diff --git a/cmd/telebit/admin.go b/cmd/telebit/admin.go
index fc79e1c..ce012d6 100644
--- a/cmd/telebit/admin.go
+++ b/cmd/telebit/admin.go
@@ -168,7 +168,18 @@ func upgradeWebsocket(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	//fmt.Printf("LocalAddr: %#v\n", r.LocalAddr)
+
 	wsTun := telebit.NewWebsocketTunnel(conn)
+	fmt.Printf("[debug] http.req.RemoteAddr: %+v\n", r.RemoteAddr)
+	fmt.Printf("[debug] conn.RemoteAddr(): %+v\n", conn.RemoteAddr())
+	fmt.Printf("[debug] conn.LocalAddr(): %+v\n", conn.LocalAddr())
+	//fmt.Printf("wsTun.RemoteAddr(): %+v\n", wsTun.RemoteAddr())
+	//fmt.Printf("wsTun.LocalAddr(): %#v\n", wsTun.LocalAddr())
+
+	// The remote address of the server is useful for identification.
+	// The local address of the server (port to which it connected) is not very meaningful.
+	// Rather the client's local address (the specific relay server) would be more useful.
 	server := &table.SubscriberConn{
 		RemoteAddr:   r.RemoteAddr,
 		WSConn:       conn,
@@ -192,6 +203,8 @@ func upgradeWebsocket(w http.ResponseWriter, r *http.Request) {
 		_ = wsTun.Close()
 		// TODO close all clients
 		fmt.Printf("a subscriber stream is done: %q\n", err)
+		// TODO check what happens when we leave a junk connection
+		table.Remove(server.Grants.Subject)
 	}()
 
 	table.Add(server)
diff --git a/cmd/telebit/telebit.go b/cmd/telebit/telebit.go
index 6190366..97e2e65 100644
--- a/cmd/telebit/telebit.go
+++ b/cmd/telebit/telebit.go
@@ -354,6 +354,9 @@ func routeSubscribersAndClients(client net.Conn) error {
 	//dstAddr := dstParts[0]
 	dstPort, _ := strconv.Atoi(dstParts[1])
 
+	fmt.Printf("[debug] wconn.LocalAddr() %+v\n", wconn.LocalAddr())
+	fmt.Printf("[debug] wconn.RemoteAddr() %+v\n", wconn.RemoteAddr())
+
 	if 80 != dstPort && 443 != dstPort {
 		// TODO handle by port without peeking at Servername / Hostname
 		// if tryToServePort(client.LocalAddr().String(), wconn) {
@@ -369,6 +372,7 @@ func routeSubscribersAndClients(client net.Conn) error {
 		return fmt.Errorf("invalid servername")
 	}
 
+	fmt.Printf("[debug] wconn.Servername() %+v\n", servername)
 	// Match full servername "sub.domain.example.com"
 	if tryToServeName(servername, wconn) {
 		// TODO better non-error
@@ -407,6 +411,7 @@ func tryToServeName(servername string, wconn *telebit.ConnWrap) bool {
 	// async so that the call stack can complete and be released
 	//srv.clients.Store(wconn.LocalAddr().String(), wconn)
 	go func() {
+		fmt.Printf("[debug] found server to handle client:\n%#v\n", srv)
 		err := srv.Serve(wconn)
 		fmt.Printf("a browser client stream is done: %q\n", err)
 		//srv.clients.Delete(wconn.LocalAddr().String())
diff --git a/mplexer/routemux.go b/mplexer/routemux.go
index f368e58..3a3cf24 100644
--- a/mplexer/routemux.go
+++ b/mplexer/routemux.go
@@ -123,9 +123,12 @@ func (m *RouteMux) HandleTLS(servername string, acme *ACME, handler Handler) err
 			}
 
 			if !wconn.isEncrypted() {
+				fmt.Println("[debug] conn is not encrypted")
 				return ErrNotHandled
 			}
 
+			fmt.Println("[debug] terminated encrypted connection")
+
 			//NewTerminator(acme, handler)(client)
 			//return handler.Serve(client)
 			return handler.Serve(TerminateTLS(wconn, acme))
diff --git a/mplexer/telebit.go b/mplexer/telebit.go
index c3cbd3c..dac7e25 100644
--- a/mplexer/telebit.go
+++ b/mplexer/telebit.go
@@ -340,6 +340,10 @@ func Inspect(authURL, token string) (*Grants, error) {
 	if err != nil {
 		return nil, err
 	}
+	if "" == grants.Subject {
+		fmt.Println("TODO update mgmt server to show Subject:", msg)
+		grants.Subject = strings.Split(grants.Domains[0], ".")[0]
+	}
 	return grants, nil
 }
 
diff --git a/mplexer/websockettunnel.go b/mplexer/websockettunnel.go
index 73ac330..5efc8f1 100644
--- a/mplexer/websockettunnel.go
+++ b/mplexer/websockettunnel.go
@@ -117,14 +117,14 @@ func (wsw *WebsocketTunnel) Close() error {
 func (wsw *WebsocketTunnel) LocalAddr() net.Addr {
 	// TODO do we reverse this since the "local" address is that of the relay?
 	// return wsw.wsconn.RemoteAddr()
-	panic("LocalAddr() not implemented")
+	panic("no LocalAddr() implementation")
 }
 
 // RemoteAddr is not implemented and will panic. Additionally, it wouldn't mean anything useful anyway.
 func (wsw *WebsocketTunnel) RemoteAddr() net.Addr {
 	// TODO do we reverse this since the "remote" address means nothing / is that of one of the clients?
 	// return wsw.wsconn.LocalAddr()
-	panic("RemoteAddr() not implemented")
+	panic("no RemoteAddr() implementation")
 }
 
 // SetDeadline sets the read and write deadlines associated
diff --git a/table/table.go b/table/table.go
index 77dac02..acc6673 100644
--- a/table/table.go
+++ b/table/table.go
@@ -36,21 +36,27 @@ func Add(server *SubscriberConn) {
 	Servers.Store(server.Grants.Subject, srvMap)
 
 	// Add this server to the domain name matrix
-	for _, name := range server.Grants.Domains {
+	for _, domainname := range server.Grants.Domains {
 		var srvMap *sync.Map
-		srvMapX, ok := Table.Load(name)
+		srvMapX, ok := Table.Load(domainname)
 		if ok {
 			srvMap = srvMapX.(*sync.Map)
 		} else {
 			srvMap = &sync.Map{}
 		}
 		srvMap.Store(server.RemoteAddr, server)
-		Table.Store(name, srvMap)
+		Table.Store(domainname, srvMap)
 	}
 }
 
+func RemoveByAddr(subject string) bool {
+	// TODO
+	return false
+}
+
 func Remove(subject string) bool {
 	srvMapX, ok := Servers.Load(subject)
+	fmt.Printf("[debug] has server for %s? %t\n", subject, ok)
 	if !ok {
 		return false
 	}
@@ -64,6 +70,23 @@ func Remove(subject string) bool {
 			return true
 		})
 		srv.WSConn.Close()
+		for _, domainname := range srv.Grants.Domains {
+			srvMapX, ok := Table.Load(domainname)
+			if !ok {
+				continue
+			}
+			srvMap = srvMapX.(*sync.Map)
+			srvMap.Delete(srv.RemoteAddr)
+			n := 0
+			srvMap.Range(func(k, v interface{}) bool {
+				n++
+				return true
+			})
+			if 0 == n {
+				// TODO comment out to handle the bad case of 0 servers / empty map
+				Table.Delete(domainname)
+			}
+		}
 		return true
 	})
 	Servers.Delete(subject)