diff --git a/packages/accounts-base/localstorage_token.js b/packages/accounts-base/localstorage_token.js
index 6a9a6da010..91205a6742 100644
--- a/packages/accounts-base/localstorage_token.js
+++ b/packages/accounts-base/localstorage_token.js
@@ -3,6 +3,8 @@
 // seconds to synchronize login state between multiple tabs in the same
 // browser.
 
+var lastLoginTokenWhenPolled;
+
 // Login with a Meteor access token. This is the only public function
 // here.
 Meteor.loginWithToken = function (token, callback) {
@@ -11,13 +13,6 @@ Meteor.loginWithToken = function (token, callback) {
     userCallback: callback});
 };
 
-var autoLoginEnabled = true;
-
-// Semi-internal API. Call at startup to prevent automatic login.
-Acocunts._disableAutoLogin = function () {
-  autoLoginEnabled = false;
-};
-
 // Semi-internal API. Call this function to re-enable auto login after
 // if it was disabled at startup.
 Accounts._enableAutoLogin = function () {
@@ -63,11 +58,11 @@ unstoreLoginToken = function() {
 // This is private, but it is exported for now because it is used by a
 // test in accounts-password.
 //
-storedLoginToken = Accounts._storedLoginToken = function() {
+var storedLoginToken = Accounts._storedLoginToken = function() {
   return Meteor._localStorage.getItem(loginTokenKey);
 };
 
-storedUserId = function() {
+var storedUserId = function() {
   return Meteor._localStorage.getItem(userIdKey);
 };
 
@@ -97,7 +92,7 @@ if (autoLoginEnabled) {
 // Poll local storage every 3 seconds to login if someone logged in in
 // another tab
 lastLoginTokenWhenPolled = token;
-pollStoredLoginToken = function() {
+var pollStoredLoginToken = function() {
   if (! autoLoginEnabled)
     return;
 
diff --git a/packages/accounts-base/package.js b/packages/accounts-base/package.js
index 1eb3f60060..5bb44013fd 100644
--- a/packages/accounts-base/package.js
+++ b/packages/accounts-base/package.js
@@ -5,7 +5,6 @@ Package.describe({
 Package.on_use(function (api) {
   api.use('underscore', ['client', 'server']);
   api.use('localstorage', 'client');
-  api.use('accounts-urls', ['client', 'server']);
   api.use('deps', 'client');
   api.use('check', 'server');
   api.use('random', ['client', 'server']);
@@ -26,10 +25,13 @@ Package.on_use(function (api) {
 
   api.add_files('accounts_common.js', ['client', 'server']);
   api.add_files('accounts_server.js', 'server');
+  api.add_files('url_client.js', 'client');
+  api.add_files('url_server.js', 'server');
 
   // accounts_client must be before localstorage_token, because
   // localstorage_token attempts to call functions in accounts_client (eg
-  // Accounts.callLoginMethod) on startup.
+  // Accounts.callLoginMethod) on startup. And localstorage_token must be after
+  // url_client, which sets autoLoginEnabled.
   api.add_files('accounts_client.js', 'client');
   api.add_files('localstorage_token.js', 'client');
 });
diff --git a/packages/accounts-urls/url_client.js b/packages/accounts-base/url_client.js
similarity index 93%
rename from packages/accounts-urls/url_client.js
rename to packages/accounts-base/url_client.js
index b6e5107421..2aad97a986 100644
--- a/packages/accounts-urls/url_client.js
+++ b/packages/accounts-base/url_client.js
@@ -1,3 +1,5 @@
+autoLoginEnabled = true;
+
 // reads a reset password token from the url's hash fragment, if it's
 // there. if so prevent automatically logging in since it could be
 // confusing to be logged in as user A while resetting password for
@@ -9,7 +11,7 @@
 var match;
 match = window.location.hash.match(/^\#\/reset-password\/(.*)$/);
 if (match) {
-  Accounts._disableAutoLogin();
+  autoLoginEnabled = false;
   Accounts._resetPasswordToken = match[1];
   window.location.hash = '';
 }
@@ -26,7 +28,7 @@ if (match) {
 // in line with the hash fragment approach)
 match = window.location.hash.match(/^\#\/verify-email\/(.*)$/);
 if (match) {
-  Accounts._disableAutoLogin();
+  autoLoginEnabled = false;
   Accounts._verifyEmailToken = match[1];
   window.location.hash = '';
 }
@@ -36,7 +38,7 @@ if (match) {
 // reset password links.
 match = window.location.hash.match(/^\#\/enroll-account\/(.*)$/);
 if (match) {
-  Accounts._disableAutoLogin();
+  autoLoginEnabled = false;
   Accounts._enrollAccountToken = match[1];
   window.location.hash = '';
 }
diff --git a/packages/accounts-urls/url_server.js b/packages/accounts-base/url_server.js
similarity index 94%
rename from packages/accounts-urls/url_server.js
rename to packages/accounts-base/url_server.js
index 4362c4a208..2aac2cc4fc 100644
--- a/packages/accounts-urls/url_server.js
+++ b/packages/accounts-base/url_server.js
@@ -1,5 +1,7 @@
 // XXX These should probably not actually be public?
 
+Accounts.urls = {};
+
 Accounts.urls.resetPassword = function (token) {
   return Meteor.absoluteUrl('#/reset-password/' + token);
 };
diff --git a/packages/accounts-ui-unstyled/package.js b/packages/accounts-ui-unstyled/package.js
index 1acad8282a..e322209ae5 100644
--- a/packages/accounts-ui-unstyled/package.js
+++ b/packages/accounts-ui-unstyled/package.js
@@ -3,7 +3,7 @@ Package.describe({
 });
 
 Package.on_use(function (api) {
-  api.use(['deps', 'service-configuration', 'accounts-urls', 'accounts-base',
+  api.use(['deps', 'service-configuration', 'accounts-base',
            'underscore', 'templating',
            'handlebars', 'spark', 'session'], 'client');
   // Export Accounts (etc) to packages using this one.
diff --git a/packages/accounts-urls/.gitignore b/packages/accounts-urls/.gitignore
deleted file mode 100644
index 677a6fc263..0000000000
--- a/packages/accounts-urls/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-.build*
diff --git a/packages/accounts-urls/package.js b/packages/accounts-urls/package.js
deleted file mode 100644
index e1fd55e3b9..0000000000
--- a/packages/accounts-urls/package.js
+++ /dev/null
@@ -1,9 +0,0 @@
-Package.describe({
-  summary: "Generate and consume reset password and verify account URLs",
-  internal: true
-});
-
-Package.on_use(function (api) {
-  api.add_files('url_client.js', 'client');
-  api.add_files('url_server.js', 'server');
-});
diff --git a/packages/audit-argument-checks/audit_argument_checks.js b/packages/audit-argument-checks/audit_argument_checks.js
index 4655d7fb41..0c0ad1391a 100644
--- a/packages/audit-argument-checks/audit_argument_checks.js
+++ b/packages/audit-argument-checks/audit_argument_checks.js
@@ -1 +1 @@
-DDP._setAuditArgumentChecks(true);
+DDPServer._setAuditArgumentChecks(true);
diff --git a/packages/http/httpcall_common.js b/packages/http/httpcall_common.js
index e319196eb2..ddbad0c41c 100644
--- a/packages/http/httpcall_common.js
+++ b/packages/http/httpcall_common.js
@@ -67,6 +67,9 @@ populateData = function(response) {
   }
 };
 
+// XXX rename to HTTP
+Meteor.http = {};
+
 Meteor.http.get = function (/* varargs */) {
   return Meteor.http.call.apply(this, ["GET"].concat(_.toArray(arguments)));
 };
diff --git a/packages/livedata/crossbar.js b/packages/livedata/crossbar.js
index 1e4a83aa29..e4c8be26db 100644
--- a/packages/livedata/crossbar.js
+++ b/packages/livedata/crossbar.js
@@ -1,4 +1,4 @@
-DDP._InvalidationCrossbar = function () {
+DDPServer._InvalidationCrossbar = function () {
   var self = this;
 
   self.next_id = 1;
@@ -7,7 +7,7 @@ DDP._InvalidationCrossbar = function () {
   self.listeners = {};
 };
 
-_.extend(DDP._InvalidationCrossbar.prototype, {
+_.extend(DDPServer._InvalidationCrossbar.prototype, {
   // Listen for notification that match 'trigger'. A notification
   // matches if it has the key-value pairs in trigger as a
   // subset. When a notification matches, call 'callback', passing two
@@ -96,4 +96,4 @@ _.extend(DDP._InvalidationCrossbar.prototype, {
 });
 
 // singleton
-DDP._InvalidationCrossbar = new DDP._InvalidationCrossbar;
+DDPServer._InvalidationCrossbar = new DDPServer._InvalidationCrossbar;
diff --git a/packages/livedata/crossbar_tests.js b/packages/livedata/crossbar_tests.js
index 7d5c01bbdb..d5eed6cedd 100644
--- a/packages/livedata/crossbar_tests.js
+++ b/packages/livedata/crossbar_tests.js
@@ -6,15 +6,15 @@
 // deep meaning to the matching function, and it could be changed later
 // as long as it preserves that property.
 Tinytest.add('livedata - crossbar', function (test) {
-  test.isTrue(DDP._InvalidationCrossbar._matches(
+  test.isTrue(DDPServer._InvalidationCrossbar._matches(
     {collection: "C"}, {collection: "C"}));
-  test.isTrue(DDP._InvalidationCrossbar._matches(
+  test.isTrue(DDPServer._InvalidationCrossbar._matches(
     {collection: "C", id: "X"}, {collection: "C"}));
-  test.isTrue(DDP._InvalidationCrossbar._matches(
+  test.isTrue(DDPServer._InvalidationCrossbar._matches(
     {collection: "C"}, {collection: "C", id: "X"}));
-  test.isTrue(DDP._InvalidationCrossbar._matches(
+  test.isTrue(DDPServer._InvalidationCrossbar._matches(
     {collection: "C", id: "X"}, {collection: "C"}));
 
-  test.isFalse(DDP._InvalidationCrossbar._matches(
+  test.isFalse(DDPServer._InvalidationCrossbar._matches(
     {collection: "C", id: "X"}, {collection: "C", id: "Y"}));
 });
diff --git a/packages/livedata/livedata_common.js b/packages/livedata/livedata_common.js
index fa6ea64abf..b23c8b06c6 100644
--- a/packages/livedata/livedata_common.js
+++ b/packages/livedata/livedata_common.js
@@ -1,5 +1,4 @@
 DDP = {};
-_LivedataTest = {};
 
 SUPPORTED_DDP_VERSIONS = [ 'pre1' ];
 
diff --git a/packages/livedata/livedata_connection.js b/packages/livedata/livedata_connection.js
index 1e6058cf3e..995d8b7fcc 100644
--- a/packages/livedata/livedata_connection.js
+++ b/packages/livedata/livedata_connection.js
@@ -648,7 +648,7 @@ _.extend(Connection.prototype, {
       try {
         // Note that unlike in the corresponding server code, we never audit
         // that stubs check() their arguments.
-        var ret = DDP._CurrentInvocation.withValue(invocation,function () {
+        var ret = DDP._CurrentInvocation.withValue(invocation, function () {
           if (Meteor.isServer) {
             // Because saveOriginals and retrieveOriginals aren't reentrant,
             // don't allow stubs to yield.
diff --git a/packages/livedata/livedata_server.js b/packages/livedata/livedata_server.js
index 556c2b3b89..77d57231fb 100644
--- a/packages/livedata/livedata_server.js
+++ b/packages/livedata/livedata_server.js
@@ -556,7 +556,7 @@ _.extend(Session.prototype, {
       // set up to mark the method as satisfied once all observers
       // (and subscriptions) have reacted to any writes that were
       // done.
-      var fence = new DDP._WriteFence;
+      var fence = new DDPServer._WriteFence;
       fence.onAllCommitted(function () {
         // Retire the fence so that future writes are allowed.
         // This means that callbacks like timers are free to use
@@ -601,7 +601,7 @@ _.extend(Session.prototype, {
         sessionData: self.sessionData
       });
       try {
-        var result = DDP._CurrentWriteFence.withValue(fence, function () {
+        var result = DDPServer._CurrentWriteFence.withValue(fence, function () {
           return DDP._CurrentInvocation.withValue(invocation, function () {
             return maybeAuditArgumentChecks(
               handler, invocation, msg.params, "call to '" + msg.method + "'");
@@ -1371,7 +1371,7 @@ var wrapInternalException = function (exception, context) {
 // Private interface for 'audit-argument-checks' package.
 //
 var shouldAuditArgumentChecks = false;
-DDP._setAuditArgumentChecks = function (value) {
+DDPServer._setAuditArgumentChecks = function (value) {
   shouldAuditArgumentChecks = value;
 };
 
diff --git a/packages/livedata/package.js b/packages/livedata/package.js
index f71324634f..a3ace7c928 100644
--- a/packages/livedata/package.js
+++ b/packages/livedata/package.js
@@ -34,6 +34,8 @@ Package.on_use(function (api) {
   api.use('minimongo', ['client', 'server']);
 
 
+  api.add_files('livedata_server.js', 'server');
+
   api.add_files('writefence.js', 'server');
   api.add_files('crossbar.js', 'server');
 
@@ -41,8 +43,6 @@ Package.on_use(function (api) {
 
   api.add_files('livedata_connection.js', ['client', 'server']);
 
-  api.add_files('livedata_server.js', 'server');
-
 
   api.add_files('client_convenience.js', 'client');
   api.add_files('server_convenience.js', 'server');
diff --git a/packages/livedata/server_convenience.js b/packages/livedata/server_convenience.js
index 28cf98c66b..50a472d03c 100644
--- a/packages/livedata/server_convenience.js
+++ b/packages/livedata/server_convenience.js
@@ -16,13 +16,13 @@ if (Package.webapp) {
   Meteor.server = new Server;
 
   Meteor.refresh = function (notification) {
-    var fence = DDP._CurrentWriteFence.get();
+    var fence = DDPServer._CurrentWriteFence.get();
     if (fence) {
       // Block the write fence until all of the invalidations have
       // landed.
       var proxy_write = fence.beginWrite();
     }
-    DDP._InvalidationCrossbar.fire(notification, function () {
+    DDPServer._InvalidationCrossbar.fire(notification, function () {
       if (proxy_write)
         proxy_write.committed();
     });
diff --git a/packages/livedata/stream_client_common.js b/packages/livedata/stream_client_common.js
index 1633535b0d..1ef4165a89 100644
--- a/packages/livedata/stream_client_common.js
+++ b/packages/livedata/stream_client_common.js
@@ -1,3 +1,4 @@
+_LivedataTest = {};
 
 // XXX from Underscore.String (http://epeli.github.com/underscore.string/)
 var startsWith = function(str, starts) {
diff --git a/packages/livedata/writefence.js b/packages/livedata/writefence.js
index 05e2802e8a..3315cbfe3c 100644
--- a/packages/livedata/writefence.js
+++ b/packages/livedata/writefence.js
@@ -5,7 +5,7 @@ var Future = Npm.require(path.join('fibers', 'future'));
 // when all of the writes are fully committed and propagated (all
 // observers have been notified of the write and acknowledged it.)
 //
-DDP._WriteFence = function () {
+DDPServer._WriteFence = function () {
   var self = this;
 
   self.armed = false;
@@ -19,9 +19,9 @@ DDP._WriteFence = function () {
 // that writes to databases should register their writes with it using
 // beginWrite().
 //
-DDP._CurrentWriteFence = new Meteor.EnvironmentVariable;
+DDPServer._CurrentWriteFence = new Meteor.EnvironmentVariable;
 
-_.extend(DDP._WriteFence.prototype, {
+_.extend(DDPServer._WriteFence.prototype, {
   // Start tracking a write, and return an object to represent it. The
   // object has a single method, committed(). This method should be
   // called when the write is fully committed and propagated. You can
diff --git a/packages/logging/.npm/package/npm-shrinkwrap.json b/packages/logging/.npm/package/npm-shrinkwrap.json
index 9ef7e8bdfe..f0eafa1381 100644
--- a/packages/logging/.npm/package/npm-shrinkwrap.json
+++ b/packages/logging/.npm/package/npm-shrinkwrap.json
@@ -7,7 +7,7 @@
           "version": "0.9.2"
         },
         "memoizee": {
-          "version": "0.2.4",
+          "version": "0.2.5",
           "dependencies": {
             "event-emitter": {
               "version": "0.2.2"
diff --git a/packages/mongo-livedata/mongo_driver.js b/packages/mongo-livedata/mongo_driver.js
index e39d691f11..6c8460e951 100644
--- a/packages/mongo-livedata/mongo_driver.js
+++ b/packages/mongo-livedata/mongo_driver.js
@@ -170,7 +170,7 @@ MongoConnection.prototype._createCappedCollection = function (collectionName,
 // fence), you should call 'committed()' on the object returned.
 MongoConnection.prototype._maybeBeginWrite = function () {
   var self = this;
-  var fence = DDP._CurrentWriteFence.get();
+  var fence = DDPServer._CurrentWriteFence.get();
   if (fence)
     return fence.beginWrite();
   else
@@ -188,7 +188,7 @@ MongoConnection.prototype._maybeBeginWrite = function () {
 // After making a write (with insert, update, remove), observers are
 // notified asynchronously. If you want to receive a callback once all
 // of the observer notifications have landed for your write, do the
-// writes inside a write fence (set DDP._CurrentWriteFence to a new
+// writes inside a write fence (set DDPServer._CurrentWriteFence to a new
 // _WriteFence, and then set a callback on the write fence.)
 //
 // Since our execution environment is single-threaded, this is
@@ -739,12 +739,12 @@ var LiveResultsSet = function (cursorDescription, mongoHandle, ordered,
   // database for changes. If this selector specifies specific IDs, specify them
   // here, so that updates to different specific IDs don't cause us to poll.
   var listenOnTrigger = function (trigger) {
-    var listener = DDP._InvalidationCrossbar.listen(
+    var listener = DDPServer._InvalidationCrossbar.listen(
       trigger, function (notification, complete) {
         // When someone does a transaction that might affect us, schedule a poll
         // of the database. If that transaction happens inside of a write fence,
         // block the fence until we've polled and notified observers.
-        var fence = DDP._CurrentWriteFence.get();
+        var fence = DDPServer._CurrentWriteFence.get();
         if (fence)
           self._pendingWrites.push(fence.beginWrite());
         // Ensure a poll is scheduled... but if we already know that one is,
diff --git a/packages/mongo-livedata/mongo_livedata_tests.js b/packages/mongo-livedata/mongo_livedata_tests.js
index afbce53379..0f1e6a2bc1 100644
--- a/packages/mongo-livedata/mongo_livedata_tests.js
+++ b/packages/mongo-livedata/mongo_livedata_tests.js
@@ -124,8 +124,8 @@ Tinytest.addAsync("mongo-livedata - basics, " + idGeneration, function (test, on
     if (Meteor.isClient) {
       f();
     } else {
-      var fence = new DDP._WriteFence;
-      DDP._CurrentWriteFence.withValue(fence, f);
+      var fence = new DDPServer._WriteFence;
+      DDPServer._CurrentWriteFence.withValue(fence, f);
       fence.armAndWait();
     }
 
@@ -281,8 +281,8 @@ Tinytest.addAsync("mongo-livedata - fuzz test, " + idGeneration, function(test,
     if (Meteor.isClient) {
       f();
     } else {
-      var fence = new DDP._WriteFence;
-      DDP._CurrentWriteFence.withValue(fence, f);
+      var fence = new DDPServer._WriteFence;
+      DDPServer._CurrentWriteFence.withValue(fence, f);
       fence.armAndWait();
     }
   };
@@ -360,8 +360,8 @@ var runInFence = function (f) {
   if (Meteor.isClient) {
     f();
   } else {
-    var fence = new DDP._WriteFence;
-    DDP._CurrentWriteFence.withValue(fence, f);
+    var fence = new DDPServer._WriteFence;
+    DDPServer._CurrentWriteFence.withValue(fence, f);
     fence.armAndWait();
   }
 };
diff --git a/packages/oauth1/package.js b/packages/oauth1/package.js
index 16219388ae..76cf2ddcc4 100644
--- a/packages/oauth1/package.js
+++ b/packages/oauth1/package.js
@@ -9,7 +9,7 @@ Package.on_use(function (api) {
   api.use('oauth', ['client', 'server']);
   api.use('underscore', 'server');
 
-  api.exportSymbol('Oauth1Binding');
+  api.exportSymbol('OAuth1Binding');
   api.exportSymbol('_Oauth1Test');
 
   api.add_files('oauth1_binding.js', 'server');
diff --git a/packages/spark/package.js b/packages/spark/package.js
index cad3ed626b..3088dcbed0 100644
--- a/packages/spark/package.js
+++ b/packages/spark/package.js
@@ -8,8 +8,8 @@ Package.on_use(function (api) {
            'ordered-dict', 'deps', 'ejson'],
           'client');
 
-  api.exportSymbol('Spark');
-  api.exportSymbol('_SparkTest');
+  api.exportSymbol('Spark', 'client');
+  api.exportSymbol('_SparkTest', 'client');
 
   api.add_files(['spark.js', 'patch.js', 'convenience.js',
                  'utils.js'], 'client');
diff --git a/packages/test-helpers/package.js b/packages/test-helpers/package.js
index 3c594268ce..4c41cef1d3 100644
--- a/packages/test-helpers/package.js
+++ b/packages/test-helpers/package.js
@@ -9,9 +9,9 @@ Package.on_use(function (api) {
   api.use(['spark'], 'client');
 
   api.exportSymbol([
-    'pollUntil', 'WrappedFrag', 'permutations', 'StubStream', 'SeededRandom',
-    'ReactiveVar', 'OnscreenDiv', 'clickElement', 'blurElement', 'focusElement',
-    'simulateEvent', 'getStyleProperty', 'canonicalizeHtml',
+    'pollUntil', 'WrappedFrag', 'try_all_permutations', 'StubStream',
+    'SeededRandom', 'ReactiveVar', 'OnscreenDiv', 'clickElement', 'blurElement',
+    'focusElement', 'simulateEvent', 'getStyleProperty', 'canonicalizeHtml',
     'withCallbackLogger', 'testAsyncMulti']);
 
   api.add_files('try_all_permutations.js');
diff --git a/tools/linker.js b/tools/linker.js
index 550a4b8d13..660b708c98 100644
--- a/tools/linker.js
+++ b/tools/linker.js
@@ -141,7 +141,7 @@ _.extend(Module.prototype, {
     _.each(self.files, function (file) {
       if (!_.isEmpty(chunks))
         chunks.push("\n\n\n\n\n\n");
-      chunks.push(file.getPrelinkedOutput({ sourceWidth: sourceWidth });
+      chunks.push(file.getPrelinkedOutput({ sourceWidth: sourceWidth }));
     });
 
     var node = new sourcemap.SourceNode(null, null, null, chunks);
diff --git a/tools/packages.js b/tools/packages.js
index 59bb9c4325..9c9b519f72 100644
--- a/tools/packages.js
+++ b/tools/packages.js
@@ -1467,7 +1467,7 @@ _.extend(Package.prototype, {
           //   change.)
           use: function (names, where, options) {
             // Support `api.use(package, {weak: true})` without where.
-            if (where.constructor === Object && !options) {
+            if (_.isObject(where) && !_.isArray(where) && !options) {
               options = where;
               where = null;
             }