diff --git a/sgx-bwmsgsv2.rb b/sgx-bwmsgsv2.rb
index 4e8f2c624f8d9c8b57cf70573c4fe3da0e822cfd..97103ce63b9bbd5da538251143151a28ecc6d524 100755
--- a/sgx-bwmsgsv2.rb
+++ b/sgx-bwmsgsv2.rb
@@ -169,23 +169,15 @@ module SGXbwmsgsv2
 		# we assume media_url is one of these (always the case so far):
 		#  https://messaging.bandwidth.com/api/v2/users/[u]/media/[path]
 
+		puts 'ORIG_URL: ' + media_url
 		usr = to
-		pth = ''
-		if media_url.start_with?(
-			'https://messaging.bandwidth.com/api/v2/users/')
-
+		if media_url.start_with?('https://messaging.bandwidth.com/api/v2/users/')
 			pth = media_url.split('/', 9)[8]
-		else
-			puts "ERROR2: unrecognized media_url: '#{media_url}'"
-			return
+			# the caller must guarantee that 'to' is a bare JID
+			media_url = ARGV[6] + WEBrick::HTTPUtils.escape(usr) + '/' + pth
+			puts 'PROX_URL: ' + media_url
 		end
 
-		# the caller must guarantee that 'to' is a bare JID
-		proxy_url = ARGV[6] + WEBrick::HTTPUtils.escape(usr) + '/' + pth
-
-		puts 'ORIG_URL: ' + media_url
-		puts 'PROX_URL: ' + proxy_url
-
 		msg = m ? m.copy : Blather::Stanza::Message.new(to, "")
 		msg.from = from
 		msg.subject = subject if subject
@@ -195,7 +187,7 @@ module SGXbwmsgsv2
 		x['xmlns'] = 'jabber:x:oob'
 
 		urln = Nokogiri::XML::Node.new 'url', msg.document
-		urlc = Nokogiri::XML::Text.new proxy_url, msg.document
+		urlc = Nokogiri::XML::Text.new media_url, msg.document
 		urln.add_child(urlc)
 		x.add_child(urln)
 
@@ -762,38 +754,32 @@ class WebhookHandler < Goliath::API
 		end
 
 		# TODO: process each message in list, not just first one
-		jparams = params['_json'][0]['message']
+		jparams = params.dig('_json', 0, 'message')
+		type = params.dig('_json', 0, 'type')
 
-		type = params['_json'][0]['type']
+		return [400, {}, "Missing params\n"] unless jparams && type
 
-		users_num = ''
-		others_num = ''
-		if jparams['direction'] == 'in'
-			users_num = jparams['owner']
-			others_num = jparams['from']
+		users_num, others_num = if jparams['direction'] == 'in'
+			[jparams['owner'], jparams['from']]
 		elsif jparams['direction'] == 'out'
-			users_num = jparams['from']
-			others_num = jparams['owner']
+			[jparams['from'], jparams['owner']]
 		else
-			# TODO: exception or similar
-			puts "big prob: '" + jparams['direction'] + "'" + body
-			return [200, {}, "OK"]
+			puts "big prob: '#{jparams['direction']}'"
+			return [400, {}, "OK"]
 		end
 
-		puts 'BODY - messageId: ' + jparams['id'] +
-			', eventType: ' + type +
-			', time: ' + jparams['time'] +
-			', direction: ' + jparams['direction'] +
-			#', state: ' + jparams['state'] +
-			', deliveryState: ' + (jparams['deliveryState'] ?
-				jparams['deliveryState'] : 'NONE') +
-			', errorCode: ' + (jparams['errorCode'] ?
-				jparams['errorCode'] : 'NONE') +
-			', description: ' + (jparams['description'] ?
-				jparams['description'] : 'NONE') +
-			', tag: ' + (jparams['tag'] ? jparams['tag'] : 'NONE') +
-			', media: ' + (jparams['media'] ?
-				jparams['media'].to_s : 'NONE')
+		return [400, {}, "Missing params\n"] unless users_num && others_num
+		return [400, {}, "Missing params\n"] unless jparams['to'].is_a?(Array)
+
+		puts "BODY - messageId: #{jparams['id']}" \
+			", eventType: #{type}" \
+			", time: #{jparams['time']}" \
+			", direction: #{jparams['direction']}" \
+			", deliveryState: #{jparams['deliveryState'] || 'NONE'}" \
+			", errorCode: #{jparams['errorCode'] || 'NONE'}" \
+			", description: #{jparams['description'] || 'NONE'}" \
+			", tag: #{jparams['tag'] || 'NONE'}" \
+			", media: #{jparams['media'] || 'NONE'}"
 
 		if others_num[0] != '+'
 			# TODO: check that others_num actually a shortcode first
@@ -806,11 +792,7 @@ class WebhookHandler < Goliath::API
 		if !bare_jid
 			puts "jid_key for (#{users_num}) DNE; BW API misconfigured?"
 
-			# TODO: likely not appropriate; give error to BW API?
-			# TODO: add text re credentials not being registered
-			#write_to_stream error_msg(m.reply, m.body, :auth,
-			#	'registration-required')
-			return [200, {}, "OK"]
+			return [403, {}, "Customer not found\n"]
 		end
 
 		msg = nil