diff --git a/web-ui/crate/src/logic.rs b/web-ui/crate/src/logic.rs
index a71f142..fddbabc 100644
--- a/web-ui/crate/src/logic.rs
+++ b/web-ui/crate/src/logic.rs
@@ -2,13 +2,11 @@ use crate::{
     api,
     state::{Action, Claims, Room, WebUiDispatcher},
 };
-use jsonwebtoken::{
-    dangerous_insecure_decode_with_validation as decode_without_verify, Validation,
-};
+use jsonwebtoken::dangerous_insecure_decode;
 
 pub(crate) type LogicResult = Result<Vec<Action>, Action>;
 
-trait LogicResultExt {
+pub(crate) trait LogicResultExt {
     /// Consumes self into the vec of Actions to apply to state,
     /// either the list of successful actions, or a list containing
     /// the error action.
@@ -36,8 +34,7 @@ async fn ensure_jwt(dispatch: &WebUiDispatcher) -> Result<(String, Option<Action
     //TODO lots of clones here. can we avoid?
     use jsonwebtoken::errors::ErrorKind;
     let token = dispatch.state().jwt_token.as_deref().unwrap_or_default();
-    let validation: Result<Claims, _> =
-        decode_without_verify(token, &Validation::default()).map(|data| data.claims);
+    let validation: Result<Claims, _> = dangerous_insecure_decode(token).map(|data| data.claims);
 
     //If valid, simply return token. If expired, attempt to refresh.
     //Otherwise, bubble error.
diff --git a/web-ui/crate/src/rooms.rs b/web-ui/crate/src/rooms.rs
index 4e0e123..0924de2 100644
--- a/web-ui/crate/src/rooms.rs
+++ b/web-ui/crate/src/rooms.rs
@@ -1,5 +1,6 @@
 use crate::api;
 use crate::error::UiError;
+use crate::logic::{self, LogicResultExt};
 use crate::state::{Action, DispatchExt, Room, WebUiDispatcher};
 use std::sync::Arc;
 use wasm_bindgen_futures::spawn_local;
@@ -26,19 +27,11 @@ fn view_room(room: &Room) -> Html {
 }
 
 async fn load_rooms(dispatch: &WebUiDispatcher) -> Result<(), UiError> {
-    let jwt_token = dispatch
-        .state()
-        .jwt_token
-        .as_ref()
-        .ok_or(UiError::NotLoggedIn)?;
+    let result = logic::fetch_rooms(dispatch).await;
+    let actions = result.actions();
 
-    let rooms = api::dicebot::rooms_for_user(jwt_token, "@projectmoon:agnos.is").await?;
-
-    for room in rooms {
-        dispatch.send(Action::AddRoom(Room {
-            room_id: room.room_id,
-            display_name: room.display_name,
-        }));
+    for action in actions {
+        dispatch.send(action);
     }
 
     Ok(())
diff --git a/web-ui/crate/src/state.rs b/web-ui/crate/src/state.rs
index 875d70f..e4a38b7 100644
--- a/web-ui/crate/src/state.rs
+++ b/web-ui/crate/src/state.rs
@@ -1,7 +1,5 @@
 use crate::error::UiError;
-use jsonwebtoken::{
-    dangerous_insecure_decode_with_validation as decode_without_verify, Validation,
-};
+use jsonwebtoken::dangerous_insecure_decode;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen::{prelude::Closure, JsCast};
 use yewdux::prelude::*;
@@ -52,10 +50,11 @@ pub(crate) enum Action {
 
 impl WebUiState {
     fn login(&mut self, jwt_token: String) {
-        let validation: Result<Claims, _> =
-            decode_without_verify(&jwt_token, &Validation::default()).map(|data| data.claims);
+        //TODO this will not work because we cannot ignore the key to decode the JWT.
+        let jwt_decoding: Result<Claims, _> =
+            dangerous_insecure_decode(&jwt_token).map(|data| data.claims);
 
-        match validation {
+        match jwt_decoding {
             Ok(claims) => {
                 self.jwt_token = Some(jwt_token);
                 self.auth_state = AuthState::LoggedIn;