diff --git a/Makefile b/Makefile
index 744a171..b15a55e 100644
--- a/Makefile
+++ b/Makefile
@@ -238,7 +238,7 @@
 	@$(VGO) build -o $(GOBIN)/servicerunner -a -tags wspr v.io/x/ref/cmd/servicerunner
 	@$(VGO) build -o $(GOBIN)/principal v.io/x/ref/cmd/principal
 	@$(VGO) build -o $(GOBIN)/test_serviced v.io/x/js.core/test_service/test_serviced
-	@$(VGO) build -o $(GOBIN)/stressd v.io/x/ref/profiles/internal/rpc/stress/stressd
+	@$(VGO) build -o $(GOBIN)/stressd v.io/x/ref/runtime/internal/rpc/stress/stressd
 
 lint: node_modules
 ifdef NOLINT
diff --git a/extension/Makefile b/extension/Makefile
index a10996b..61228fa 100644
--- a/extension/Makefile
+++ b/extension/Makefile
@@ -17,10 +17,7 @@
 
 define COMPILE-NACL-PLUGIN
 	mkdir -p $(dir $2)
-	GOARCH=amd64p32 \
-	GOOS=nacl \
-	GOROOT= \
-	v23 xgo --target-go=$(V23_ROOT)/third_party/repos/go_ppapi/bin/go amd64p32-nacl build -o $2 $1
+	GOROOT= V23_PROFILE=nacl v23 go build -o $2 $1
 endef
 
 all: vanadium.zip
diff --git a/extension/src/background/auth-handler.js b/extension/src/background/auth-handler.js
index 848e7eb..601f280 100644
--- a/extension/src/background/auth-handler.js
+++ b/extension/src/background/auth-handler.js
@@ -127,8 +127,19 @@
 // Pop up a new tab asking the user to chose their caveats.
 AuthHandler.prototype.getCaveats = function(account, origin, appPort) {
   var outstandingAuthRequests = this._outstandingAuthRequests;
+  var caveatTabOrigins = this._caveatTabOrigins;
   if (origin in this._outstandingAuthRequests) {
     outstandingAuthRequests[origin].push(appPort);
+
+    // Switch to the corresponding open caveat tab.
+    for (var tabId in caveatTabOrigins) {
+      if (caveatTabOrigins[tabId] === origin) {
+        var tabIdAsNumber = +tabId;
+        chrome.tabs.update(tabIdAsNumber, {active: true});
+        break;
+      }
+    }
+
     return;
   }
 
@@ -141,7 +152,6 @@
 
   // Get  currently active tab in the window.
   var windowId = appPort.sender.tab.windowId;
-  var caveatTabOrigins = this._caveatTabOrigins;
   chrome.tabs.query({active: true, windowId: windowId}, function(tabs) {
     // Store the current tab id so we can switch back to it after the addcaveats
     // tab is removed.  Note that the currently active tab might not be the same
diff --git a/go/src/v.io/x/js.core/test_service/cache.vdl.go b/go/src/v.io/x/js.core/test_service/cache.vdl.go
index 0c96986..ac84325 100644
--- a/go/src/v.io/x/js.core/test_service/cache.vdl.go
+++ b/go/src/v.io/x/js.core/test_service/cache.vdl.go
@@ -20,7 +20,7 @@
 type KeyPageResult [10]string
 
 func (KeyPageResult) __VDLReflect(struct {
-	Name string "v.io/x/js.core/test_service.KeyPageResult"
+	Name string `vdl:"v.io/x/js.core/test_service.KeyPageResult"`
 }) {
 }
 
@@ -31,7 +31,7 @@
 }
 
 func (KeyValuePair) __VDLReflect(struct {
-	Name string "v.io/x/js.core/test_service.KeyValuePair"
+	Name string `vdl:"v.io/x/js.core/test_service.KeyValuePair"`
 }) {
 }
 
diff --git a/go/src/v.io/x/js.core/test_service/invoke_method_caveat_id.vdl.go b/go/src/v.io/x/js.core/test_service/invoke_method_caveat_id.vdl.go
index f6c9379..a283878 100644
--- a/go/src/v.io/x/js.core/test_service/invoke_method_caveat_id.vdl.go
+++ b/go/src/v.io/x/js.core/test_service/invoke_method_caveat_id.vdl.go
@@ -25,7 +25,7 @@
 }
 
 func (TestCaveatData) __VDLReflect(struct {
-	Name string "v.io/x/js.core/test_service.TestCaveatData"
+	Name string `vdl:"v.io/x/js.core/test_service.TestCaveatData"`
 }) {
 }
 
diff --git a/go/src/v.io/x/js.core/test_service/test_serviced/main.go b/go/src/v.io/x/js.core/test_service/test_serviced/main.go
index c10108a..ec964e8 100644
--- a/go/src/v.io/x/js.core/test_service/test_serviced/main.go
+++ b/go/src/v.io/x/js.core/test_service/test_serviced/main.go
@@ -11,7 +11,7 @@
 
 	"v.io/v23"
 	"v.io/x/ref/lib/signals"
-	_ "v.io/x/ref/profiles"
+	_ "v.io/x/ref/runtime/factories/generic"
 )
 
 func main() {
diff --git a/go/src/v.io/x/js.core/test_service/test_serviced/test_serviced.go b/go/src/v.io/x/js.core/test_service/test_serviced/test_serviced.go
index 6158ed2..092ae64 100644
--- a/go/src/v.io/x/js.core/test_service/test_serviced/test_serviced.go
+++ b/go/src/v.io/x/js.core/test_service/test_serviced/test_serviced.go
@@ -14,7 +14,7 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/x/js.core/test_service"
-	_ "v.io/x/ref/profiles"
+	_ "v.io/x/ref/runtime/factories/generic"
 )
 
 // openAuthorizer allows RPCs from all clients.
diff --git a/src/gen-vdl/v.io/v23/security/access/index.js b/src/gen-vdl/v.io/v23/security/access/index.js
index 9503e22..84afd30 100644
--- a/src/gen-vdl/v.io/v23/security/access/index.js
+++ b/src/gen-vdl/v.io/v23/security/access/index.js
@@ -95,6 +95,19 @@
 ]);
 
 
+module.exports.UnenforceablePatternsError = makeError('v.io/v23/security/access.UnenforceablePatterns', actions.NO_RETRY, {
+  'en': '{1:}{2:} AccessList contains the following invalid or unrecognized patterns in the In list: {3}',
+}, [
+  _type1,
+]);
+
+
+module.exports.InvalidOpenAccessListError = makeError('v.io/v23/security/access.InvalidOpenAccessList', actions.NO_RETRY, {
+  'en': '{1:}{2:} AccessList with the pattern ... in its In list must have no other patterns in the In or NotIn lists',
+}, [
+]);
+
+
 
 
 // Services:
diff --git a/src/rpc/server.js b/src/rpc/server.js
index fee6f5e..ca75941 100644
--- a/src/rpc/server.js
+++ b/src/rpc/server.js
@@ -57,6 +57,9 @@
   this.serverOption = serverOption || new ServerOption();
 }
 
+// TODO(aghassemi) the serviceObject example needs to point to a "Guides" page
+// on the website when we have it. https://github.com/vanadium/issues/issues/444
+/* jshint ignore:start */
 /**
  * ServeOptions is a set of options that are passed to the
  * [serve]{@link module:vanadium.rpc~Server#serve}.
@@ -70,13 +73,6 @@
  * <p>Serve associates object with name by publishing the address
  * of this server with the mount table under the supplied name and using
  * authorizer to authorize access to it.</p>
- *
- * <p>To serve names of the form "mymedia/*" make the calls:</p>
- * <pre>
- * serve("mymedia", serviceObject, { // optional authorizer
- *   authorizer: serviceAuthorizer
- * });
- * </pre>
  * <p>If name is an empty string, no attempt will made to publish that
  * name to a mount table. It is an error to call
  * {@link module:vanadium.rpc~Server#serve|serve}
@@ -84,6 +80,55 @@
  * or {@link module:vanadium.rpc~Server.serve|serve} has already been called.
  * To serve the same object under multiple names,
  * {@link module:vanadium.rpc~Server#addName|addName} can be used.</p>
+ * <p>To serve names of the form "mymedia/*" make the calls:</p>
+ * <pre>
+ * serve("mymedia", serviceObject, {
+ *   authorizer: serviceAuthorizer // optional authorizer
+ * });
+ * </pre>
+ * <p>
+ * serviceObject is simply a JavaScript object that implements service methods.
+ * </p>
+ * <p>
+ * <pre>
+ * var serviceObject = new MyService();
+ * function MyService() {}
+ * </pre>
+ * <p>
+ * Each service method must take [ctx]{@link module:vanadium.context.Context}
+ * and [serverCall]{@link module:vanadium.rpc~ServerCall} as the
+ * first two parameters.
+ * </p>
+ * <p>
+ * The output arguments can be given in several forms - through direct return,
+ * return of a promise or calling a callback that is optionally the
+ * last parameter.
+ * </p>
+ * <pre>
+ * // Sync method that echoes the input text immediately.
+ * MyService.prototype.echo = function(ctx, serverCall, text) {
+ *   return 'Echo: ' + text;
+ * };
+ * </pre>
+ * <pre>
+ * // Async method that echoes the input text after 1 second, using Promises.
+ * MyService.prototype.delayedEcho = function(ctx, serverCall, text) {
+ *   return new Promise(function(resolve, reject) {
+ *     setTimeout(function() {
+ *       resolve('Echo: ' + text);
+ *     }, 1000);
+ *   });
+ * };
+ *</pre>
+ *<pre>
+ * // Async method that echoes the input text after 1 second, using Callbacks.
+ * MyService.prototype.delayedEcho = function(ctx, serverCall, text, callback) {
+ *   setTimeout(function() {
+ *     // first argument to the callback is error, second argument is results
+ *     callback(null, 'Echo: ' + text);
+ *   }, 1000);
+ * };
+ *</pre>
  *
  * @public
  * @param {string} name Name to serve under.
@@ -94,6 +139,7 @@
  * will be called on completion.
  * @return {Promise<void>} Promise to be called when serve completes or fails.
  */
+/* jshint ignore:end */
 Server.prototype.serve = function(name, serviceObject, options, cb) {
   if (typeof options === 'function') {
     cb = options;
@@ -122,13 +168,13 @@
  */
 
 /**
- * A function that returns the service object for a suffix/method pair.
+ * A function that returns the service implementation for the object identified
+ * by the given suffix.
  * @callback module:vanadium.rpc~Server~Dispatcher
  * @param {string} suffix The suffix for the call.
- * @param {string} method The method for the call.
  * @param {module:vanadium.rpc~Server~Dispatcher-callback} cb
  * The callback to call when the dispatch is complete.
- * @return {module:vanadium.rpc~Server~DispatcherResponse | Promise}
+ * @return {Promise<module:vanadium.rpc~Server~DispatcherResponse>}
  * Either the DispatcherResponse object to
  * handle the method call or a Promise that will be resolved the service
  * callback.
diff --git a/test/integration/test-namespace.js b/test/integration/test-namespace.js
index a2cbccb..ee56a42 100644
--- a/test/integration/test-namespace.js
+++ b/test/integration/test-namespace.js
@@ -176,7 +176,7 @@
       runtime = rt;
       var namespace = rt.namespace();
       // Note: Glob will always timeout after 30s
-      // see v.io/x/ref/profiles/internal/naming/namespace/parallelstartcall.go
+      // see v.io/x/ref/runtime/internal/naming/namespace/parallelstartcall.go
       // This means we'll get a timeout error on the glob stream before
       // timeouts.long expires.
       var rpc = namespace.glob(rt.getContext(),