diff --git a/internal/dis/component/auth/panel/templates/user.html b/internal/dis/component/auth/panel/templates/user.html
index d2e71fd..e0676c6 100644
--- a/internal/dis/component/auth/panel/templates/user.html
+++ b/internal/dis/component/auth/panel/templates/user.html
@@ -23,7 +23,7 @@
             {{ if .User.IsTOTPEnabled }}
                 <li>Passcode Enabled: <b>true</b></li>
             {{ else }}
-                <li>Passcode Enabled: <b>false</b> <small>(some actions are disabled)</small></li>
+                <li>Passcode Enabled: <b>false</b>  {{ if .User.IsAdmin }}<small>(some admin actions are disabled)</small>{{ end }}</li>
             {{ end }}
         </ul>
     </p>
diff --git a/internal/dis/component/auth/protect.go b/internal/dis/component/auth/protect.go
index 85387c1..2afa700 100644
--- a/internal/dis/component/auth/protect.go
+++ b/internal/dis/component/auth/protect.go
@@ -85,7 +85,7 @@ var Admin Permission = func(user *AuthUser, r *http.Request) (ok Grant, err erro
 	return Bool2Grant(user != nil && user.IsAdmin() && user.IsTOTPEnabled(), "user needs to have admin permissions and passcode enabled"), nil
 }
 
-// User represents a permission that checks if a user has totp enabled.
+// User represents a permission that checks if a user is enabled
 var User Permission = func(user *AuthUser, r *http.Request) (ok Grant, err error) {
-	return Bool2Grant(user != nil && user.IsEnabled() && user.IsTOTPEnabled(), "user needs to have passcode enabled"), nil
+	return Bool2Grant(user != nil && user.IsEnabled(), "user needs to be enabled"), nil
 }
diff --git a/internal/dis/component/control/admin/components.go b/internal/dis/component/control/admin/components.go
index f1dc587..927698b 100644
--- a/internal/dis/component/control/admin/components.go
+++ b/internal/dis/component/control/admin/components.go
@@ -11,7 +11,7 @@ import (
 	"github.com/FAU-CDI/wisski-distillery/internal/models"
 	"github.com/FAU-CDI/wisski-distillery/pkg/httpx"
 	"github.com/FAU-CDI/wisski-distillery/pkg/lazy"
-	"github.com/gorilla/mux"
+	"github.com/julienschmidt/httprouter"
 )
 
 //go:embed "html/components.html"
@@ -52,7 +52,8 @@ func (admin *Admin) ingredients(r *http.Request) (cp ingredientsContext, err err
 	admin.Dependencies.Custom.Update(&cp, r)
 
 	// find the instance itself!
-	instance, err := admin.Dependencies.Instances.WissKI(r.Context(), mux.Vars(r)["slug"])
+	slug := httprouter.ParamsFromContext(r.Context()).ByName("slug")
+	instance, err := admin.Dependencies.Instances.WissKI(r.Context(), slug)
 	if err == instances.ErrWissKINotFound {
 		return cp, httpx.ErrNotFound
 	}
diff --git a/internal/dis/component/control/admin/grants.go b/internal/dis/component/control/admin/grants.go
index bbdb733..6c98d5a 100644
--- a/internal/dis/component/control/admin/grants.go
+++ b/internal/dis/component/control/admin/grants.go
@@ -12,7 +12,7 @@ import (
 	"github.com/FAU-CDI/wisski-distillery/internal/wisski"
 	"github.com/FAU-CDI/wisski-distillery/pkg/httpx"
 	"github.com/FAU-CDI/wisski-distillery/pkg/httpx/field"
-	"github.com/gorilla/mux"
+	"github.com/julienschmidt/httprouter"
 	"golang.org/x/exp/maps"
 	"golang.org/x/exp/slices"
 )
@@ -94,7 +94,8 @@ func (gc *grantsContext) useGrants(r *http.Request, admin *Admin) (err error) {
 }
 
 func (admin *Admin) getGrants(r *http.Request) (gc grantsContext, err error) {
-	if err := gc.use(r, mux.Vars(r)["slug"], admin); err != nil {
+	slug := httprouter.ParamsFromContext(r.Context()).ByName("slug")
+	if err := gc.use(r, slug, admin); err != nil {
 		return gc, err
 	}
 
diff --git a/internal/dis/component/control/admin/instance.go b/internal/dis/component/control/admin/instance.go
index ce160db..a0c5884 100644
--- a/internal/dis/component/control/admin/instance.go
+++ b/internal/dis/component/control/admin/instance.go
@@ -10,7 +10,7 @@ import (
 	"github.com/FAU-CDI/wisski-distillery/internal/models"
 	"github.com/FAU-CDI/wisski-distillery/internal/status"
 	"github.com/FAU-CDI/wisski-distillery/pkg/httpx"
-	"github.com/gorilla/mux"
+	"github.com/julienschmidt/httprouter"
 )
 
 //go:embed "html/instance.html"
@@ -31,7 +31,8 @@ func (admin *Admin) instance(r *http.Request) (is instanceContext, err error) {
 	admin.Dependencies.Custom.Update(&is, r)
 
 	// find the instance itself!
-	instance, err := admin.Dependencies.Instances.WissKI(r.Context(), mux.Vars(r)["slug"])
+	slug := httprouter.ParamsFromContext(r.Context()).ByName("slug")
+	instance, err := admin.Dependencies.Instances.WissKI(r.Context(), slug)
 	if err == instances.ErrWissKINotFound {
 		return is, httpx.ErrNotFound
 	}
diff --git a/internal/dis/component/instances/instances.go b/internal/dis/component/instances/instances.go
index 3cfd648..3c1053a 100644
--- a/internal/dis/component/instances/instances.go
+++ b/internal/dis/component/instances/instances.go
@@ -47,6 +47,10 @@ func (instances *Instances) use(wisski *wisski.WissKI) {
 // WissKI returns the WissKI with the provided slug, if it exists.
 // It the WissKI does not exist, returns ErrWissKINotFound.
 func (instances *Instances) WissKI(ctx context.Context, slug string) (wissKI *wisski.WissKI, err error) {
+	if slug == "" {
+		return nil, ErrWissKINotFound
+	}
+
 	sql := instances.Dependencies.SQL
 	if err := sql.WaitQueryTable(ctx); err != nil {
 		return nil, err
@@ -61,7 +65,7 @@ func (instances *Instances) WissKI(ctx context.Context, slug string) (wissKI *wi
 	wissKI = new(wisski.WissKI)
 
 	// find the instance by slug
-	query := table.Where(&models.Instance{Slug: slug}).Find(&wissKI.Liquid.Instance)
+	query := table.Find(&wissKI.Liquid.Instance, &models.Instance{Slug: slug})
 	switch {
 	case query.Error != nil:
 		return nil, errSQL.WithMessageF(query.Error)