diff --git a/README.md b/README.md
index 914d1a8..5db692d 100644
--- a/README.md
+++ b/README.md
@@ -31,3 +31,28 @@ https://github.com/virtUOS/opencast-ca-display/assets/1008395/ead22cd2-9d7a-4d26
 - The display and laptop do not know about each other
 - The laptop is running an Opencast capture agent
 - When the laptop starts capturing video, the display shows an active recording
+
+## Opencast User
+
+To improve security, you can limit the access rights for the Opencast user by
+creating a user which has only read access to the capture agent status API and
+nothing else.
+
+To do this, first create a new security rule in your Opencast's
+`etc/security/mh_default_org.xml` allowing read access for a new role
+`ROLE_CAPTURE_AGENT_CALENDAR`:
+
+```xml
+<!-- Enable capture agent updates and ingest -->
+<sec:intercept-url pattern="/capture-admin/agents/**" method="GET" access="ROLE_ADMIN, ROLE_CAPTURE_AGENT, ROLE_CAPTURE_AGENT_CALENDAR" />
+<sec:intercept-url pattern="/capture-admin/**" access="ROLE_ADMIN, ROLE_CAPTURE_AGENT" />
+```
+
+Next, go to the Opencast  REST Docs → `/user-utils` and fill out the form for
+`POST /` with data like this:
+
+- username: `ca-display`
+- password: `secret-password`
+- roles: `["ROLE_CAPTURE_AGENT_CALENDAR"]`
+
+You should now be able to use this new user.
diff --git a/assets/index.js b/assets/index.js
index 2e71d0f..d664013 100644
--- a/assets/index.js
+++ b/assets/index.js
@@ -11,25 +11,37 @@ fetch('/config')
 	setInterval(updateTimer, 2000);
 })
 
+/**
+ * Update the view
+ */
+function updateView(active) {
+	// Update text
+	document.getElementById('text').innerText = active.text;
+
+	// Update colors
+	const body = document.getElementsByTagName('body')[0];
+	body.style.backgroundColor = active.background;
+	body.style.color = active.color;
+
+	// Update logo
+	document.getElementById('logo').src = active.image.replace(/\s/g, '');
+}
+
 /**
  * Check for capture agent status
  */
 function updateTimer() {
 	fetch('/status')
-	.then(response => response.json())
-	.then(capturing => {
+	.then(response => {
+		if (!response.ok) {
+			const active = config.unknown;
+			active.text = response.statusText;
+			updateView(active);
+			throw Error(response.statusText);
+		}
+		return response.json()
+	}).then(capturing => {
 		console.debug('capturing', capturing)
-		const active = capturing ? config.capturing : config.idle;
-
-		// Update text
-		document.getElementById('text').innerText = active.text;
-
-		// Update colors
-		const body = document.getElementsByTagName('body')[0];
-		body.style.backgroundColor = active.background;
-		body.style.color = active.color;
-
-		// Update logo
-		document.getElementById('logo').src = active.image.replace(/\s/g, '');
+		updateView(capturing ? config.capturing : config.idle);
 	})
 }
diff --git a/assets/style.css b/assets/style.css
index d3d74da..d4d0547 100644
--- a/assets/style.css
+++ b/assets/style.css
@@ -12,8 +12,6 @@ body {
 	top: 0;
 	right: 0;
 	width: 10vw;
-	border-left: 0.2vw solid white;
-	border-bottom: 0.2vw solid white;
 }
 
 #text {
diff --git a/main.go b/main.go
index e1bfb9c..4a6bdba 100644
--- a/main.go
+++ b/main.go
@@ -57,6 +57,7 @@ type Config struct {
 	Display struct {
 		Capturing DisplayConfig `json:"capturing"`
 		Idle      DisplayConfig `json:"idle"`
+		Unknown   DisplayConfig `json:"unknown"`
 	}
 
 	Listen string
@@ -120,9 +121,17 @@ func setupRouter() *gin.Engine {
 		req.SetBasicAuth(config.Opencast.Username, config.Opencast.Password)
 		resp, err := client.Do(req)
 		if err != nil {
+			log.Println(err)
 			c.JSON(http.StatusBadGateway, nil)
 			return
 		}
+
+		if resp.StatusCode != 200 {
+			log.Println(resp)
+			c.JSON(resp.StatusCode, nil)
+			return
+		}
+    
 		bodyText, err := io.ReadAll(resp.Body)
 		s := string(bodyText)
 		var result AgentStateResult
diff --git a/opencast-ca-display.yml b/opencast-ca-display.yml
index db6ca93..0d727fb 100644
--- a/opencast-ca-display.yml
+++ b/opencast-ca-display.yml
@@ -110,6 +110,11 @@ display:
       bdf+Ja02rbN0Tm63v7bb1/63qhYAAAAAAAAAAAAAAAAAAAAAAAAAAIDY8w9T
       Gxe/25sMhQAAAABJRU5ErkJggg==
 
+  unknown:
+    text: Unknown
+    color: white
+    background: black
+
 
 # IP address and port to bind to
 listen: 127.0.0.1:8080