diff --git a/assets/scripts/app/auth.coffee b/assets/scripts/app/auth.coffee
index 260da1d2..c1bfe18d 100644
--- a/assets/scripts/app/auth.coffee
+++ b/assets/scripts/app/auth.coffee
@@ -16,8 +16,14 @@
   # for auto signin then we're trying to sign in.
   autoSignIn: (path) ->
     console.log 'autoSignIn'
-    if user = sessionStorage.getItem('travis.user')
-      @setData(user: JSON.parse(user))
+    global  = localStorage.getItem('travis.user')
+    session = sessionStorage.getItem('travis.user')
+    user    = session || global
+    if user
+      localStorage.setItem('travis.user', user) unless global
+      data = JSON.parse(user)
+      data = { user: data } unless data.user?
+      @setData(data)
     else if localStorage.getItem('travis.auto_signin')
       console.log 'travis.auto_signin', localStorage.getItem('travis.auto_signin')
       @signIn()
@@ -32,6 +38,7 @@
   signOut: ->
     localStorage.removeItem('travis.auto_signin')
     localStorage.removeItem('travis.locale')
+    localStorage.removeItem('travis.user')
     sessionStorage.clear()
     @setData()
 
@@ -49,13 +56,7 @@
 
   # TODO should have clearData() to clean this up
   setData: (data) ->
-    if typeof data == 'string'
-      # TODO: I sometimes see plain text response "done" when authenticating
-      #       we should track down why is that happening and fix the API
-      if data == 'done'
-        data = {}
-      else
-        data = JSON.parse(data)
+    data = JSON.parse(data) if typeof data == 'string'
     @storeToken(data.token) if data?.token
     console.log 'setData', data.user if data?.user
     user = @storeUser(data.user) if data?.user
@@ -89,9 +90,12 @@
 
   receiveMessage: (event) ->
     if event.origin == @expectedOrigin()
-      event.data.user.token = event.data.travis_token if event.data.travis_token
-      @setData(event.data)
-      console.log("signed in as #{event.data.user.login}")
+      if event.data == 'redirect'
+        @forceSignIn()
+      else if event.data.user?
+        event.data.user.token = event.data.travis_token if event.data.travis_token
+        @setData(event.data)
+        console.log("signed in as #{event.data.user.login}")
     else
       console.log("unexpected message #{event.origin}: #{event.data}")
 
diff --git a/lib/travis/web/set_token.rb b/lib/travis/web/set_token.rb
index 13a3222f..af73cbdc 100644
--- a/lib/travis/web/set_token.rb
+++ b/lib/travis/web/set_token.rb
@@ -11,14 +11,18 @@ module Travis
       end
 
       def call(env)
-        return app.call(env) unless info = info_for(env)
-        Rack::Response.new(template % info).finish
+        set_info(env) || app.call(env)
       end
 
-      def info_for(env)
+      def set_info(env)
         return unless env['REQUEST_METHOD'] == 'POST'
-        info = Rack::Request.new(env).params.values_at('token', 'user')
-        info if info.first =~ /\A[a-zA-Z\-_\d]+\Z/
+        request = Rack::Request.new(env)
+        token, user, storage = request.params.values_at('token', 'user', 'storage')
+        if token =~ /\A[a-zA-Z\-_\d]+\Z/
+          storage = 'sessionStorage' if storage != 'localStorage'
+          info = [storage, token, user, request.fullpath]
+          Rack::Response.new(template % info).finish
+        end
       end
     end
   end
@@ -26,7 +30,8 @@ end
 
 __END__
 <script>
-sessionStorage.setItem('travis.token', %p);
-sessionStorage.setItem('travis.user',  %p);
-window.location = '/';
+var storage = %s;
+storage.setItem('travis.token', %p);
+storage.setItem('travis.user',  %p);
+window.location = %p;
 </script>