @client.require_admin_session()
 async def debug_user(localpart: str) -> typing.Union[str, quart.Response]:
     target_user_info = await client.get_user_by_localpart(localpart)
@@ -180,7 +180,7 @@ async def debug_user(localpart: str) -> typing.Union[str, quart.Response]:
     )
 
 
-@bp.route("/users/password-reset/<id_>", methods=["GET", "POST"])
+@bp.route("/users/password-reset/<id_>", methods=["GET", "POST"])  # type:ignore  # noqa:E501
 @client.require_admin_session()
 async def user_password_reset_link(
         id_: str,
@@ -274,7 +274,7 @@ class InvitePost(BaseForm):
         )
 
 
-@bp.route("/invitations", methods=["GET", "POST"])
+@bp.route("/invitations", methods=["GET", "POST"])  # type:ignore
 @client.require_admin_session()
 async def invitations() -> typing.Union[str, quart.Response]:
     invites = sorted(
@@ -320,7 +320,7 @@ class InviteForm(BaseForm):
     )
 
 
-@bp.route("/invitation/-/new", methods=["POST"])
+@bp.route("/invitation/-/new", methods=["POST"])  # type:ignore
 @client.require_admin_session()
 async def create_invite() -> typing.Union[str, quart.Response]:
     form = InvitePost()
@@ -348,7 +348,7 @@ async def create_invite() -> typing.Union[str, quart.Response]:
                                  invite_form=form)
 
 
-@bp.route("/invitation/<id_>", methods=["GET", "POST"])
+@bp.route("/invitation/<id_>", methods=["GET", "POST"])  # type:ignore
 @client.require_admin_session()
 async def edit_invite(id_: str) -> typing.Union[str, quart.Response]:
     try:
@@ -397,7 +397,7 @@ class CirclePost(BaseForm):
     )
 
 
-@bp.route("/circles")
+@bp.route("/circles")  # type:ignore
 @client.require_admin_session()
 async def circles() -> str:
     circles = sorted(
@@ -414,7 +414,7 @@ async def circles() -> str:
     )
 
 
-@bp.route("/circle/-/new", methods=["POST"])
+@bp.route("/circle/-/new", methods=["POST"])  # type:ignore
 @client.require_admin_session()
 async def create_circle() -> typing.Union[str, quart.Response]:
     create_form = CirclePost()
@@ -460,7 +460,7 @@ class EditCircleForm(BaseForm):
     )
 
 
-@bp.route("/circle/<id_>", methods=["GET", "POST"])
+@bp.route("/circle/<id_>", methods=["GET", "POST"])  # type:ignore
 @client.require_admin_session()
 async def edit_circle(id_: str) -> typing.Union[str, quart.Response]:
     async with client.authenticated_session() as session:
diff --git a/snikket_web/infra.py b/snikket_web/infra.py
index 195dc84..dc58456 100644
--- a/snikket_web/infra.py
+++ b/snikket_web/infra.py
@@ -26,7 +26,7 @@ babel = flask_babel.Babel()
 def selected_locale() -> str:
     selected = request.accept_languages.best_match(
         current_app.config['LANGUAGES']
-    )
+    ) or current_app.config['LANGUAGES'][0]
     return selected
 
 
diff --git a/snikket_web/invite.py b/snikket_web/invite.py
index 742509e..a3f995e 100644
--- a/snikket_web/invite.py
+++ b/snikket_web/invite.py
@@ -46,12 +46,12 @@ def context() -> typing.Mapping[str, typing.Any]:
     }
 
 
-@bp.route("/<id_>")
+@bp.route("/<id_>")  # type:ignore
 async def view_old(id_: str) -> quart.Response:
     return redirect(url_for(".view", id_=id_))
 
 
-@bp.route("/<id_>/")
+@bp.route("/<id_>/")  # type:ignore
 async def view(id_: str) -> typing.Union[quart.Response,
                                          typing.Tuple[str, int],
                                          str]:
@@ -124,7 +124,7 @@ class RegisterForm(BaseForm):
     )
 
 
-@bp.route("/<id_>/register", methods=["GET", "POST"])
+@bp.route("/<id_>/register", methods=["GET", "POST"])  # type:ignore
 async def register(id_: str) -> typing.Union[str, quart.Response]:
     try:
         invite = await client.get_public_invite_by_id(id_)
@@ -191,7 +191,7 @@ class ResetForm(BaseForm):
     )
 
 
-@bp.route("/<id_>/reset", methods=["GET", "POST"])
+@bp.route("/<id_>/reset", methods=["GET", "POST"])  # type:ignore
 async def reset(id_: str) -> typing.Union[str, quart.Response]:
     try:
         invite = await client.get_public_invite_by_id(id_)
@@ -232,7 +232,7 @@ async def reset(id_: str) -> typing.Union[str, quart.Response]:
     )
 
 
-@bp.route("/success", methods=["GET", "POST"])
+@bp.route("/success", methods=["GET", "POST"])  # type:ignore
 async def success() -> str:
     return await render_template(
         "invite_success.html",
@@ -240,7 +240,7 @@ async def success() -> str:
     )
 
 
-@bp.route("/success/reset", methods=["GET", "POST"])
+@bp.route("/success/reset", methods=["GET", "POST"])  # type:ignore
 async def reset_success() -> str:
     return await render_template(
         "invite_reset_success.html",
@@ -248,6 +248,6 @@ async def reset_success() -> str:
     )
 
 
-@bp.route("/-")
+@bp.route("/-")  # type:ignore
 async def index() -> quart.Response:
     return redirect(url_for("index"))
diff --git a/snikket_web/main.py b/snikket_web/main.py
index ee233b8..091f27c 100644
--- a/snikket_web/main.py
+++ b/snikket_web/main.py
@@ -48,7 +48,7 @@ class LoginForm(BaseForm):
     )
 
 
-@bp.route("/-")
+@bp.route("/-")  # type:ignore
 async def index() -> quart.Response:
     return redirect(url_for("index"))
 
@@ -56,7 +56,7 @@ async def index() -> quart.Response:
 ERR_CREDENTIALS_INVALID = _l("Invalid username or password.")
 
 
-@bp.route("/login", methods=["GET", "POST"])
+@bp.route("/login", methods=["GET", "POST"])  # type:ignore
 async def login() -> typing.Union[str, quart.Response]:
     if client.has_session and (await client.test_session()):
         return redirect(url_for('user.index'))
@@ -89,7 +89,7 @@ async def login() -> typing.Union[str, quart.Response]:
     return await render_template("login.html", form=form)
 
 
-@bp.route("/meta/about.html")
+@bp.route("/meta/about.html")  # type:ignore
 async def about() -> str:
     version = None
     extra_versions = {}
@@ -113,7 +113,7 @@ async def about() -> str:
     )
 
 
-@bp.route("/meta/demo.html")
+@bp.route("/meta/demo.html")  # type:ignore
 async def demo() -> str:
     return await render_template("demo.html")
 
@@ -122,8 +122,9 @@ def repad(s: str) -> str:
     return s + "=" * (4 - len(s) % 4)
 
 
-@bp.route("/avatar/<from_>/<code>")
+@bp.route("/avatar/<from_>/<code>")  # type:ignore
 async def avatar(from_: str, code: str) -> quart.Response:
+    etag: typing.Optional[str]
     try:
         etag = request.headers["if-none-match"]
     except KeyError:
@@ -165,6 +166,6 @@ async def avatar(from_: str, code: str) -> quart.Response:
     return response
 
 
-@bp.route("/_health")
+@bp.route("/_health")  # type:ignore
 async def health() -> Response:
     return Response("STATUS OK", content_type="text/plain")
diff --git a/snikket_web/prosodyclient.py b/snikket_web/prosodyclient.py
index c9c0644..01451b0 100644
--- a/snikket_web/prosodyclient.py
+++ b/snikket_web/prosodyclient.py
@@ -272,8 +272,9 @@ class ProsodyClient:
 
     def init_app(self, app: quart.Quart) -> None:
         app.config[self.CONFIG_ENDPOINT]
-        app.teardown_appcontext(self._plain_session.teardown)
-        app.teardown_appcontext(self._auth_session.teardown)
+        # the type annotation in quart seems to be wrong here
+        app.teardown_appcontext(self._plain_session.teardown)  # type:ignore
+        app.teardown_appcontext(self._auth_session.teardown)  # type:ignore
 
     @property
     def _endpoint_base(self) -> str:
diff --git a/snikket_web/user.py b/snikket_web/user.py
index 279e6e8..07db532 100644
--- a/snikket_web/user.py
+++ b/snikket_web/user.py
@@ -76,14 +76,14 @@ class ProfileForm(BaseForm):
     )
 
 
-@bp.route("/")
+@bp.route("/")  # type:ignore
 @client.require_session()
 async def index() -> str:
     user_info = await client.get_user_info()
     return await render_template("user_home.html", user_info=user_info)
 
 
-@bp.route('/passwd', methods=["GET", "POST"])
+@bp.route('/passwd', methods=["GET", "POST"])  # type:ignore
 @client.require_session()
 async def change_pw() -> typing.Union[str, quart.Response]:
     form = ChangePasswordForm()
@@ -115,7 +115,7 @@ EAVATARTOOBIG = _l(
 )
 
 
-@bp.route("/profile", methods=["GET", "POST"])
+@bp.route("/profile", methods=["GET", "POST"])  # type:ignore
 @client.require_session()
 async def profile() -> typing.Union[str, quart.Response]:
     max_avatar_size = current_app.config["MAX_AVATAR_SIZE"]
@@ -169,7 +169,7 @@ async def profile() -> typing.Union[str, quart.Response]:
                                  avatar_too_big_warning=EAVATARTOOBIG)
 
 
-@bp.route("/logout", methods=["GET", "POST"])
+@bp.route("/logout", methods=["GET", "POST"])  # type:ignore
 @client.require_session()
 async def logout() -> typing.Union[quart.Response, str]:
     form = LogoutForm()