diff --git a/src/pages/convert.tsx b/src/pages/convert.tsx
index ed367b23..c181e516 100644
--- a/src/pages/convert.tsx
+++ b/src/pages/convert.tsx
@@ -56,16 +56,21 @@ export const convert = new Elysia().use(userService).post(
       return redirect(`${WEBROOT}/`, 302);
     }
 
-    const fileNames = JSON.parse(body.file_names) as string[];
-
-    for (let i = 0; i < fileNames.length; i++) {
-      fileNames[i] = sanitize(fileNames[i] || "");
+    let fileNames: string[];
+    try {
+      fileNames = JSON.parse(body.file_names) as string[];
+    } catch (e) {
+      return redirect(`${WEBROOT}/`, 302);
     }
 
     if (!Array.isArray(fileNames) || fileNames.length === 0) {
       return redirect(`${WEBROOT}/`, 302);
     }
 
+    for (let i = 0; i < fileNames.length; i++) {
+      fileNames[i] = sanitize(fileNames[i] || "");
+    }
+
     db.query("UPDATE jobs SET num_files = ?1, status = 'pending' WHERE id = ?2").run(
       fileNames.length,
       jobId.value,
diff --git a/src/pages/deleteFile.tsx b/src/pages/deleteFile.tsx
index e18caef3..a43fd596 100644
--- a/src/pages/deleteFile.tsx
+++ b/src/pages/deleteFile.tsx
@@ -27,7 +27,15 @@ export const deleteFile = new Elysia().use(userService).post(
     const sanitized = sanitize(body.filename);
     const targetPath = path.join(userUploadsDir, sanitized);
 
-    await unlink(targetPath);
+    try {
+      await unlink(targetPath);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return { message: "File not found." };
+      }
+      console.error(`Failed to unlink ${targetPath}:`, error);
+      throw error;
+    }
 
     return {
       message: "File deleted successfully.",
diff --git a/src/pages/download.tsx b/src/pages/download.tsx
index ffc64e9b..f4dc7cf4 100644
--- a/src/pages/download.tsx
+++ b/src/pages/download.tsx
@@ -21,8 +21,8 @@ export const download = new Elysia()
         return redirect(`${WEBROOT}/results`, 302);
       }
       // parse from URL encoded string
-      const jobId = decodeURIComponent(params.jobId);
-      const fileName = sanitize(decodeURIComponent(params.fileName));
+      const jobId = params.jobId;
+      const fileName = sanitize(params.fileName);
 
       const filePath = `${outputDir}${userId}/${jobId}/${fileName}`;
       const file = Bun.file(filePath);
diff --git a/src/pages/root.tsx b/src/pages/root.tsx
index eba32384..b0ea02f0 100644
--- a/src/pages/root.tsx
+++ b/src/pages/root.tsx
@@ -33,30 +33,44 @@ export const root = new Elysia().use(userService).get(
     // validate jwt
     let user: ({ id: string } & JWTPayloadSpec) | false = false;
     if (ALLOW_UNAUTHENTICATED) {
-      const newUserId = String(
-        UNAUTHENTICATED_USER_SHARING
-          ? 0
-          : randomInt(2 ** 24, Math.min(2 ** 48 + 2 ** 24 - 1, Number.MAX_SAFE_INTEGER)),
-      );
-      const accessToken = await jwt.sign({
-        id: newUserId,
-      });
-
-      user = { id: newUserId };
-      if (!auth) {
-        return {
-          message: "No auth cookie, perhaps your browser is blocking cookies.",
-        };
+      // Check if the current cookie is already a valid session
+      if (auth?.value) {
+        try {
+          const verifiedUser = await jwt.verify(auth.value);
+          if (verifiedUser && verifiedUser.id) {
+            user = verifiedUser;
+          }
+        } catch (e) {
+          // Invalid cookie, fall through to anonymous creation
+        }
       }
 
-      // set cookie
-      auth.set({
-        value: accessToken,
-        httpOnly: true,
-        secure: !HTTP_ALLOWED,
-        maxAge: 24 * 60 * 60,
-        sameSite: "strict",
-      });
+      // If no valid session found, create an anonymous user
+      if (!user) {
+        const newUserId = String(
+          UNAUTHENTICATED_USER_SHARING
+            ? 0
+            : randomInt(2 ** 24, Math.min(2 ** 48 + 2 ** 24 - 1, Number.MAX_SAFE_INTEGER)),
+        );
+        const accessToken = await jwt.sign({
+          id: newUserId,
+        });
+
+        user = { id: newUserId };
+        if (!auth) {
+          return {
+            message: "No auth cookie, perhaps your browser is blocking cookies.",
+          };
+        }
+
+        auth.set({
+          value: accessToken,
+          httpOnly: true,
+          secure: !HTTP_ALLOWED,
+          maxAge: 24 * 60 * 60,
+          sameSite: "strict",
+        });
+      }
     } else if (auth?.value) {
       user = await jwt.verify(auth.value);