diff --git a/deprecations.txt b/deprecations.txt
index 06c148a..e00eb3a 100644
--- a/deprecations.txt
+++ b/deprecations.txt
@@ -4,3 +4,9 @@
   from collections import Counter, Iterator, Mapping, OrderedDict
 /mnt/d/CUCC-Expo/t37/lib/python3.7/site-packages/django/core/paginator.py:126: DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated since Python 3.3,and in 3.9 it will stop working
   class Page(collections.Sequence):
+/mnt/d/CUCC-Expo/t37/lib/python3.7/site-packages/registration/auth_urls_classes.py:20: DeprecationWarning: 
+include('registration.auth_urls') is deprecated and will be
+removed in django-registration 3.0. Use
+include('django.contrib.auth.urls') instead.
+
+  DeprecationWarning
diff --git a/localsettingsWSL.py b/localsettingsWSL.py
index 81a4042..3f44d36 100644
--- a/localsettingsWSL.py
+++ b/localsettingsWSL.py
@@ -15,18 +15,21 @@ This file is included at the end of the main troggle/settings.py file so that
 it overwrites defaults in that file.
 """
 
-# link 'localsettings.py' to localsettingsWSL.py for use on a Windows 10 machine running WSL1
 print(" * importing troggle/localsettings.py")
 
 #-----------------------------------------------------------------
 #  THINK before you push this to a repo
-#  - have you checked that this file is in .gitignore ?
-#  - have you run pre-push.sh to copy files and remove passwords?
+#  - have you checked that credentials.py is in .gitignore ?
 #  - we don't want to have to change the expo system password !
 #-----------------------------------------------------------------
+# default values, then get overwritten by real secrets
+EXPOUSERPASS = "nnn:gggggg"
+EMAIL_HOST_PASSWORD = "insert-real-email-password-here"
+from credentials import EXPOUSERPASS
+from credentials import EMAIL_HOST_PASSWORD
 
 SERVERPORT = '8000'
-EXPOFILESREMOTE = False # if True, then re-routes urls in expofiles to remote sever
+EXPOFILESREMOTE = False # if True, then re-routes urls in expofiles to remote sever. Tests are then less accurate.
 #SECURE_SSL_REDIRECT = True # breaks 7 tests in test suite 301 not 200 (or 302) and runserver fails completely
 
 # --------------------- MEDIA redirections BEGIN --------------------- 
@@ -38,12 +41,18 @@ TROGGLE_PATH = Path(__file__).parent
 TEMPLATE_PATH     = os.fspath(TROGGLE_PATH / 'templates')
 MEDIA_ROOT        = os.fspath(TROGGLE_PATH / 'media')
 
+FILES = Path('/mnt/f/expofiles/')
+EXPOFILES = Path('/mnt/f/expofiles/')
+SURVEY_SCANS = EXPOFILES / 'surveyscans'
+PHOTOS_ROOT = EXPOFILES / 'photos'
+
 # URL that handles the media served from MEDIA_ROOT. Make sure to use a
 # trailing slash if there is a path component (optional in other cases).
 MEDIA_URL = '/site-media/'
 
-URL_ROOT = 'http://localhost:'+ SERVERPORT +'/'
 DIR_ROOT = ''#this should end in / if a value is given
+URL_ROOT = '/'
+URL_ROOT = 'http://localhost:'+ SERVERPORT +'/'
 
 MEDIA_URL   = urllib.parse.urljoin(URL_ROOT , '/site_media/')
 SURVEYS_URL = urllib.parse.urljoin(URL_ROOT , '/survey_scans/')
@@ -54,12 +63,6 @@ SVX_URL     = urllib.parse.urljoin(URL_ROOT , '/survex/')
 STATIC_URL = urllib.parse.urljoin(URL_ROOT , '/static/') # used by Django admin pages. Do not delete.
 JSLIB_URL  = urllib.parse.urljoin(URL_ROOT , '/javascript/') # always fails, try to revive it ?
 
-print(REPOS_ROOT_PATH)
-print(LIBDIR)
-print(TROGGLE_PATH)
-print(TEMPLATE_PATH)
-print(MEDIA_ROOT)
-
 #STATIC_ROOT removed after merging content into MEDIA_ROOT. See urls.py & core/views/surveys.py
 # --------------------- MEDIA redirections END --------------------- 
 
@@ -99,19 +102,21 @@ TEMPLATES = [
         ],
         'OPTIONS': {
             'debug': 'DEBUG',
-            'context_processors': [
-                'django.contrib.auth.context_processors.auth',
-                'core.context.troggle_context', 
+            'context_processors': [ 
+                # django.template.context_processors.csrf, # is always enabled and cannot be removed, sets csrf_token
+                'django.contrib.auth.context_processors.auth', # knowledge of logged-on user & permissions
+                'core.context.troggle_context',    # in core/troggle.py
                 'django.template.context_processors.debug',
+                #'django.template.context_processors.request', # copy of current request, added in trying to make csrf work
                 'django.template.context_processors.i18n',
-                'django.template.context_processors.media',
-                'django.template.context_processors.static',
+                'django.template.context_processors.media',  # includes a variable MEDIA_URL
+                'django.template.context_processors.static', # includes a variable STATIC_URL
                 'django.template.context_processors.tz',
                 'django.contrib.messages.context_processors.messages',
             ],
             'loaders': [
                 'django.template.loaders.filesystem.Loader',
-                'django.template.loaders.app_directories.Loader',
+                'django.template.loaders.app_directories.Loader', #For each app, inc admin,  in INSTALLED_APPS, loader looks for /templates 
                 # insert your own TEMPLATE_LOADERS here
            ]
        },
@@ -119,14 +124,15 @@ TEMPLATES = [
 ]
 
 EXPOUSER = 'expo'
-EXPOUSERPASS = "nnn:gggggg"
+# EXPOUSERPASS = "nnn:gggggg" # loaded from credentials.py
 EXPOUSER_EMAIL = 'philip.sargent@gmail.com'
 
-EMAIL_HOST = "smtp.gmail.com"
-EMAIL_HOST_USER = "philip.sargent@gmail.com"
-EMAIL_HOST_PASSWORD = "insert-real-email-password-here"
+EMAIL_HOST = "smtp-auth.mythic-beasts.com"
+EMAIL_HOST_USER = "django-test@klebos.net" # Philip Sargent really
+# EMAIL_HOST_PASSWORD = "insert-real-email-password-here" # loaded from credentials.py
 EMAIL_PORT=587
 EMAIL_USE_TLS = True
+DEFAULT_FROM_EMAIL = 'django-test@klebos.net'
 
 SURVEX_DATA = REPOS_ROOT_PATH / "loser"
 TUNNEL_DATA = REPOS_ROOT_PATH / "drawings"
@@ -134,13 +140,10 @@ THREEDCACHEDIR  =  REPOS_ROOT_PATH / 'expowebcache' / '3d'
 
 EXPOWEB = REPOS_ROOT_PATH / "expoweb" 
 SURVEYS = REPOS_ROOT_PATH
-SURVEY_SCANS = '/mnt/f/expofiles/surveyscans/'
-FILES = '/mnt/f/expofiles/'
 CAVEDESCRIPTIONS        = EXPOWEB / "cave_data"
 ENTRANCEDESCRIPTIONS    = EXPOWEB / "entrance_data"
 EXPOWEB_URL = ''
 SURVEYS_URL = '/survey_scans/'
-EXPOFILES ='/mnt/f/expofiles/'
 
 # Sanitise these to be strings as all other code is expecting strings
 # and we have not made the change to pathlib Path type in the other localsettings-* variants yet.
diff --git a/urls.py b/urls.py
index cd3bff7..62ea610 100644
--- a/urls.py
+++ b/urls.py
@@ -135,7 +135,7 @@ trogglepatterns = [
   
     url(r'^photos/(?P<subpath>.*)$',      mediapage, {'doc_root': settings.PHOTOS_ROOT}, name="mediapage"), # photo galleries 
     url(r'^site_media/(?P<subpath>.*)$',  mediapage, {'doc_root': settings.MEDIA_ROOT},  name="mediapage"), # MEDIA_ROOT: CSS and JS 
-    url(r'^static/(?P<subpath>.*)$',      mediapage, {'doc_root': settings.STATIC_ROOT}, name="mediapage"), # STATIC: CSS and JS 
+    url(r'^static/(?P<subpath>.*)$',      mediapage, {'doc_root': settings.MEDIA_ROOT},  name="mediapage"), # STATIC is in MEDIA now!
 
 
     url(r'^(.*)_edit$',         editexpopage, name="editexpopage"),
@@ -154,7 +154,7 @@ urlpatterns = [
 # Alias /site-media/ /home/expo/troggle/media/
 # Alias /robots.txt  /home/expo/troggle/media/robots.txt
 # Alias /favicon.ico /home/expo/troggle/media/favicon.ico  # comes from /expoweb/* when running runserver
-# Alias /javascript  /home/expo/troggle/media/javascript 
+# Alias /javascript  /home/expo/troggle/media/javascript   # empty
 
 # Copy of old standard apache configurations:
 # Alias /expofiles   /home/expo/expofiles