Merge branch 'security' into testing
diff --git a/developer/views.py b/developer/views.py
index 2aee202..3c4970c 100644
--- a/developer/views.py
+++ b/developer/views.py
@@ -4,31 +4,37 @@
 # Create your views here.
 
 def home_page(request):
-	return render(request, 'developerhome.html')
+    if request.user.is_staff:
+        return render(request, 'developerhome.html')
 
 def view_dev_status(request):
-	userprofiles = UserProfile.objects.all()
-	products = Product.objects.all()
-	datasets = Dataset.objects.all()
-	optasks = OpTask.objects.all()
-	return render(request, 'status.html', {'userprofiles': userprofiles, 'products': products, 'datasets': datasets,'optasks': optasks})
+    if request.user.is_staff:
+        userprofiles = UserProfile.objects.all()
+        products = Product.objects.all()
+        datasets = Dataset.objects.all()
+        optasks = OpTask.objects.all()
+        return render(request, 'status.html', {'userprofiles': userprofiles, 'products': products, 'datasets': datasets,'optasks': optasks})
 
 def view_dev_products(request):
-	products = Product.objects.all()
-	return render(request, 'dev_products.html', {'products': products})	
+    if request.user.is_staff:
+        products = Product.objects.all()
+        return render(request, 'dev_products.html', {'products': products})
 
 def submit_product(request):
-    return render(request, 'submit_product.html')
+    if request.user.is_staff:
+        return render(request, 'submit_product.html')
 
 def newProduct(request):
-    dataset = Dataset.objects.create(name=request.POST['product_dataset'])
-    Product.objects.create(dataset=dataset, 
-        url=request.POST['product_url'], 
-        team=request.POST['product_team'], 
-        name=request.POST['product_name'], 
-        version=request.POST['product_version'], 
-        instructions=request.POST['product_instructions'])
-    return redirect('/developer/product_comp/')
+    if request.user.is_staff:
+        dataset = Dataset.objects.create(name=request.POST['product_dataset'])
+        Product.objects.create(dataset=dataset,
+            url=request.POST['product_url'],
+            team=request.POST['product_team'],
+            name=request.POST['product_name'],
+            version=request.POST['product_version'],
+            instructions=request.POST['product_instructions'])
+        return redirect('/developer/product_comp/')
 
 def product_comp(request):
-    return render(request, 'product_comp.html')
\ No newline at end of file
+    if request.user.is_staff:
+        return render(request, 'product_comp.html')
\ No newline at end of file
diff --git a/exp_portal/email.py b/exp_portal/email.py
index 820d94c..d8b38c1 100644
--- a/exp_portal/email.py
+++ b/exp_portal/email.py
@@ -2,24 +2,31 @@
 from op_tasks.models import UserProfile
 from django.core import mail
 from django.conf import settings
+from tasks import user_authorized
+
 from django.contrib.auth.decorators import login_required
 
 
 @login_required(login_url='/tasking/login')
 def send_email(request):
-    if request.method == 'POST':
-        email_to = request.POST.get('email_to', 'xdataonlineerrors@gmail.com')
-        subject = request.POST.get('email_subject', 'error')
-        message = request.POST.get('email_message', 'error')
-        print email_to, subject, message
-        status = mail.send_mail(subject, message, settings.EMAIL_HOST_USER, [email_to], fail_silently=False)
-    else:
-        status = 2
-    userprofiles = UserProfile.objects.all()
-    if status == 0:
-        statusMessage = "The email did not send. Try again."
-    elif status == 1:
-        statusMessage = "Email sent!"
-    elif status == 2:
-        statusMessage = ""
-    return render(request, 'email_form.html', {'userprofiles': userprofiles, 'status': status, 'statusMessage': statusMessage})
\ No newline at end of file
+    if user_authorized(request):
+        if request.method == 'POST':
+            email_to = request.POST.get('email_to', 'xdataonlineerrors@gmail.com')
+            subject = request.POST.get('email_subject', 'error')
+            message = request.POST.get('email_message', 'error')
+            print email_to, subject, message
+            status = mail.send_mail(subject, message, settings.EMAIL_HOST_USER, [email_to], fail_silently=False)
+        else:
+            status = 2
+        userprofiles = UserProfile.objects.all()
+        if status == 0:
+            statusMessage = "The email did not send. Try again."
+        elif status == 1:
+            statusMessage = "Email sent!"
+        elif status == 2:
+            statusMessage = ""
+        return render(request, 'email_form.html', {'userprofiles': userprofiles, 'status': status, 'statusMessage': statusMessage})
+
+
+def printme(string):
+    print string
diff --git a/exp_portal/products.py b/exp_portal/products.py
index 140cc0f..1985241 100644
--- a/exp_portal/products.py
+++ b/exp_portal/products.py
@@ -1,64 +1,75 @@
 from django.shortcuts import render, redirect
 from op_tasks.models import Product, Dataset
 from django.contrib.auth.decorators import login_required
+from tasks import user_authorized
+from django.contrib.auth.decorators import login_required
+from xdata.settings import LOGIN_URL
 
-@login_required(login_url='/tasking/login')
+
+@login_required(login_url=LOGIN_URL)
 def view_products(request):
-	products = Product.objects.all()
-	return render(request, 'products.html', {'products': products})
+	if user_authorized(request):
+		products = Product.objects.all()
+		return render(request, 'products.html', {'products': products})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def view_product_details(request, productname):
-	product = Product.objects.all().filter(name=productname)[0]
-	datasets = Dataset.objects.all()
-	return render(request, 'product_details.html', {'product': product, 'datasets': datasets})
+	if user_authorized(request):
+		product = Product.objects.all().filter(name=productname)[0]
+		datasets = Dataset.objects.all()
+		return render(request, 'product_details.html', {'product': product, 'datasets': datasets})
 
 
-@login_required(login_url='/tasking/login')
+
+@login_required(login_url=LOGIN_URL)
 def edit_product(request, productpk):
-	product = Product.objects.get(id=productpk)
-	product.name = request.POST['product_name']
-	product.team = request.POST['product_team']
-	product.url = request.POST['product_url']
-	product.instructions = request.POST['instructions_url']
-	product.version = request.POST['version']
-	product.is_active = request.POST.get('is_active', False)
+	if user_authorized(request):
+		product = Product.objects.get(id=productpk)
+		product.name = request.POST['product_name']
+		product.team = request.POST['product_team']
+		product.url = request.POST['product_url']
+		product.instructions = request.POST['instructions_url']
+		product.version = request.POST['version']
+		product.is_active = request.POST.get('is_active', False)
 
-	# TODO error checking on this, though it should never fail 
-	dataset = Dataset.objects.all().filter(name=request.POST['dataset'])[0]
-	product.dataset = dataset
+		# TODO error checking on this, though it should never fail
+		dataset = Dataset.objects.all().filter(name=request.POST['dataset'])[0]
+		product.dataset = dataset
 
-	product.save()
+		product.save()
 
-	return redirect('exp_portal:view_products')
+		return redirect('exp_portal:view_products')
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def manage_products(request):
-	products = Product.objects.all()
-	return render(request, 'products.html', {'products': products})
+	if user_authorized(request):
+		products = Product.objects.all()
+		return render(request, 'products.html', {'products': products})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def add_product(request):
-	datasets = Dataset.objects.all()
-	return render(request, 'add_product.html', {'datasets': datasets})
+	if user_authorized(request):
+		datasets = Dataset.objects.all()
+		return render(request, 'add_product.html', {'datasets': datasets})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def new_product(request):
-	product = Product(name=request.POST['product_name'])
-	product.url = request.POST['product_url']
-	product.team = request.POST['product_team']
-	product.url = request.POST['product_url']
-	product.version = request.POST['product_version']
-	product.instructions = request.POST['product_instructions']
-	product.is_active = request.POST.get('product_active', False)
+	if user_authorized(request):
+		product = Product(name=request.POST['product_name'])
+		product.url = request.POST['product_url']
+		product.team = request.POST['product_team']
+		product.url = request.POST['product_url']
+		product.version = request.POST['product_version']
+		product.instructions = request.POST['product_instructions']
+		product.is_active = request.POST.get('product_active', False)
 
-	dataset = Dataset.objects.get(name=request.POST['product_dataset'])
-	product.dataset = dataset
+		dataset = Dataset.objects.get(name=request.POST['product_dataset'])
+		product.dataset = dataset
 
-	product.save()
+		product.save()
 
-	return redirect('exp_portal:view_products')	
+		return redirect('exp_portal:view_products')
diff --git a/exp_portal/tasks.py b/exp_portal/tasks.py
index 7bd10b4..2c27577 100644
--- a/exp_portal/tasks.py
+++ b/exp_portal/tasks.py
@@ -2,82 +2,92 @@
 from op_tasks.models import UserProfile, Product, Dataset, OpTask, TaskListItem, Experiment
 from django.contrib.auth.decorators import login_required
 from django.contrib.auth.models import User
+from xdata.settings import LOGIN_URL
 
-@login_required(login_url='/tasking/login')
+def user_authorized(request):
+	user = request.user
+	return user.is_staff
+
+
+@login_required(login_url=LOGIN_URL)
 def view_tasks(request):
-	tasks = OpTask.objects.all()
-	datasets = Dataset.objects.all()
-	return render(request, 'tasks.html', {'tasks': tasks, 'datasets':datasets})
+	if user_authorized(request):
+		tasks = OpTask.objects.all()
+		datasets = Dataset.objects.all()
+		return render(request, 'tasks.html', {'tasks': tasks, 'datasets':datasets})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def view_completed(request):
-	completed_tasks = TaskListItem.objects.all().filter(task_complete=True).order_by('-date_complete')
-	return render(request, 'completed.html', {'completed_tasks': completed_tasks})
+	if user_authorized(request):
+		completed_tasks = TaskListItem.objects.all().filter(task_complete=True).order_by('-date_complete')
+		return render(request, 'completed.html', {'completed_tasks': completed_tasks})
 
 
-@login_required(login_url='/tasking/login')
+
+@login_required(login_url=LOGIN_URL)
 def view_incomplete(request):
-	incomplete_tasks = TaskListItem.objects.all().filter(task_complete=False)
-	return render(request, 'incomplete.html', {'incomplete_tasks': incomplete_tasks})
+	if user_authorized(request):
+		incomplete_tasks = TaskListItem.objects.all().filter(task_complete=False)
+		return render(request, 'incomplete.html', {'incomplete_tasks': incomplete_tasks})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def add_task(request):
-	datasets = Dataset.objects.all()
-	return render(request, 'add_task.html', {'datasets': datasets})
+	if user_authorized(request):
+		datasets = Dataset.objects.all()
+		return render(request, 'add_task.html', {'datasets': datasets})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def new_task(request):
-	dataset = Dataset.objects.get(name=request.POST['task_dataset'])
-	task = OpTask()
-	task.dataset = dataset
-	task.survey_url = request.POST['task_url']
-	task.name = request.POST['task_name']
-	task.instructions = request.POST['task_instructions']
-	task.exit_url = request.POST['task_exit_url']
-
-	task.save()
-	return redirect('exp_portal:view_tasks')
+	if user_authorized(request):
+		dataset = Dataset.objects.get(name=request.POST['task_dataset'])
+		task = OpTask()
+		task.dataset = dataset
+		task.survey_url = request.POST['task_url']
+		task.name = request.POST['task_name']
+		task.instructions = request.POST['task_instructions']
+		task.exit_url = request.POST['task_exit_url']
+		task.save()
+		return redirect('exp_portal:view_tasks')
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def manage_tasks(request):
-	return view_tasks(request)
+	if user_authorized(request):
+		return view_tasks(request)
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def view_task_details(request, taskname):
-	task = OpTask.objects.all().filter(name=taskname)[0]
-	datasets = Dataset.objects.all()
-	print task.dataset.name
-	for dataset in datasets:
-		print dataset.name
-	return render(request, 'task_details.html', {'task': task, 'datasets': datasets})
+	if user_authorized(request):
+		task = OpTask.objects.all().filter(name=taskname)[0]
+		datasets = Dataset.objects.all()
+		print task.dataset.name
+		for dataset in datasets:
+			print dataset.name
+		return render(request, 'task_details.html', {'task': task, 'datasets': datasets})
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def edit_task(request, taskpk):
-	task = OpTask.objects.get(id=taskpk)
-	task.name = request.POST['task_name']
-	task.survey_url = request.POST['task_url']
-	task.exit_url = request.POST['task_exit_url']
-	task.instructions =request.POST['task_instructions']
-
-	dataset = Dataset.objects.get(name=request.POST['task_dataset'])
-	task.dataset = dataset
-
-	task.is_active = request.POST.get('task_active', False)
-
-	task.save()
-
-	return redirect('exp_portal:view_tasks')
+	if user_authorized(request):
+		task = OpTask.objects.get(id=taskpk)
+		task.name = request.POST['task_name']
+		task.survey_url = request.POST['task_url']
+		task.exit_url = request.POST['task_exit_url']
+		task.instructions =request.POST['task_instructions']
+		dataset = Dataset.objects.get(name=request.POST['task_dataset'])
+		task.dataset = dataset
+		task.is_active = request.POST.get('task_active', False)
+		task.save()
+		return redirect('exp_portal:view_tasks')
 
 
-@login_required(login_url='/tasking/login')
+@login_required(login_url=LOGIN_URL)
 def delete_task(request, taskpk):
-	task = OpTask.objects.get(id=taskpk)
-	task.delete()
-
-	return redirect('exp_portal:view_tasks')
+	if user_authorized(request):
+		task = OpTask.objects.get(id=taskpk)
+		task.delete()
+		return redirect('exp_portal:view_tasks')
diff --git a/exp_portal/urls.py b/exp_portal/urls.py
index 72347b1..9154fc0 100644
--- a/exp_portal/urls.py
+++ b/exp_portal/urls.py
@@ -41,4 +41,8 @@
 	url(r'^users/tasks/viewall/(?P<profile>.*)$', views.view_user_tasks, name='view_user_tasks'),
 	url(r'^experiment/products/$', views.view_experiment_products, name='view_experiment_products'),
 	url(r'^email/$', views.send_email, name='send_email'),
-	)
\ No newline at end of file
+	)
+
+# print settings.DEBUG, settings.STATIC_ROOT
+if settings.DEBUG:
+    urlpatterns += url(r'^static/(?P<path>.*)$', vs.serve),
\ No newline at end of file
diff --git a/exp_portal/users.py b/exp_portal/users.py
index f4138fb..8019e1d 100644
--- a/exp_portal/users.py
+++ b/exp_portal/users.py
@@ -9,6 +9,7 @@
 	userprofiles = UserProfile.objects.all().order_by('-user__last_login')
 	return render(request, 'users.html', {'userprofiles': userprofiles})
 
+
 @login_required(login_url='/tasking/login')
 def manage_users(request):
 	userprofiles = UserProfile.objects.all().order_by('-user__last_login')
@@ -156,7 +157,6 @@
 
 	return redirect('exp_portal:add_user_task', userpk)
 
-
 @login_required(login_url='/tasking/login')
 def view_users_experiment(request, experiment_name):
 	experiment = Experiment.objects.get(name=experiment_name)
diff --git a/exp_portal/views.py b/exp_portal/views.py
index 6e05ec3..681b709 100644
--- a/exp_portal/views.py
+++ b/exp_portal/views.py
@@ -6,67 +6,96 @@
 from products import *
 from tasks import *
 from email import *
-import csv
-import pandas
+
+
+def user_authorized(request):
+	user = request.user
+	return user.is_staff
+
 
 @login_required(login_url='/tasking/login')
 def home_page(request):
-	return render(request, 'experimenthome.html')
-
+	if user_authorized(request):
+		return render(request, 'experimenthome.html')
 
 @login_required(login_url='/tasking/login')
 def view_status(request):
-	experiments = Experiment.objects.all()
-	masterList = {}
-	for experiment in experiments:
-		name = experiment.name
-		userprofiles = experiment.userprofile_set.all()
-		usp = sorted(userprofiles)
-		products = []
-		tasks = []
-		completedTasks = []
-		incompleteTasks = []
-		experimentList = {}
-		for userprofile in userprofiles:
-			tasklistitems = userprofile.tasklistitem_set.all()
-			for tasklistitem in tasklistitems:
-				products.append(tasklistitem.product)
-				tasks.append(tasklistitem.op_task)
-				if tasklistitem.task_complete is True:
-					completedTasks.append(tasklistitem)
-				else:
-					incompleteTasks.append(tasklistitem)
-		percentageComplete = int((len(completedTasks) / float(len(completedTasks) + len(incompleteTasks))) * 100)
-		sortedProd = sorted(set(products))
-		sortedTasks = sorted(set(tasks))
-		sortedCompletedTasks = sorted(completedTasks)
-		sortedIncompleteTasks = sorted(incompleteTasks)
-		experimentList["users"] = usp
-		experimentList["products"] = sortedProd
-		experimentList["tasks"] = sortedTasks
-		experimentList["completedTasks"] = sortedCompletedTasks
-		experimentList["incompleteTasks"] = sortedIncompleteTasks
-		experimentList["percentageComplete"] = percentageComplete
-		masterList[name] = experimentList
-	return render(request, 'status.html', {'experimentList': masterList})	
+	if user_authorized(request):
+		experiments = Experiment.objects.all()
+		masterList = {}
+		for experiment in experiments:
+			name = experiment.name
+			userprofiles = experiment.userprofile_set.all()
+			usp = sorted(userprofiles)
+			products = []
+			tasks = []
+			completedTasks = []
+			incompleteTasks = []
+			experimentList = {}
+			for userprofile in userprofiles:
+				tasklistitems = userprofile.tasklistitem_set.all()
+				for tasklistitem in tasklistitems:
+					products.append(tasklistitem.product)
+					tasks.append(tasklistitem.op_task)
+					if tasklistitem.task_complete is True:
+						completedTasks.append(tasklistitem)
+					else:
+						incompleteTasks.append(tasklistitem)
+			percentageComplete = int((len(completedTasks) / float(len(completedTasks) + len(incompleteTasks))) * 100)
+			sortedProd = sorted(set(products))
+			sortedTasks = sorted(set(tasks))
+			sortedCompletedTasks = sorted(completedTasks)
+			sortedIncompleteTasks = sorted(incompleteTasks)
+			experimentList["users"] = usp
+			experimentList["products"] = sortedProd
+			experimentList["tasks"] = sortedTasks
+			experimentList["completedTasks"] = sortedCompletedTasks
+			experimentList["incompleteTasks"] = sortedIncompleteTasks
+			experimentList["percentageComplete"] = percentageComplete
+			masterList[name] = experimentList
+		return render(request, 'status.html', {'experimentList': masterList})
 
 
 @login_required(login_url='/tasking/login')
 def manage_exps(request):
-	experimentlist = Experiment.objects.all()
-	return render(request, 'experiments.html', {'experimentlist': experimentlist})
+	if user_authorized(request):
+		experimentlist = Experiment.objects.all()
+		return render(request, 'experiments.html', {'experimentlist': experimentlist})
 
 
 @login_required(login_url='/tasking/login')
 def view_exp_details(request, exppk):
-	experiment = Experiment.objects.get(id=exppk)
-	return render(request, 'experiment_details.html', {'experiment':experiment})
+	if user_authorized(request):
+		experiment = Experiment.objects.get(id=exppk)
+		return render(request, 'experiment_details.html', {'experiment':experiment})
 
 
 @login_required(login_url='/tasking/login')
 def add_exp(request):
-	if request.method == 'POST':
-		experiment = Experiment()
+	if user_authorized(request):
+		if request.method == 'POST':
+			experiment = Experiment()
+			experiment.name = request.POST['exp_name']
+			experiment.task_count = request.POST['exp_taskcount']
+			experiment.task_length = request.POST['exp_tasklength']
+			experiment.has_achievements = request.POST.get('exp_achievements', False)
+			experiment.has_intake = request.POST.get('exp_intake', False)
+			experiment.has_followup = request.POST.get('exp_followup', False)
+			experiment.consent = request.POST.get('exp_consent', False)
+			experiment.sequential_tasks = request.POST.get('exp_sequentialtasks', False)
+			experiment.show_progress = request.POST.get('exp_progress', False)
+			experiment.timed = request.POST.get('exp_timed', False)
+
+			experiment.save()
+			return redirect('exp_portal:manage_exps')
+
+		return render(request, 'add_experiment.html')
+
+
+@login_required(login_url='/tasking/login')
+def edit_exp(request, exppk):
+	if user_authorized(request):
+		experiment = Experiment.objects.get(id=exppk)
 		experiment.name = request.POST['exp_name']
 		experiment.task_count = request.POST['exp_taskcount']
 		experiment.task_length = request.POST['exp_tasklength']
@@ -81,100 +110,84 @@
 		experiment.save()
 		return redirect('exp_portal:manage_exps')
 
-	return render(request, 'add_experiment.html')
-
-
-@login_required(login_url='/tasking/login')
-def edit_exp(request, exppk):
-	experiment = Experiment.objects.get(id=exppk)
-	experiment.name = request.POST['exp_name']
-	experiment.task_count = request.POST['exp_taskcount']
-	experiment.task_length = request.POST['exp_tasklength']
-	experiment.has_achievements = request.POST.get('exp_achievements', False)
-	experiment.has_intake = request.POST.get('exp_intake', False)
-	experiment.has_followup = request.POST.get('exp_followup', False)
-	experiment.consent = request.POST.get('exp_consent', False)
-	experiment.sequential_tasks = request.POST.get('exp_sequentialtasks', False)
-	experiment.show_progress = request.POST.get('exp_progress', False)
-	experiment.timed = request.POST.get('exp_timed', False)
-
-	experiment.save()
-
-	return redirect('exp_portal:manage_exps')
-
 
 @login_required(login_url='/tasking/login')
 def manage_datasets(request):
-	datasets = Dataset.objects.all()
-	return render(request, 'datasets.html', {'datasets':datasets})
+	if user_authorized(request):
+		datasets = Dataset.objects.all()
+		return render(request, 'datasets.html', {'datasets':datasets})
 
 
 @login_required(login_url='/tasking/login')
 def view_dataset_details(request, datasetpk):
-	dataset = Dataset.objects.get(id=datasetpk)
-	return render(request, 'dataset_details.html', {'dataset':dataset})
+	if user_authorized(request):
+		dataset = Dataset.objects.get(id=datasetpk)
+		return render(request, 'dataset_details.html', {'dataset':dataset})
 
 
 @login_required(login_url='/tasking/login')
 def add_dataset(request):
-	if request.method == 'POST':
-		# do update
-		dataset = Dataset()
+	if user_authorized(request):
+		if request.method == 'POST':
+			# do update
+			dataset = Dataset()
+			dataset.name = request.POST['dataset_name']
+			dataset.version = request.POST['dataset_version']
+			dataset.is_active = request.POST.get('dataset_active', False)
+
+			dataset.save()
+			return redirect('exp_portal:manage_datasets')
+		# else fall here
+		return render(request, 'add_dataset.html')
+
+
+@login_required(login_url='/tasking/login')
+def edit_dataset(request, datasetpk):
+	if user_authorized(request):
+		dataset = Dataset.objects.get(id=datasetpk)
 		dataset.name = request.POST['dataset_name']
 		dataset.version = request.POST['dataset_version']
 		dataset.is_active = request.POST.get('dataset_active', False)
 
 		dataset.save()
+
 		return redirect('exp_portal:manage_datasets')
-	# else fall here
-	return render(request, 'add_dataset.html')
-
-
-@login_required(login_url='/tasking/login')
-def edit_dataset(request, datasetpk):
-	dataset = Dataset.objects.get(id=datasetpk)
-	dataset.name = request.POST['dataset_name']
-	dataset.version = request.POST['dataset_version']
-	dataset.is_active = request.POST.get('dataset_active', False)
-
-	dataset.save()
-
-	return redirect('exp_portal:manage_datasets')
 
 
 @login_required(login_url='/tasking/login')
 def view_experiment_products(request):
-	experiments = Experiment.objects.all()
-	masterList = {}
-	for experiment in experiments:
-		name = experiment.name
-		userprofiles = experiment.userprofile_set.all()
-		usp = sorted(userprofiles)
-		products = []
-		tasks = []
-		completedTasks = []
-		incompleteTasks = []
-		experimentList = {}
-		for userprofile in userprofiles:
-			tasklistitems = userprofile.tasklistitem_set.all()
-			for tasklistitem in tasklistitems:
-				products.append(tasklistitem.product)
-				tasks.append(tasklistitem.op_task)
-				if tasklistitem.task_complete is True:
-					completedTasks.append(tasklistitem)
-				else:
-					incompleteTasks.append(tasklistitem)
-		percentageComplete = int((len(completedTasks) / float(len(completedTasks) + len(incompleteTasks))) * 100)
-		sortedProd = sorted(set(products))
-		sortedTasks = sorted(set(tasks))
-		sortedCompletedTasks = sorted(completedTasks)
-		sortedIncompleteTasks = sorted(incompleteTasks)
-		experimentList["users"] = usp
-		experimentList["products"] = sortedProd
-		experimentList["tasks"] = sortedTasks
-		experimentList["completedTasks"] = sortedCompletedTasks
-		experimentList["incompleteTasks"] = sortedIncompleteTasks
-		experimentList["percentageComplete"] = percentageComplete
-		masterList[name] = experimentList
-	response = JsonResponse({'experimentInfo': str(masterList)})
-	return response
\ No newline at end of file
+	if user_authorized(request):
+		experiments = Experiment.objects.all()
+		masterList = {}
+		for experiment in experiments:
+			name = experiment.name
+			userprofiles = experiment.userprofile_set.all()
+			usp = sorted(userprofiles)
+			products = []
+			tasks = []
+			completedTasks = []
+			incompleteTasks = []
+			experimentList = {}
+			for userprofile in userprofiles:
+				tasklistitems = userprofile.tasklistitem_set.all()
+				for tasklistitem in tasklistitems:
+					products.append(tasklistitem.product)
+					tasks.append(tasklistitem.op_task)
+					if tasklistitem.task_complete is True:
+						completedTasks.append(tasklistitem)
+					else:
+						incompleteTasks.append(tasklistitem)
+			percentageComplete = int((len(completedTasks) / float(len(completedTasks) + len(incompleteTasks))) * 100)
+			sortedProd = sorted(set(products))
+			sortedTasks = sorted(set(tasks))
+			sortedCompletedTasks = sorted(completedTasks)
+			sortedIncompleteTasks = sorted(incompleteTasks)
+			experimentList["users"] = usp
+			experimentList["products"] = sortedProd
+			experimentList["tasks"] = sortedTasks
+			experimentList["completedTasks"] = sortedCompletedTasks
+			experimentList["incompleteTasks"] = sortedIncompleteTasks
+			experimentList["percentageComplete"] = percentageComplete
+			masterList[name] = experimentList
+		response = JsonResponse({'experimentInfo': str(masterList)})
+		return response
\ No newline at end of file
diff --git a/op_tasks/achievements.py b/op_tasks/achievements.py
new file mode 100644
index 0000000..bb43016
--- /dev/null
+++ b/op_tasks/achievements.py
@@ -0,0 +1,108 @@
+from django.core.exceptions import ObjectDoesNotExist
+from op_tasks.models import UserAchievement, Achievement
+
+
+def checkAchievements(request):
+    user = request.user
+
+    tasksComplete(user)
+    genTaskAccuracy(user)
+    devTaskAccuracy(user)
+    genTaskAccuracy(user)
+    referralsOne(user)
+    referralsTwo(user)
+    referralsThree(user)
+    referralsFour(user)
+
+
+def tasksComplete(user):
+    return True
+
+
+def genTaskAccuracy(user):
+    award = False
+    userprofile = user.userprofile
+    genAccuracyAchivement = Achievement.objects.get(name='genTaskAccuracy')
+
+    try:
+        userAchievement = UserAchievement.objects.get(userprofile=userprofile, achievement=genAccuracyAchivement)
+    except ObjectDoesNotExist:
+        if userprofile.bestDevAccuracy > 89:
+            userAchievement = UserAchievement(userprofile=userprofile, achievement=genAccuracyAchivement)
+            userAchievement.save()
+            award=True
+    return award
+
+
+def devTaskAccuracy(user):
+    award = False
+    userprofile = user.userprofile
+    devAccuracyAchivement = Achievement.objects.get(name='devTaskAccuracy')
+
+    try:
+        userAchievement = UserAchievement.objects.get(userprofile=userprofile, achievement=devAccuracyAchivement)
+    except ObjectDoesNotExist:
+        if userprofile.bestDevAccuracy > 89:
+            userAchievement = UserAchievement(userprofile=userprofile, achievement=devAccuracyAchivement)
+            userAchievement.save()
+            award=True
+    return award
+
+
+def referralsOne(user):
+    """
+    checks referrals in userprofile to see if a certain level is met
+    :param user: the user object to check
+    :return: boolean, true if condition met, false otherwise
+    """
+    return referralsCheck(user, 3, 'referralsOne')
+
+
+def referralsTwo(user):
+    """
+    checks referrals in userprofile to see if level two is met
+    :param user: the user object to check
+    :return: award - boolean, true if condition met, false otherwise
+    """
+    return referralsCheck(user, 6, 'referralsTwo')
+
+
+def referralsThree(user):
+    """
+
+    :param user:
+    :return:
+    """
+    return referralsCheck(user, 9, 'referralsThree')
+
+
+def referralsFour(user):
+    """
+
+    :param user:
+    :return:
+    """
+    return referralsCheck(user, 12, 'referralsFour')
+
+
+def referralsCheck(user, count, achievementName):
+    """
+    general method to check different levels of referrals
+    :param user: the user object to check
+    :param count: the level to check
+    :param achievementName: the name of the achievement
+    :return: boolean - true if level met, false otherwise
+    """
+    award = False
+    userprofile = user.userprofile
+    referralsAchievement = Achievement.objects.get(name=achievementName)
+
+    # first check if user already has achievement
+    try:
+        userAchievement = UserAchievement.objects.get(userprofile=userprofile, achievement=referralsAchievement)
+    except ObjectDoesNotExist:
+        if userprofile.referrals >= count :
+            userAchievement = UserAchievement(userprofile=userprofile, achievement=referralsAchievement)
+            userAchievement.save()
+            award = True
+    return award
\ No newline at end of file
diff --git a/op_tasks/models.py b/op_tasks/models.py
index cd9bd9d..af2dece 100755
--- a/op_tasks/models.py
+++ b/op_tasks/models.py
@@ -3,21 +3,26 @@
 import hashlib
 import time, datetime
 
+
 def _createHash():
     hash = hashlib.sha1()
     hash.update(str(time.time()))
     return hash.hexdigest()[:-10]
 
+
 # the dataset class stores parameters about the 
 class Dataset(models.Model):
     name = models.CharField(max_length=255) # name of dataset
     version = models.CharField(max_length=10)
     is_active = models.BooleanField(default=True)
+
     def __unicode__(self):  # Python 3: def __str__(self):
         return '%s - %s' % (self.name, self.version)
+
     class Meta:
         unique_together = ("name", "version")
 
+
 class Product(models.Model): # product = tool + dataset
     dataset = models.ForeignKey(Dataset, null=True, blank=True) # data for tool
     url = models.CharField(max_length=255, unique=False) # path to product 
@@ -26,10 +31,11 @@
     name = models.CharField(max_length=255) # name of 
     version = models.CharField(max_length=10)
     is_active = models.BooleanField(default=True)
-    instructions = models.CharField(max_length=255) 
+    instructions = models.CharField(max_length=255)
     def __unicode__(self):  # Python 3: def __str__(self):
         return '%s:%s:%s:%s' % (self.team, self.name, self.dataset, self.version)
 
+
 class OpTask(models.Model):
     dataset = models.ForeignKey(Dataset, null=True, blank=True)
     name = models.CharField(max_length=200)
@@ -41,6 +47,7 @@
     def __unicode__(self):  # Python 3: def __str__(self):
         return '%s-%s' % (self.name, self.dataset)
 
+
 class Experiment(models.Model):
     name = models.CharField(max_length=250)  # name of the experiment
     task_count = models.IntegerField(default=0)  
@@ -60,6 +67,7 @@
     def __unicode__(self):
         return '%s' % (self.name)
 
+
 class UserProfile(models.Model):
     user = models.OneToOneField(User)
     user_hash = models.CharField(max_length=30, default=_createHash, unique=True, editable=False)
@@ -70,6 +78,10 @@
     portal_inst_complete = models.BooleanField(default=False)
     task_inst_complete = models.BooleanField(default=False)
     experiment = models.ForeignKey(Experiment, null=True, blank=True)
+    referrals = models.IntegerField(default=0)
+    bestGenAccuracy = models.IntegerField(default=0)
+    bestDevAccuracy = models.IntegerField(default=0)
+
 
     def __unicode__(self):
         return self.user.username
@@ -108,3 +120,19 @@
     class Meta:
         ordering = ('userprofile', 'index')
     # index = models.IntegerField()
+
+
+class Achievement(models.Model):
+    name = models.CharField(max_length=50)
+    desc = models.CharField(max_length=1000)
+
+    def __unicode__(self):
+        return '%s' % (self.name)
+
+
+class UserAchievement(models.Model):
+    userprofile = models.ForeignKey(UserProfile)
+    achievement = models.ForeignKey(Achievement)
+
+    def __unicode__(self):
+        return '%s - %s' % (self.userprofile.user.username, self.achievement.name)
\ No newline at end of file
diff --git a/op_tasks/tests.py b/op_tasks/tests.py
index 15743f9..55c94dd 100755
--- a/op_tasks/tests.py
+++ b/op_tasks/tests.py
@@ -1,9 +1,12 @@
-from django.core.urlresolvers import resolve
 from django.test import TestCase
 from django.contrib.auth.models import User 
 from django.contrib.auth.hashers import make_password
+from django.core.exceptions import ObjectDoesNotExist
 
-from op_tasks.models import Dataset, Product, OpTask, UserProfile, TaskListItem, Experiment
+from op_tasks.models import Dataset, \
+	Product, OpTask, UserProfile, TaskListItem, Experiment, Achievement, UserAchievement
+
+import achievements
 
 # Create your tests here.
 
@@ -12,6 +15,7 @@
 # 	def test_bad_math(self):
 # 		self.assertEqual(1+1,3)
 
+
 class ModelTest(TestCase):
 
 	def test_user_can_be_assigned_an_experiment(self):
@@ -49,6 +53,7 @@
 		dataset = Dataset()
 		dataset.version = '1'
 		dataset.name = 'test'
+		dataset.save()
 
 		product = Product()
 		product.dataset = dataset
@@ -197,9 +202,15 @@
 		testtask2 = OpTask(dataset=testdata, name='task2')
 		testtask2.save()
 
-		test_tli_1 = TaskListItem(userprofile=userprofile1, product=testproduct, op_task=testtask1, index=0)
+		test_tli_1 = TaskListItem(userprofile=userprofile1,
+								  product=testproduct,
+								  op_task=testtask1,
+								  index=0)
 		test_tli_1.save()
-		test_tli_2 = TaskListItem(userprofile=userprofile1, product=testproduct, op_task=testtask2, index=1)
+		test_tli_2 = TaskListItem(userprofile=userprofile1,
+								  product=testproduct,
+								  op_task=testtask2,
+								  index=1)
 		test_tli_2.save()
 
 		test_tlis = TaskListItem.objects.all()
@@ -212,4 +223,82 @@
 			if userprofile.user.username == 'John':
 				self.assertEqual(matched_task_items.count(),2)
 			else:
-				self.assertEqual(matched_task_items.count(),0)
\ No newline at end of file
+				self.assertEqual(matched_task_items.count(),0)
+
+	def test_can_assign_user_achievements(self):
+		# create a bunch of users
+		user = User(username='John', password=make_password('John'))
+		user.save()
+		userprofile = UserProfile(user=user)
+		userprofile.save()
+
+		userTwo = User(username='Paul', password=make_password('Paul'))
+		userTwo.save()
+		userprofileTwo = UserProfile(user=userTwo)
+		userprofileTwo.save()
+
+		achievement = Achievement(name='One')
+		achievement.save()
+
+		achievement2 = Achievement(name='Two')
+		achievement2.save()
+
+		userachievement = UserAchievement()
+		userachievement.achievement = achievement
+		userachievement.userprofile = userprofile
+		userachievement.save()
+
+		userachievementTwo = UserAchievement()
+		userachievementTwo.userprofile = userprofileTwo
+		userachievementTwo.achievement = Achievement.objects.get(name='One')
+		userachievementTwo.save()
+
+		saved_achievements = Achievement.objects.all()
+		self.assertEqual(saved_achievements.count(), 2)
+
+		saved_userachievements = UserAchievement.objects.all()
+		self.assertEqual(saved_userachievements.count(), 2)
+
+		for saved_userachievement in saved_userachievements:
+			if saved_userachievement.userprofile.user.username == 'Paul':
+				self.assertEqual(saved_userachievement.achievement.name, 'One')
+
+		try:
+			johnAchievement = UserAchievement.objects.get(userprofile=userprofile, achievement=achievement2)
+			self.assertEqual(johnAchievement.userprofile, userprofile)
+		except ObjectDoesNotExist:
+			print 'object does not exist'
+			johnAchievements = UserAchievement.objects.get(userprofile=userprofile)
+			print johnAchievements
+
+
+	def test_can_check_achievement_conditions(self):
+		user = User(username='John', password=make_password('John'))
+		user.save()
+		userprofile = UserProfile(user=user)
+		userprofile.referrals = 3
+		userprofile.save()
+
+		achievement1 = Achievement(name='referralsOne')
+		achievement1.save()
+		achievement2 = Achievement(name='referralsTwo')
+		achievement2.save()
+		achievement3 = Achievement(name='referralsThree')
+		achievement3.save()
+
+		self.assertEqual(achievements.referralsOne(user), True)
+
+		userprofile.referrals = 6
+		userprofile.save()
+
+		self.assertEqual(achievements.referralsTwo(user), True)
+
+		userprofile.referrals = 9
+		userprofile.save()
+
+		self.assertEqual(achievements.referralsThree(user), True)
+
+		johnsAchievements = UserAchievement.objects.filter(userprofile=userprofile)
+		self.assertEqual(3, johnsAchievements.count())
+
+
diff --git a/op_tasks/views.py b/op_tasks/views.py
index 6d7af89..3d0a3e7 100755
--- a/op_tasks/views.py
+++ b/op_tasks/views.py
@@ -9,10 +9,11 @@
 from django.contrib.auth.models import User
 from django.utils import timezone
 from elasticsearch import Elasticsearch
-
+import achievements
 import exp_portal
 import datetime
 
+
 from op_tasks.models import Product, UserProfile, TaskListItem, Experiment
 
 import exceptions
@@ -166,8 +167,7 @@
 
 # cretaes a new user and assigns tasks 
 def register(request):
-    logging.basicConfig(filename='/home/ubuntu/logs/log.txt', level=logging.DEBUG, format='%(asctime)s - %(levelname)s - %(message)s')
-    logger.debug("Logging is working.")
+    # TODO : add logging back in.  Good practice!!
     # Like before, get the request's context.
     context = RequestContext(request)
 
@@ -197,7 +197,6 @@
 
         # Now we save the UserProfile model instance.
         userprofile.save()
-        logger.debug("Saved the user profile successfully")
 
         # Finally we assign tasks to the new user
         # Get a random product, get a random order of tasks
diff --git a/static/css/styles.css b/static/css/styles.css
index 61a79e7..d68eb76 100644
--- a/static/css/styles.css
+++ b/static/css/styles.css
@@ -417,16 +417,21 @@
           }
 
           .trayTableBody {
-            padding: 18px 2%;
+            margin: 0;
+            padding: 0;
             max-height: 410px;
             overflow: auto;
           }
 
           .trayTableBody li {
-            margin-bottom: 20px;
+            padding: 12px 2%;
             width: 100%;
           }
 
+            .trayTableBody li:nth-child(even) {
+              background: #555;
+            } 
+
           .trayTableBody>li>div {
             float: left;
           }
diff --git a/uploads/views.py b/uploads/views.py
index a75fea1..dbbc93d 100644
--- a/uploads/views.py
+++ b/uploads/views.py
@@ -3,10 +3,8 @@
 from django.http import HttpResponseRedirect
 from django.core.urlresolvers import reverse
 from django.contrib.auth.decorators import login_required
-
 import pandas
 import numpy as np
-
 import os
 
 from models import Document
@@ -29,6 +27,7 @@
         # Render list page with the documents and the form
         return render(request, 'expuploads.html', {'form': form, 'experiments': experiments})
 
+
 def handle_uploaded_file(f, dirname):
     path = os.path.join('../static/results', dirname)
     try:
diff --git a/xdata/settings.py b/xdata/settings.py
index e0f9969..fc3530d 100755
--- a/xdata/settings.py
+++ b/xdata/settings.py
@@ -26,6 +26,8 @@
 
 TEMPLATE_DEBUG = True
 
+ADMINS = ADMIN_EMAILS
+
 ALLOWED_HOSTS = ['*']
 
 SITE_ROOT = os.path.realpath(os.path.dirname(__file__))
@@ -74,31 +76,22 @@
 # https://docs.djangoproject.com/en/1.6/ref/settings/#databases
 
 DATABASES = {
-#    'default': {
-#        'ENGINE': 'django.db.backends.sqlite3',
-#        'NAME': os.path.join(BASE_DIR, '../db', 'db.sqlite3'),
-#    }
-#
-#    'default': {
-#        'ENGINE': 'django.db.backends.postgresql_psycopg2',
-#        'NAME': 'xdatadb',
-#        'USER': 'xdatauser',
-#        'PASSWORD': 'xd@t@!',
-#        'HOST': '127.0.0.1',
-#        'PORT': '',
-#    }
-#
-    'default': {
-        'ENGINE': 'django.db.backends.mysql', 
-#        'ENGINE': 'mysql.connector.django', 
-        'NAME': 'xdatadb',
-        'USER': 'xdatauser',
-        'PASSWORD': 'Dr@perUs3r!',
-        'HOST': 'localhost', #'127.0.0.1',   # Or an IP Address that your DB is hosted on
-        'PORT': '3306',
-    }
+   'default': {
+       'ENGINE': 'django.db.backends.sqlite3',
+       'NAME': os.path.join(BASE_DIR, '../db', 'db.sqlite3'),
+   }
+
+    # 'default': {
+    #     'ENGINE': 'django.db.backends.mysql',
+    #     'NAME': 'xdatadb',
+    #     'USER': 'xdatauser',
+    #     'PASSWORD': 'Dr@perUs3r!',
+    #     'HOST': 'localhost', #'127.0.0.1',   # Or an IP Address that your DB is hosted on
+    #     'PORT': '3306',
+    # }
 }
 
+
 # Internationalization
 # https://docs.djangoproject.com/en/1.6/topics/i18n/
 
@@ -127,7 +120,7 @@
 MEDIA_ROOT = os.path.join(BASE_DIR, 'media')
 MEDIA_URL = '/media/'
 
-LOGIN_URL = '/login/'
+LOGIN_URL = '/tasking/login'
 
 CRISPY_TEMPLATE_PACK = 'bootstrap3'