--- a/pvl/login/server.py	Mon Jan 13 17:44:18 2014 +0200
+++ b/pvl/login/server.py	Mon Jan 13 17:44:45 2014 +0200
@@ -140,9 +140,7 @@
         valid = pubtkt.valid()
         grace = pubtkt.grace()
 
-        if valid and grace :
-            return 'success'
-        elif valid and grace is False :
+        if grace :
             return 'warning'
         elif valid :
             return 'success'
@@ -159,11 +157,8 @@
         valid = pubtkt.valid()
         grace = pubtkt.grace()
 
-        if valid and grace :
-            valid = "{grace} ({valid})".format(valid=self.render_valid(valid), grace=self.render_valid(grace))
-            valid_status = 'success'
-        elif valid and grace is False :
-            valid = "Renewable ({valid})".format(valid=self.render_valid(valid))
+        if grace :
+            valid = "{grace} (Renew)".format(grace=self.render_valid(grace))
             valid_status = 'warning'
         elif valid :
             valid = "{valid}".format(valid=self.render_valid(valid))
@@ -247,6 +242,9 @@
             self.process_back()
         except pubtkt.Error as ex :
             self.alert('danger', ex)
+            
+        # update cookie?
+        set_pubtkt = None
 
         if self.request.method == 'POST' :
             username = self.request.form.get('username')
@@ -257,21 +255,26 @@
                 username = username.strip().lower()
                 
                 try :
-                    self.pubtkt = self.app.auth(username, password)
+                    set_pubtkt = self.app.auth(username, password)
 
                 except pubtkt.Error as ex :
                     self.auth_errors = ex
             
             elif self.pubtkt and self.pubtkt.valid() :
-                # renew
-                self.app.renew(self.pubtkt)
+                # renew manually if valid
+                set_pubtkt = self.app.renew(self.pubtkt)
 
-            else :
-                return
-
+        elif 'renew' in self.request.args :
+            # renew automatically if in grace period
+            if self.pubtkt and self.pubtkt.grace() :
+                set_pubtkt = self.app.renew(self.pubtkt)
+            
+        if set_pubtkt :
             # browsers seem to be very particular about quoting ;'s in cookie values...
             # this follows PHP's setcookie() encoding...
-            cookie = werkzeug.urls.url_quote(self.app.sign(self.pubtkt))
+            cookie = werkzeug.urls.url_quote(self.app.sign(set_pubtkt))
+            
+            self.pubtkt = set_pubtkt
 
             # redirect with cookie
             response = pvl.web.response.redirect(self.back)
@@ -284,6 +287,7 @@
 
             return response
 
+
     def render (self) :
         if self.pubtkt :
             username = self.pubtkt.uid
@@ -295,6 +299,15 @@
         if 'logout' in self.request.args :
             self.alert('info', "You have been logged out.")
 
+        if self.pubtkt and self.pubtkt.valid() :
+            renew = True
+
+            # within validity period...
+            self.alert('info', "Login or renew ticket.")
+
+        else :
+            renew = False
+
         return html.div(class_='container')(
             html.form(action=self.url(back=self.back), method='POST', id='login')(
                 (
@@ -320,10 +333,12 @@
                         ),
 
                         html.label(for_='password', class_='sr-only')("Password"),
-                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=True),
+                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=(not renew)),
                     ),
 
                     html.button(type='submit', class_='btn btn-primary')("Login"),
+
+                    html.button(type='submit', class_='btn btn-success')("Rewnew") if renew else None,
                 )
             )
         )
@@ -429,5 +444,8 @@
         """
             Renew and re-sign the given pubtkt.
         """
+    
+        # XXX: inplace
+        pubtkt.renew(self.login_valid, self.login_grace)
 
-        pubtkt.renew(self.login_valid, self.login_grace)
+        return pubtkt