diff --git a/go.mod b/go.mod
index 6c5cd0f..e40377f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,39 +1,66 @@
 module github.com/go-phorce/dolly
 
-go 1.16
+go 1.17
 
 require (
 	github.com/DataDog/datadog-go v4.8.0+incompatible
+	github.com/GeertJohan/go.rice v1.0.0 // indirect
 	github.com/Microsoft/go-winio v0.5.0 // indirect
+	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
+	github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d // indirect
 	github.com/aws/aws-sdk-go v1.40.8
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.1.1 // indirect
 	github.com/cloudflare/cfssl v1.6.0
+	github.com/daaku/go.zipexe v1.0.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-phorce/cov-report v1.1.1-0.20200622030546-3fb510c4b1ba
 	github.com/go-sql-driver/mysql v1.5.0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/certificate-transparency-go v1.0.21 // indirect
 	github.com/google/go-cmp v0.5.6 // indirect
 	github.com/hashicorp/go-immutable-radix v1.0.0
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/jinzhu/copier v0.3.2
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jmhodges/clock v0.0.0-20160418191101-880ee4c33548 // indirect
+	github.com/jmoiron/sqlx v1.2.0 // indirect
 	github.com/jteeuwen/go-bindata v3.0.7+incompatible
 	github.com/juju/errors v0.0.0-20200330140219-3fe23663418f
 	github.com/juju/testing v0.0.0-20210324180055-18c50b0c2098 // indirect
 	github.com/julienschmidt/httprouter v1.3.0
+	github.com/kisielk/sqlstruct v0.0.0-20150923205031-648daed35d49 // indirect
 	github.com/lib/pq v1.7.0 // indirect
 	github.com/mattn/go-sqlite3 v1.14.0 // indirect
 	github.com/mattn/goveralls v0.0.9
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.0.3
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.11.0
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.26.0 // indirect
+	github.com/prometheus/procfs v0.6.0 // indirect
 	github.com/rs/cors v1.7.0
 	github.com/stretchr/objx v0.2.0 // indirect
 	github.com/stretchr/testify v1.7.0
 	github.com/ugorji/go/codec v1.2.6
+	github.com/weppos/publicsuffix-go v0.13.0 // indirect
 	github.com/yuin/goldmark v1.4.0 // indirect
+	github.com/zmap/zcrypto v0.0.0-20201128221613-3719af1573cf // indirect
+	github.com/zmap/zlint/v3 v3.0.0 // indirect
 	golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e
 	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616
+	golang.org/x/mod v0.4.2 // indirect
+	golang.org/x/net v0.0.0-20210614182718-04defd469f4e // indirect
+	golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect
+	golang.org/x/text v0.3.6 // indirect
 	golang.org/x/tools v0.1.4
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/genproto v0.0.0-20210426193834-eac7f76ac494 // indirect
 	google.golang.org/grpc v1.38.0
+	google.golang.org/protobuf v1.26.0 // indirect
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
diff --git a/metrics/const_unix.go b/metrics/const_unix.go
index 31098dd..511202d 100644
--- a/metrics/const_unix.go
+++ b/metrics/const_unix.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package metrics
diff --git a/metrics/const_windows.go b/metrics/const_windows.go
index 38136af..6bb1897 100644
--- a/metrics/const_windows.go
+++ b/metrics/const_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package metrics
diff --git a/tools.go b/tools.go
index 406e616..0ac0546 100644
--- a/tools.go
+++ b/tools.go
@@ -1,5 +1,6 @@
 // Package tools for go mod
 
+//go:build tools
 // +build tools
 
 package tools
diff --git a/xhttp/httperror/errors_test.go b/xhttp/httperror/errors_test.go
index b2a3dcd..e088c7e 100644
--- a/xhttp/httperror/errors_test.go
+++ b/xhttp/httperror/errors_test.go
@@ -66,7 +66,7 @@ func TestError_WriteHTTPResponse(t *testing.T) {
 	many.Add("one", errors.Errorf("test error 1"))
 	many.Add("two", httperror.New(http.StatusBadRequest, httperror.InvalidJSON, "test error 2"))
 
-	manyNil := &httperror.ManyError{}
+	manyNil := &httperror.ManyError{HTTPStatus: http.StatusBadRequest}
 	manyNil.Add("one", errors.Errorf("test error 1"))
 	manyNil.Add("two", httperror.New(http.StatusBadRequest, httperror.InvalidJSON, "test error 2"))
 
diff --git a/xlog/init.go b/xlog/init.go
index b2c1fc0..3f57a8a 100644
--- a/xlog/init.go
+++ b/xlog/init.go
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
+//go:build !windows
 // +build !windows
 
 package xlog
diff --git a/xpki/cryptoprov/uri.go b/xpki/cryptoprov/uri.go
index da93474..1d497cf 100644
--- a/xpki/cryptoprov/uri.go
+++ b/xpki/cryptoprov/uri.go
@@ -67,15 +67,18 @@ func (k *keyURI) ID() string {
 // name if present.
 func ParseTokenURI(uri string) (TokenConfig, error) {
 	u, err := url.Parse(uri)
-	if err != nil || u.Scheme != "pkcs11" {
+	if err != nil {
+		return nil, errors.Annotatef(err, "invalid URI: %s", uri)
+	}
+	if u.Scheme != "pkcs11" {
 		return nil, errors.Annotate(ErrInvalidURI, uri)
 	}
 
 	c := new(tokenConfig)
 
-	pk11PAttr, err := url.ParseQuery(u.Opaque)
+	pk11PAttr, err := url.ParseQuery(strings.ReplaceAll(u.Opaque, ";", "&"))
 	if err != nil {
-		return nil, errors.Annotate(ErrInvalidURI, uri)
+		return nil, errors.Annotatef(err, "invalid URI: %s", uri)
 	}
 
 	setIfPresent(pk11PAttr, "manufacturer", &c.Man)
@@ -115,15 +118,18 @@ func ParseTokenURI(uri string) (TokenConfig, error) {
 // ParsePrivateKeyURI parses a PKCS #11 URI into a key configuration
 func ParsePrivateKeyURI(uri string) (PrivateKeyURI, error) {
 	u, err := url.Parse(uri)
-	if err != nil || u.Scheme != "pkcs11" {
+	if err != nil {
+		return nil, errors.Annotatef(err, "invalid URI: %s", uri)
+	}
+	if u.Scheme != "pkcs11" {
 		return nil, errors.Annotate(ErrInvalidURI, uri)
 	}
 
 	c := new(keyURI)
 
-	pk11PAttr, err := url.ParseQuery(u.Opaque)
+	pk11PAttr, err := url.ParseQuery(strings.ReplaceAll(u.Opaque, ";", "&"))
 	if err != nil {
-		return nil, errors.Annotate(ErrInvalidURI, uri)
+		return nil, errors.Annotatef(err, "invalid URI: %s", uri)
 	}
 
 	setIfPresent(pk11PAttr, "manufacturer", &c.manufacturer)