diff --git a/app/rest/api/rest_private_test.go b/app/rest/api/rest_private_test.go
index e310b994..d7dbd6f4 100644
--- a/app/rest/api/rest_private_test.go
+++ b/app/rest/api/rest_private_test.go
@@ -86,9 +86,33 @@ func TestRest_CreateTooBig(t *testing.T) {
 	c := JSON{}
 	err = json.Unmarshal(b, &c)
 	assert.Nil(t, err)
-
 	assert.Equal(t, "comment text exceeded max allowed size 4000 (4001)", c["error"])
 	assert.Equal(t, "invalid comment", c["details"])
+
+	veryLongComment := fmt.Sprintf(`{"text": "%70000s", "locator":{"url": "https://radio-t.com/blah1", "site": "radio-t"}}`, "Щ")
+	resp, err = post(t, ts.URL+"/api/v1/comment", veryLongComment)
+	assert.Nil(t, err)
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	b, err = ioutil.ReadAll(resp.Body)
+	assert.Nil(t, err)
+	c = JSON{}
+	err = json.Unmarshal(b, &c)
+	assert.Nil(t, err)
+	assert.Equal(t, "http: request body too large", c["error"])
+	assert.Equal(t, "can't bind comment", c["details"])
+}
+
+func TestRest_CreateRejected(t *testing.T) {
+
+	srv, ts := prep(t)
+	require.NotNil(t, srv)
+	defer cleanup(ts)
+	body := `{"text": "test 123", "locator":{"url": "https://radio-t.com/blah1", "site": "radio-t"}}`
+
+	// try to create without auth
+	resp, err := http.Post(ts.URL+"/api/v1/comment", "", strings.NewReader(body))
+	assert.Nil(t, err)
+	assert.Equal(t, 401, resp.StatusCode)
 }
 func TestRest_CreateAndGet(t *testing.T) {
 	srv, ts := prep(t)
diff --git a/app/rest/api/rss.go b/app/rest/api/rss.go
index 7ea5fd77..2a44f753 100644
--- a/app/rest/api/rss.go
+++ b/app/rest/api/rss.go
@@ -29,11 +29,10 @@ func (s *Rest) rssRoutes() chi.Router {
 // GET /rss/post?site=siteID&url=post-url
 func (s *Rest) rssPostCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
-	sort := "-time"
 	log.Printf("[DEBUG] get rss for post %+v", locator)
 
 	data, err := s.Cache.Get(cache.Key(cache.URLKey(r), locator.SiteID, locator.URL), func() ([]byte, error) {
-		comments, e := s.DataService.Find(locator, sort)
+		comments, e := s.DataService.Find(locator, "-time")
 		if e != nil {
 			return nil, e
 		}
diff --git a/app/store/user.go b/app/store/user.go
index 60ea63b5..cd725f82 100644
--- a/app/store/user.go
+++ b/app/store/user.go
@@ -35,7 +35,9 @@ func HashValue(val string, secret string) string {
 	key := []byte(secret)
 	h := hmac.New(sha1.New, key)
 	if _, err := h.Write([]byte(val)); err != nil {
+		// fail back to crc64
 		log.Printf("[WARN] can't hash ip, %s", err)
+		return fmt.Sprintf("%x", crc64.Checksum([]byte(val), crc64.MakeTable(crc64.ECMA)))
 	}
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
@@ -43,6 +45,9 @@ func HashValue(val string, secret string) string {
 // EncodeID hashes id to sha1. The function intentionally left outside of User struct because in some cases
 // we need hashing for parts of id, in some others hashing for non-User values.
 func EncodeID(id string) string {
+	if reValidSha.Match([]byte(id)) {
+		return id // already hashed or empty
+	}
 	h := sha1.New()
 	if _, err := h.Write([]byte(id)); err != nil {
 		// fail back to crc64
diff --git a/app/store/user_test.go b/app/store/user_test.go
index fab2be6a..63f49f60 100644
--- a/app/store/user_test.go
+++ b/app/store/user_test.go
@@ -14,6 +14,7 @@ func TestUser_EncodeID(t *testing.T) {
 		{"myid", "6e34471f84557e1713012d64a7477c71bfdac631"},
 		{"", "da39a3ee5e6b4b0d3255bfef95601890afd80709"},
 		{"blah blah", "135a1e01bae742c4a576b20fd41a683f6483ca43"},
+		{"da39a3ee5e6b4b0d3255bfef95601890afd80709", "da39a3ee5e6b4b0d3255bfef95601890afd80709"},
 	}
 
 	for i, tt := range tbl {