diff --git a/cgi/canned_responses.c b/cgi/canned_responses.c
line changes: +8/-0
index fb79b6f..a1e4f29
--- a/cgi/canned_responses.c
+++ b/cgi/canned_responses.c

@@ -11,6 +11,14 @@ void respond_simple_data(unsigned const char *data, int len) {
 	fwrite(data, len, 1, stdout);
 }
 
+void respond_403() {
+	printf("Status: 403 Forbidden\r\n");
+	printf("Content-type: text/html\r\n");
+	printf("Content-length: %d\r\n\r\n", strlen(CONTENT_403));
+
+	printf(CONTENT_403);
+}
+
 void respond_404() {
 	printf("Status: 404 Not Found\r\n");
 	printf("Content-type: text/html\r\n");

diff --git a/cgi/canned_responses.h b/cgi/canned_responses.h
line changes: +1/-0
index bfdafda..9ae878d
--- a/cgi/canned_responses.h
+++ b/cgi/canned_responses.h

@@ -5,6 +5,7 @@
 #define _CANNED_RESPONSES
 
 void respond_simple_data(unsigned const char *data, int len);
+void respond_403();
 void respond_404();
 void respond_405();
 void respond_JSON_Failure();

diff --git a/cgi/cgi_blerg.c b/cgi/cgi_blerg.c
line changes: +97/-16
index c004a7d..1bba24d
--- a/cgi/cgi_blerg.c
+++ b/cgi/cgi_blerg.c

@@ -9,12 +9,28 @@
 #include "database.h"
 #include "tags.h"
 #include "auth.h"
+#include "subscription.h"
 #include "canned_responses.h"
 #include "app.h"
 #include "config.h"
 
 yajl_gen_config yajl_c = { 0, 0 };
 
+int check_auth(const char *username) {
+	if (username == NULL || username[0] == 0) {
+		respond_403();
+		return 0;
+	}
+
+	const char *given_token = cgi_getcookie("auth");
+	if (!auth_check_token(username, given_token)) {
+		respond_403();
+		return 0;
+	}
+	return 1;
+}
+
+
 void respond_for_range(struct blerg *b, uint64_t from, uint64_t to) {
 	const unsigned char *ybuf;
 	unsigned int len;

@@ -183,21 +199,17 @@ int main(int argc, char *argv[]) {
 			exit(0);
 		}
 
+		const char *username = cgi_getentrystr("username");
+		if (!check_auth(username))
+			exit(0);
+
 		if (path[4] == '/') {
 			respond_404();
 			exit(0);
 		}
 
-		const char *username = cgi_getentrystr("username");
 		const char *data = cgi_getentrystr("data");
-		if (username == NULL || username[0] == 0 ||
-		    data == NULL || data[0] == 0) {
-			respond_JSON_Failure();
-			exit(0);
-		}
-
-		const char *given_token = cgi_getcookie("auth");
-		if (!auth_check_token(username, given_token)) {
+		if (data == NULL || data[0] == 0) {
 			respond_JSON_Failure();
 			exit(0);
 		}

@@ -312,19 +324,88 @@ int main(int argc, char *argv[]) {
 		}
 
 		const char *username = cgi_getentrystr("username");
-		if (username == NULL || username[0] == 0) {
-			respond_JSON_Failure();
+		if (!check_auth(username))
 			exit(0);
+
+		auth_logout(username);
+		respond_JSON_Success();
+	} else if (strncmp(path, "/subscribe", 11) == 0 || strncmp(path, "/unsubscribe", 13) == 0) {
+
+		const char *username = cgi_getentrystr("username");
+		if (!check_auth(username))
+			exit(0);
+
+		if (path[1] == 'u') {
+			if (path[12] != '/') {
+				respond_404();
+				exit(0);
+			}
+
+			ret = parse_url_info(path + 13, &info);
+			if ((ret & URL_INFO_NAME) == 0) {
+				respond_404();
+				exit(0);
+			}
+
+			subscription_remove(username, info.name);
+		} else {
+			if (path[10] != '/') {
+				respond_404();
+				exit(0);
+			}
+
+			ret = parse_url_info(path + 11, &info);
+			if ((ret & URL_INFO_NAME) == 0) {
+				respond_404();
+				exit(0);
+			}
+
+			subscription_add(username, info.name);
 		}
+		respond_JSON_Success();
+	} else if (strncmp(path, "/feed", 6) == 0) {
+		const char *username = cgi_getentrystr("username");
+		if (!check_auth(username))
+			exit(0);
 
+		int recs = 50;
+		struct blergref *feedlist = subscription_list(username, 0, &recs, -1);
 
-		const char *given_token = cgi_getcookie("auth");
-		if (auth_check_token(username, given_token)) {
-			auth_logout(username);
-			respond_JSON_Success();
+		if (recs == 0) {
+			respond_simple_data("[]", 2);
 		} else {
-			respond_JSON_Failure();
+			respond_blergref_list(feedlist, recs);
 		}
+	} else if (strncmp(path, "/feedinfo", 9) == 0) {
+		const char *username = cgi_getentrystr("username");
+		if (!check_auth(username))
+			exit(0);
+
+		if (path[9] != '/') {
+			respond_404();
+			exit(0);
+		}
+
+		ret = parse_url_info(path + 10, &info);
+		if ((ret & URL_INFO_NAME) == 0) {
+			respond_404();
+			exit(0);
+		}
+
+		yajl_gen g = yajl_gen_alloc(&yajl_c, NULL);
+		yajl_gen_map_open(g);
+		yajl_gen_string(g, "subscribed", 10);
+		yajl_gen_bool(g, is_subscribed(username, info.name));
+		yajl_gen_map_close(g);
+
+		const unsigned char *ybuf;
+		yajl_gen_get_buf(g, &ybuf, &len);
+
+		printf("Content-type: application/json\r\n");
+		printf("Content-length: %d\r\n\r\n", len);
+		fwrite(ybuf, len, 1, stdout);
+
+		yajl_gen_free(g);
 	} else {
 		respond_404();
 		exit(0);