diff --git a/xs_httpd.h b/xs_httpd.h
index 3eacc5f..85ab67a 100644
--- a/xs_httpd.h
+++ b/xs_httpd.h
@@ -4,15 +4,15 @@
 
 #define _XS_HTTPD_H
 
-xs_str *xs_url_dec(char *str);
-xs_dict *xs_url_vars(char *str);
+xs_str *xs_url_dec(const char *str);
+xs_dict *xs_url_vars(const char *str);
 xs_dict *xs_httpd_request(FILE *f, xs_str **payload, int *p_size);
 void xs_httpd_response(FILE *f, int status, xs_dict *headers, xs_str *body, int b_size);
 
 
 #ifdef XS_IMPLEMENTATION
 
-xs_str *xs_url_dec(char *str)
+xs_str *xs_url_dec(const char *str)
 /* decodes an URL */
 {
     xs_str *s = xs_str_new(NULL);
@@ -41,7 +41,7 @@ xs_str *xs_url_dec(char *str)
 }
 
 
-xs_dict *xs_url_vars(char *str)
+xs_dict *xs_url_vars(const char *str)
 /* parse url variables */
 {
     xs_dict *vars;
@@ -59,9 +59,34 @@ xs_dict *xs_url_vars(char *str)
         while (xs_list_iter(&l, &v)) {
             xs *kv = xs_split_n(v, "=", 2);
 
-            if (xs_list_len(kv) == 2)
-                vars = xs_dict_append(vars,
-                    xs_list_get(kv, 0), xs_list_get(kv, 1));
+            if (xs_list_len(kv) == 2) {
+                const char *key = xs_list_get(kv, 0);
+                const char *pv  = xs_dict_get(vars, key);
+
+                if (!xs_is_null(pv)) {
+                    /* there is a previous value: convert to a list and append */
+                    xs *vlist = NULL;
+                    if (xs_type(pv) == XSTYPE_LIST)
+                        vlist = xs_dup(pv);
+                    else {
+                        vlist = xs_list_new();
+                        vlist = xs_list_append(vlist, pv);
+                    }
+
+                    vlist = xs_list_append(vlist, xs_list_get(kv, 1));
+                    vars  = xs_dict_set(vars, key, vlist);
+                }
+                else {
+                    /* ends with []? force to always be a list */
+                    if (xs_endswith(key, "[]")) {
+                        xs *vlist = xs_list_new();
+                        vlist = xs_list_append(vlist, xs_list_get(kv, 1));
+                        vars = xs_dict_append(vars, key, vlist);
+                    }
+                    else
+                        vars = xs_dict_append(vars, key, xs_list_get(kv, 1));
+                }
+            }
         }
     }
 
diff --git a/xs_openssl.h b/xs_openssl.h
index eef57ed..4a86046 100644
--- a/xs_openssl.h
+++ b/xs_openssl.h
@@ -22,6 +22,64 @@ int xs_evp_verify(const char *pubkey, const char *mem, int size, const char *b64
 #include "openssl/pem.h"
 #include "openssl/evp.h"
 
+#if 0
+xs_str *xs_base64_enc(const xs_val *data, int sz)
+/* encodes data to base64 */
+{
+    BIO *mem, *b64;
+    BUF_MEM *bptr;
+ 
+    b64 = BIO_new(BIO_f_base64());
+    mem = BIO_new(BIO_s_mem());
+    b64 = BIO_push(b64, mem);
+
+    BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
+
+    BIO_write(b64, data, sz);
+    BIO_flush(b64);
+    BIO_get_mem_ptr(b64, &bptr);
+
+    int n = bptr->length;
+    xs_str *s = xs_realloc(NULL, _xs_blk_size(n + 1));
+
+    memcpy(s, bptr->data, n);
+    s[n] = '\0';
+
+    BIO_free_all(b64);
+
+    return s;
+}
+
+
+xs_val *xs_base64_dec(const xs_str *data, int *size)
+/* decodes data from base64 */
+{
+    BIO *b64, *mem;
+
+    *size = strlen(data);
+
+    b64 = BIO_new(BIO_f_base64());
+    mem = BIO_new_mem_buf(data, *size);
+    b64 = BIO_push(b64, mem);
+
+    BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
+
+    /* alloc a very big buffer */
+    xs_str *s = xs_realloc(NULL, *size);
+
+    *size = BIO_read(b64, s, *size);
+
+    /* adjust to current size */
+    s = xs_realloc(s, _xs_blk_size(*size + 1));
+    s[*size] = '\0';
+
+    BIO_free_all(mem);
+
+    return s;
+}
+#endif
+
+
 xs_str *_xs_digest(const xs_val *input, int size, const char *digest, int as_hex)
 /* generic function for generating and encoding digests */
 {
diff --git a/xs_version.h b/xs_version.h
index d2b2069..4c842e3 100644
--- a/xs_version.h
+++ b/xs_version.h
@@ -1 +1 @@
-/* 01bea7d4a0e631c0406b358dda9cc9409362c003 */
+/* 333e84c76cd0e51f9f98a36df2eb3bf81e0d2608 */