diff --git a/src/main/java/dev/kruhlmann/imgfloat/service/AuthorizationService.java b/src/main/java/dev/kruhlmann/imgfloat/service/AuthorizationService.java
index cc70830..847e135 100644
--- a/src/main/java/dev/kruhlmann/imgfloat/service/AuthorizationService.java
+++ b/src/main/java/dev/kruhlmann/imgfloat/service/AuthorizationService.java
@@ -91,7 +91,7 @@ public class AuthorizationService {
 
     public boolean userIsBroadcasterOrChannelAdminForBroadcaster(String broadcaster, String sessionUser) {
         return (
-            userIsBroadcaster(sessionUser, broadcaster) || userIsChannelAdminForBroadcaster(sessionUser, broadcaster)
+            userIsBroadcaster(sessionUser, broadcaster) || userIsChannelAdminForBroadcaster(broadcaster, sessionUser)
         );
     }
 
diff --git a/src/main/resources/static/js/csrf.js b/src/main/resources/static/js/csrf.js
index 43664c1..5b916f5 100644
--- a/src/main/resources/static/js/csrf.js
+++ b/src/main/resources/static/js/csrf.js
@@ -1,8 +1,8 @@
-(function () {
+(function() {
     const CSRF_COOKIE_NAME = "XSRF-TOKEN";
     const DEFAULT_HEADER_NAME = "X-XSRF-TOKEN";
     const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS", "TRACE"]);
-    const originalFetch = window.fetch;
+    const originalFetch = globalThis.fetch;
 
     function getCookie(name) {
         return document.cookie
@@ -13,16 +13,16 @@
     }
 
     function isSameOrigin(url) {
-        const parsed = new URL(url, window.location.href);
-        return parsed.origin === window.location.origin;
+        const parsed = new URL(url, globalThis.location.href);
+        return parsed.origin === globalThis.location.origin;
     }
 
     function getMeta(name) {
-        const el = document.querySelector(`meta[name=\"${name}\"]`);
+        const el = document.querySelector(`meta[name="${name}"]`);
         return el ? el.getAttribute("content") : null;
     }
 
-    window.fetch = function patchedFetch(input, init = {}) {
+    globalThis.fetch = function patchedFetch(input, init = {}) {
         const request = new Request(input, init);
         const method = (request.method || "GET").toUpperCase();
 
diff --git a/src/main/resources/templates/dashboard.html b/src/main/resources/templates/dashboard.html
index 60983b6..436e7a6 100644
--- a/src/main/resources/templates/dashboard.html
+++ b/src/main/resources/templates/dashboard.html
@@ -12,7 +12,7 @@
         <div class="dashboard-shell">
             <header class="dashboard-topbar">
                 <div class="brand">
-                    <img class="brand-mark" src="/img/brand.png" />
+                    <img class="brand-mark" alt="brand" src="/img/brand.png" />
                     <div>
                         <div class="brand-title">Imgfloat</div>
                         <div class="brand-subtitle">Twitch overlay manager</div>
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 877dc03..3c9d418 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -10,7 +10,7 @@
         <div class="landing">
             <header class="landing-header">
                 <div class="brand">
-                    <img class="brand-mark" src="/img/brand.png" />
+                    <img class="brand-mark" alt="brand" src="/img/brand.png" />
                     <div>
                         <div class="brand-title">Imgfloat</div>
                         <div class="brand-subtitle">Twitch overlay manager</div>