diff --git a/Plugins/Web/StatsWeb/Controllers/StatsController.cs b/Plugins/Web/StatsWeb/Controllers/StatsController.cs
index 22c44f166..d7c6a7883 100644
--- a/Plugins/Web/StatsWeb/Controllers/StatsController.cs
+++ b/Plugins/Web/StatsWeb/Controllers/StatsController.cs
@@ -115,6 +115,11 @@ namespace IW4MAdmin.Plugins.Web.StatsWeb.Controllers
                     .Select(_penalty => new { _penalty.OffenderId, _penalty.PenaltyId, _penalty.When, _penalty.AutomatedOffense })
                     .FirstOrDefaultAsync(_penalty => _penalty.PenaltyId == penaltyId);
 
+                if (penalty == null)
+                {
+                    return NotFound();
+                }
+
                 // todo: this can be optimized
                 var iqSnapshotInfo = ctx.Set<Stats.Models.EFACSnapshot>()
                     .Where(s => s.ClientId == penalty.OffenderId)
diff --git a/SharedLibraryCore/Services/ClientService.cs b/SharedLibraryCore/Services/ClientService.cs
index a7c9ce578..8fb5d7c00 100644
--- a/SharedLibraryCore/Services/ClientService.cs
+++ b/SharedLibraryCore/Services/ClientService.cs
@@ -50,6 +50,8 @@ namespace SharedLibraryCore.Services
                     NetworkId = entity.NetworkId
                 };
 
+
+                entity.CurrentServer.Logger.WriteDebug($"[create] adding {entity} to context");
                 context.Clients.Add(client);
 
                 // they're just using a new GUID
diff --git a/WebfrontCore/Startup.cs b/WebfrontCore/Startup.cs
index 46f681bca..0d7abb765 100644
--- a/WebfrontCore/Startup.cs
+++ b/WebfrontCore/Startup.cs
@@ -114,13 +114,13 @@ namespace WebfrontCore
 
             app.UseStaticFiles();
             app.UseAuthentication();
-            app.UseAuthorization();
             app.UseCors("AllowAll");
 
             // prevents banned/demoted users from keeping their claims
             app.UseMiddleware<ClaimsPermissionRemoval>(Program.Manager);
 
             app.UseRouting();
+            app.UseAuthorization();
             app.UseEndpoints(endpoints =>
             {
                 endpoints.MapControllerRoute("default", "{controller=Home}/{action=Index}/{id?}");