diff --git a/src/routes/aliases.js b/src/routes/aliases.js
index 76b99af..d504216 100644
--- a/src/routes/aliases.js
+++ b/src/routes/aliases.js
@@ -3,13 +3,14 @@ const router = express.Router();
 const Aliases = require('../controllers/aliases');
 const Pages = require('../controllers/pages');
 const Alias = require('../models/alias');
+const verifyToken = require('./middlewares/token');
 
 /**
  * GET /*
  *
  * Return document with given alias
  */
-router.get('*', async (req, res) => {
+router.get('*', verifyToken, async (req, res) => {
   try {
     const alias = await Aliases.get(req.originalUrl.slice(1)); // Cuts first '/' character
 
diff --git a/src/routes/auth.js b/src/routes/auth.js
index 5ba1b0a..795cc8c 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -28,6 +28,14 @@ router.get('/auth', csrfProtection, function (req, res) {
 router.post('/auth', parseForm, csrfProtection, async (req, res) => {
   let userDoc = await Users.get();
 
+  if (!userDoc) {
+    res.render('auth', {
+      title: 'Login page',
+      header: 'Password not set',
+      csrfToken: req.csrfToken()
+    });
+  }
+
   const passHash = userDoc.passHash;
 
   bcrypt.compare(req.body.password, passHash, async (err, result) => {
diff --git a/src/routes/middlewares/token.js b/src/routes/middlewares/token.js
index 851b763..220a972 100644
--- a/src/routes/middlewares/token.js
+++ b/src/routes/middlewares/token.js
@@ -15,7 +15,7 @@ module.exports = async function verifyToken(req, res, next) {
 
   if (!userDoc) {
     res.locals.isAuthorized = false;
-    next()
+    next();
   }
 
   jwt.verify(token, userDoc.passHash + config.secret, (err, decodedToken) => {