diff --git a/meshuser.js b/meshuser.js
index 8f2bb93b..07653731 100644
--- a/meshuser.js
+++ b/meshuser.js
@@ -81,9 +81,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
         if (user == null) { try { obj.ws.close(); } catch (e) { } return; }
 
         // Associate this websocket session with the web session
-        //req.session.ws = obj.ws;
-        //req.session.ws.userid = req.session.userid;
-        //req.session.ws.domainid = domain.id;
+        obj.ws.userid = req.session.userid;
+        obj.ws.domainid = domain.id;
 
         // Add this web socket session to session list
         obj.ws.sessionId = user._id + '/' + ('' + Math.random()).substring(2);
@@ -102,7 +101,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
         obj.ws.HandleEvent = function (source, event) {
             if (!event.domain || event.domain == obj.domain.id) {
                 try {
-                    if (event == 'close') { req.session.destroy(); obj.close(); }
+                    if (event == 'close') { try { delete req.session; } catch (ex) { } obj.close(); }
                     else if (event == 'resubscribe') { user.subscriptions = obj.parent.subscribe(user._id, ws); }
                     else if (event == 'updatefiles') { updateUserFiles(user, ws, domain); }
                     else { ws.send(JSON.stringify({ action: 'event', event: event })); }
@@ -1137,7 +1136,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
                 case 'close':
                     {
                         // Close the web socket session
-                        if (obj.req.session && obj.req.session.ws && obj.req.session.ws == ws) delete obj.req.session.ws;
+                        console.log('CLOSING1');
+                        if (obj.req.session && obj.req.session.ws && obj.req.session.ws == ws) { console.log('CLOSING2'); delete obj.req.session.ws; }
                         try { ws.close(); } catch (e) { }
                         break;
                     }
diff --git a/mpsserver.js b/mpsserver.js
index 8517636b..e8c1f804 100644
--- a/mpsserver.js
+++ b/mpsserver.js
@@ -26,7 +26,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
     const tls = require("tls");
     const MAX_IDLE = 90000;      // 90 seconds max idle time, higher than the typical KEEP-ALIVE periode of 60 seconds
 
-    if (obj.args.tlsoffload) {
+    if (obj.args.mpstlsoffload) {
         obj.server = net.createServer(onConnection);
     } else {
         obj.server = tls.createServer({ key: certificates.mps.key, cert: certificates.mps.cert, requestCert: true, rejectUnauthorized: false }, onConnection);
@@ -99,7 +99,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
     };
 
     function onConnection(socket) {
-        if (obj.args.tlsoffload) {
+        if (obj.args.mpstlsoffload) {
             socket.tag = { first: true, clientCert: null, accumulator: "", activetunnels: 0, boundPorts: [], socket: socket, host: null, nextchannelid: 4, channels: {}, nextsourceport: 0 };
         } else {
             socket.tag = { first: true, clientCert: socket.getPeerCertificate(true), accumulator: "", activetunnels: 0, boundPorts: [], socket: socket, host: null, nextchannelid: 4, channels: {}, nextsourceport: 0 };
diff --git a/package.json b/package.json
index 4ee9a1b8..a6831aaf 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "meshcentral",
-  "version": "0.2.2-s",
+  "version": "0.2.2-t",
   "keywords": [
     "Remote Management",
     "Intel AMT",
diff --git a/sample-config.json b/sample-config.json
index e7173ed8..b9fd5e1e 100644
--- a/sample-config.json
+++ b/sample-config.json
@@ -16,7 +16,9 @@
     "_ClickOnce": false,
     "_SelfUpdate": true,
     "_UserAllowedIP": "127.0.0.1,::1,192.168.0.100",
-    "_LocalDiscovery": { "name": "Local server name", "info": "Information about this server" }
+    "_LocalDiscovery": { "name": "Local server name", "info": "Information about this server" },
+    "_TlsOffload": true,
+    "_MpsTlsOffload":  true
   },
   "_domains": {
     "": {
diff --git a/views/default.handlebars b/views/default.handlebars
index 45220a88..430ef0a5 100644
--- a/views/default.handlebars
+++ b/views/default.handlebars
@@ -2101,7 +2101,7 @@
             if (serverinfo != null) { x += addHtmlValue('MPS Server', '<input style=width:230px readonly value="' + EscapeHtml(serverinfo.mpsname) + ':' + serverinfo.mpsport + '" />'); }
             x += "</div>";
 
-            // Setup CIRA with certificate authentication (Really difficult, only is allowed)
+            // Setup CIRA with certificate authentication (Really difficult, only if TLS offload is not used)
             if ((features & 16) == 0) {
                 x += "<div id=dlgAddCira2 style=display:none>To add a new Intel&reg; AMT device to device group \"" + EscapeHtml(mesh.name) + "\" with CIRA, load the following certificate as trusted root within Intel AMT, authenticate using a client certificate with the following common name and connect to the following server.<br /><br />";
                 x += addHtmlValue('Root Certificate', '<a href="MeshServerRootCert.cer" target="_blank">Root Certificate File</a>');
diff --git a/webserver.js b/webserver.js
index 3317390c..3da47dbe 100644
--- a/webserver.js
+++ b/webserver.js
@@ -709,8 +709,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
             }
         }
 
-        // If a user is logged in, serve the default app, otherwise server the login app.
-        if (req.session && req.session.userid) {
+        // If a user exists and is logged in, serve the default app, otherwise server the login app.
+        if (req.session && req.session.userid && obj.users[req.session.userid]) {
+            var user = obj.users[req.session.userid];
             if (req.session.domainid != domain.id) { req.session = null; res.redirect(domain.url); return; } // Check is the session is for the correct domain
             var viewmode = 1;
             if (req.session.viewmode) {
@@ -727,16 +728,15 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
                 currentNode = 'node/' + domain.id + '/' + req.query.node;
             }
             var logoutcontrol = '';
-            if (obj.args.nousers != true) { logoutcontrol = 'Welcome ' + obj.users[req.session.userid].name + '.'; }
+            if (obj.args.nousers != true) { logoutcontrol = 'Welcome ' + user.name + '.'; }
 
             // Give the web page a list of supported server features
             features = 0;
-            user = obj.users[req.session.userid];
             if (obj.args.wanonly == true) { features += 1; } // WAN-only mode
             if (obj.args.lanonly == true) { features += 2; } // LAN-only mode
             if (obj.args.nousers == true) { features += 4; } // Single user mode
             if (domain.userQuota == -1) { features += 8; } // No server files mode
-            if (obj.args.tlsoffload) { features += 16; } // No mutual-auth CIRA
+            if (obj.args.mpstlsoffload) { features += 16; } // No mutual-auth CIRA
             if ((parent.config != null) && (parent.config.settings != null) && (parent.config.settings.allowframing == true)) { features += 32; } // Allow site within iframe
             if ((obj.parent.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName != 'un-configured') && (obj.args.lanonly != true)) { features += 64; } // Email invites
             if (obj.args.webrtc == true) { features += 128; } // Enable WebRTC (Default false for now)