diff --git a/packages/builder/src/components/userInterface/ComponentSelectionList.svelte b/packages/builder/src/components/userInterface/ComponentSelectionList.svelte
index 66df3aa686..169c3ab284 100644
--- a/packages/builder/src/components/userInterface/ComponentSelectionList.svelte
+++ b/packages/builder/src/components/userInterface/ComponentSelectionList.svelte
@@ -30,34 +30,9 @@
   let selectedCategory = categories[0]
 
   const onComponentChosen = component => {
-    if (component.template) {
-      // onTemplateChosen(component.template)
-    } else {
-      store.addChildComponent(component._component)
-      toggleTab()
-    }
+    store.addChildComponent(component._component)
+    toggleTab()
   }
-
-  // const onTemplateInstanceChosen = () => {
-  //   selectedComponent = null
-  //   const instance = templateInstances.find(
-  //     i => i.name === selectedTemplateInstance
-  //   )
-  //   store.addTemplatedComponent(instance.props)
-  //   toggleTab()
-  // }
-
-  // $: templatesByComponent = groupBy(t => t.component)($store.templates)
-  // $: standaloneTemplates = pipe(
-  //   templatesByComponent,
-  //   [
-  //     values,
-  //     flatten,
-  //     filter(t => !$store.components.some(c => c.name === t.component)),
-  //     map(t => ({ name: splitName(t.component).componentName, template: t })),
-  //     uniqBy(t => t.name),
-  //   ]
-  // )
 </script>
 
 <div class="root">
@@ -78,25 +53,6 @@
   </div>
 </div>
 
-<!-- <ConfirmDialog
-  bind:this={selectTemplateDialog}
-  title="Choose Template"
-  onCancel={() => (selectedComponent = null)}
-  onOk={onTemplateInstanceChosen}>
-  {#each templateInstances.map(i => i.name) as instance}
-    <div class="uk-margin uk-grid-small uk-child-width-auto uk-grid">
-      <label>
-        <input
-          class="uk-radio"
-          type="radio"
-          bind:group={selectedTemplateInstance}
-          value={instance} />
-        <span class="template-instance-label">{instance}</span>
-      </label>
-    </div>
-  {/each}
-</ConfirmDialog> -->
-
 <style>
   .tabs {
     display: flex;
diff --git a/packages/server/src/api/index.js b/packages/server/src/api/index.js
index 765329f842..19c44b3955 100644
--- a/packages/server/src/api/index.js
+++ b/packages/server/src/api/index.js
@@ -18,82 +18,79 @@ const {
   componentRoutes,
 } = require("./routes")
 
-module.exports = app => {
-  const router = new Router()
+const router = new Router()
 
-  router
-    .use(
-      compress({
-        threshold: 2048,
-        gzip: {
-          flush: zlib.Z_SYNC_FLUSH,
-        },
-        deflate: {
-          flush: zlib.Z_SYNC_FLUSH,
-        },
-      })
-    )
-    .use(async (ctx, next) => {
-      // TODO: temp dev middleware
-      ctx.config = {
-        latestPackagesFolder: resolve(homedir(), ".budibase"),
-        jwtSecret: "foo",
-      }
-      ctx.isDev = process.env.NODE_ENV !== "production"
-      await next()
+router
+  .use(
+    compress({
+      threshold: 2048,
+      gzip: {
+        flush: zlib.Z_SYNC_FLUSH,
+      },
+      deflate: {
+        flush: zlib.Z_SYNC_FLUSH,
+      },
     })
-    .use(authenticated)
-
-  // error handling middleware
-  router.use(async (ctx, next) => {
-    try {
-      await next()
-    } catch (err) {
-      console.trace(err)
-      ctx.status = err.status || err.statusCode || 500
-      ctx.body = {
-        message: err.message,
-        status: ctx.status,
-      }
+  )
+  .use(async (ctx, next) => {
+    ctx.config = {
+      latestPackagesFolder: resolve(homedir(), ".budibase"),
+      jwtSecret: process.env.JWT_SECRET,
     }
+    ctx.isDev = process.env.NODE_ENV !== "production"
+    await next()
   })
+  .use(authenticated)
 
-  router.use(authRoutes.routes())
-  router.use(authRoutes.allowedMethods())
+// error handling middleware
+router.use(async (ctx, next) => {
+  try {
+    await next()
+  } catch (err) {
+    console.trace(err)
+    ctx.status = err.status || err.statusCode || 500
+    ctx.body = {
+      message: err.message,
+      status: ctx.status,
+    }
+  }
+})
 
-  // authenticated routes
-  router.use(viewRoutes.routes())
-  router.use(viewRoutes.allowedMethods())
+router.use(authRoutes.routes())
+router.use(authRoutes.allowedMethods())
 
-  router.use(modelRoutes.routes())
-  router.use(modelRoutes.allowedMethods())
+// authenticated routes
+router.use(viewRoutes.routes())
+router.use(viewRoutes.allowedMethods())
 
-  router.use(userRoutes.routes())
-  router.use(userRoutes.allowedMethods())
+router.use(modelRoutes.routes())
+router.use(modelRoutes.allowedMethods())
 
-  router.use(recordRoutes.routes())
-  router.use(recordRoutes.allowedMethods())
+router.use(userRoutes.routes())
+router.use(userRoutes.allowedMethods())
 
-  router.use(instanceRoutes.routes())
-  router.use(instanceRoutes.allowedMethods())
-  // end auth routes
+router.use(recordRoutes.routes())
+router.use(recordRoutes.allowedMethods())
 
-  router.use(pageRoutes.routes())
-  router.use(pageRoutes.allowedMethods())
+router.use(instanceRoutes.routes())
+router.use(instanceRoutes.allowedMethods())
+// end auth routes
 
-  router.use(applicationRoutes.routes())
-  router.use(applicationRoutes.allowedMethods())
+router.use(pageRoutes.routes())
+router.use(pageRoutes.allowedMethods())
 
-  router.use(componentRoutes.routes())
-  router.use(componentRoutes.allowedMethods())
+router.use(applicationRoutes.routes())
+router.use(applicationRoutes.allowedMethods())
 
-  router.use(clientRoutes.routes())
-  router.use(clientRoutes.allowedMethods())
+router.use(componentRoutes.routes())
+router.use(componentRoutes.allowedMethods())
 
-  router.use(staticRoutes.routes())
-  router.use(staticRoutes.allowedMethods())
+router.use(clientRoutes.routes())
+router.use(clientRoutes.allowedMethods())
 
-  router.redirect("/", "/_builder")
+router.use(staticRoutes.routes())
+router.use(staticRoutes.allowedMethods())
 
-  return router
-}
+router.redirect("/", "/_builder")
+
+module.exports = router
diff --git a/packages/server/src/app.js b/packages/server/src/app.js
index 728e4accc6..2174d4ceff 100644
--- a/packages/server/src/app.js
+++ b/packages/server/src/app.js
@@ -1,17 +1,15 @@
 const Koa = require("koa")
 const logger = require("koa-logger")
-const router = require("./api")
+const api = require("./api")
 const koaBody = require("koa-body")
+
 const app = new Koa()
 
-module.exports = () => {
-  app.keys = Object.keys(process.env)
-    .filter(k => k.startsWith("COOKIE_KEY_"))
-    .map(k => process.env[k])
+// set up top level koa middleware
+app.use(koaBody({ multipart: true }))
+app.use(logger())
 
-  app.use(koaBody({ multipart: true }))
-  app.use(logger())
-  app.use(router(app).routes())
+// api routes
+app.use(api.routes())
 
-  return app.listen(process.env.PORT || 4001)
-}
+module.exports = app.listen(process.env.PORT || 4001)
diff --git a/packages/server/src/electron.js b/packages/server/src/electron.js
index 41162e2099..c689c49e2f 100644
--- a/packages/server/src/electron.js
+++ b/packages/server/src/electron.js
@@ -5,7 +5,7 @@ require("dotenv").config()
 const DEV_URL = "http://localhost:4001";
 
 function createWindow() {
-  app.server = require("./app")();
+  app.server = require("./app");
   let win = new BrowserWindow({ width: 1920, height: 1080 });
   win.loadURL(DEV_URL);
 }
diff --git a/packages/server/src/index.js b/packages/server/src/index.js
index 6274440c8b..0079115f5b 100644
--- a/packages/server/src/index.js
+++ b/packages/server/src/index.js
@@ -1,11 +1,6 @@
 require("dotenv").config()
-const app = require("./app")
+const server = require("./app")
 
-async function startServer() {
-  const server = await app()
-  server.on("listening", () => {
-    console.log(`Budibase Server listening on port ${process.env.PORT}`)
-  })
-}
-
-startServer()
+server.on("listening", () => {
+  console.log(`Budibase Server listening on port ${process.env.PORT}`)
+});
\ No newline at end of file
diff --git a/packages/server/src/middleware/authenticated.js b/packages/server/src/middleware/authenticated.js
index 7821e6aa44..34c9f66d1f 100644
--- a/packages/server/src/middleware/authenticated.js
+++ b/packages/server/src/middleware/authenticated.js
@@ -1,8 +1,14 @@
 const jwt = require("jsonwebtoken")
+const STATUS_CODES = require("../utilities/statusCodes");
 
 module.exports = async (ctx, next) => {
+  if (ctx.isDev) {
+    ctx.isAuthenticated = true
+    await next();
+    return
+  }
+
   const token = ctx.cookies.get("budibase:token")
-  console.log("TOKEN", token)
 
   if (!token) {
     ctx.isAuthenticated = false
@@ -14,7 +20,7 @@ module.exports = async (ctx, next) => {
     ctx.jwtPayload = jwt.verify(token, ctx.config.jwtSecret)
     ctx.isAuthenticated = true
   } catch (err) {
-    ctx.throw(err.status || 403, err.text)
+    ctx.throw(err.status || STATUS_CODES.FORBIDDEN, err.text)
   }
 
   await next()
diff --git a/packages/server/src/middleware/session.js b/packages/server/src/middleware/session.js
deleted file mode 100644
index 1767b82e39..0000000000
--- a/packages/server/src/middleware/session.js
+++ /dev/null
@@ -1,24 +0,0 @@
-const session = require("koa-session")
-
-module.exports = app => {
-  const sessionConfig = {
-    key: "budi:sess" /** (string) cookie key (default is koa:sess) */,
-    /** (number || 'session') maxAge in ms (default is 1 days) */
-    /** 'session' will result in a cookie that expires when session/browser is closed */
-    /** Warning: If a session cookie is stolen, this cookie will never expire */
-    maxAge: 86400000,
-    autoCommit: true /** (boolean) automatically commit headers (default true) */,
-    overwrite: true /** (boolean) can overwrite or not (default true) */,
-    httpOnly: true /** (boolean) httpOnly or not (default true) */,
-    signed: true /** (boolean) signed or not (default true) */,
-    rolling: false /** (boolean) Force a session identifier cookie to be set on every response. The expiration is reset to the original maxAge, resetting the expiration countdown. (default is false) */,
-    renew: false /** (boolean) renew session when session is nearly expired, so we can always keep user logged in. (default is false)*/,
-    store: {
-      get: async key => ({ key }),
-      set: async key => ({ key }),
-      destroy: async () => ({}),
-    },
-  }
-
-  return session(sessionConfig, app)
-}