From b4db5a8667a5fe150adad68c9fdce51d039cd95b Mon Sep 17 00:00:00 2001
From: bain <bain@bain.cz>
Date: Sat, 1 Jun 2024 22:44:32 +0200
Subject: [PATCH] refactor, rethink, rewrite

---
 Cargo.lock                                    | 114 ++--
 Cargo.toml                                    |   3 +-
 README.md                                     |  25 +-
 src/accounts.rs                               | 165 ++++++
 src/authorization.html                        | 289 ++++++---
 src/homepage.html                             | 127 ++++
 src/main.rs                                   | 556 ++++++++++--------
 src/names.rs                                  |  24 -
 static/fonts.css                              |  39 ++
 .../poppins-v21-latin_latin-ext-700.woff2     | Bin 0 -> 10736 bytes
 ...oppins-v21-latin_latin-ext-700italic.woff2 | Bin 0 -> 11692 bytes
 .../poppins-v21-latin_latin-ext-italic.woff2  | Bin 0 -> 11788 bytes
 .../poppins-v21-latin_latin-ext-regular.woff2 | Bin 0 -> 10832 bytes
 13 files changed, 939 insertions(+), 403 deletions(-)
 create mode 100644 src/accounts.rs
 create mode 100644 src/homepage.html
 delete mode 100644 src/names.rs
 create mode 100644 static/fonts.css
 create mode 100644 static/fonts/poppins-v21-latin_latin-ext-700.woff2
 create mode 100644 static/fonts/poppins-v21-latin_latin-ext-700italic.woff2
 create mode 100644 static/fonts/poppins-v21-latin_latin-ext-italic.woff2
 create mode 100644 static/fonts/poppins-v21-latin_latin-ext-regular.woff2

diff --git a/Cargo.lock b/Cargo.lock
index e230e29..5c491ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -82,8 +82,9 @@ dependencies = [
  "ring",
  "serde",
  "serde_json",
+ "serde_yaml",
  "tide",
- "toml",
+ "tide-serve-dir-macro",
 ]
 
 [[package]]
@@ -1382,6 +1383,15 @@ version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "semver"
 version = "0.9.0"
@@ -1448,15 +1458,6 @@ dependencies = [
  "thiserror",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -1469,6 +1470,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha1"
 version = "0.6.1"
@@ -1738,6 +1752,18 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "tide-serve-dir-macro"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0569876d14d685e8047bb24104c2e5c36768507cb0e3bc719b962c10d08c6e8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "walkdir",
+]
+
 [[package]]
 name = "time"
 version = "0.2.27"
@@ -1791,40 +1817,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
-[[package]]
-name = "toml"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd79e69d3b627db300ff956027cc6c3798cef26d22526befdfcd12feeb6d2257"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime",
- "toml_edit",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.19.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned",
- "toml_datetime",
- "winnow",
-]
-
 [[package]]
 name = "tracing"
 version = "0.1.40"
@@ -1878,6 +1870,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -1944,6 +1942,16 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
 
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "wasi"
 version = "0.9.0+wasi-snapshot-preview1"
@@ -2050,6 +2058,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
+[[package]]
+name = "winapi-util"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@@ -2196,12 +2213,3 @@ name = "windows_x86_64_msvc"
 version = "0.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0770833d60a970638e989b3fa9fd2bb1aaadcf88963d1659fd7d9990196ed2d6"
-
-[[package]]
-name = "winnow"
-version = "0.5.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
-dependencies = [
- "memchr",
-]
diff --git a/Cargo.toml b/Cargo.toml
index 1ef894f..fc5de3e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,8 +10,9 @@ async-std = { version = "1.8.0", features = ["attributes"] }
 tide = { version = "0.16.0", features = [] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+serde_yaml = "0.9.34"
 ring = { version = "0.17.8", features = ["std"] }
 anyhow = "1.0.70"
 base64 = "0.21.0"
-toml = "0.7.3"
 hex = "0.4.3"
+tide-serve-dir-macro = "0.1"
diff --git a/README.md b/README.md
index 540079e..45168b2 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,10 @@
-# ^NON
+# ^NON \[anon\]
 
-Extremely rudimentary OIDC provider. Users hold account numbers from which
+Extremely rudimentary OIDC provider. Users hold account codes from which
 their identities are derived on-demand.
 
 Each identity is separate for different services, but can be accessed from a
-single account number. ^NON does not have a database of the users, so nobody
+single account code. ^NON does not have a database of the users, so nobody
 can correlate user information across services.
 
 ## Installation
@@ -14,4 +14,21 @@ can correlate user information across services.
 2. fill out `config.toml.sample`. The server expects a file called
    `config.toml` in its working directory.
 
-3. Enjoy :)
+3. Generate the keypair for signing JWT tokens with:
+   ```bash
+   openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 | \
+      openssl pkcs8 -topk8 -nocrypt -outform der > rsa-key.pk8
+   ```
+
+4. Enjoy :)
+
+## Deployment notes
+
+When deploying, you should be aware of the potential of a birthday attack on
+the system. For `v1` of the account code, we should expect a collision after
+about `2^36` unique accounts, which means that, without rate-limiting, there is
+the potential to brute-force an account / accidentally log into someone else's
+account. You should consider the amount of users which will use the system, and
+set up a rate-limiter.
+
+Improbable things happen all the time, so better safe than sorry :)
diff --git a/src/accounts.rs b/src/accounts.rs
new file mode 100644
index 0000000..1c66307
--- /dev/null
+++ b/src/accounts.rs
@@ -0,0 +1,165 @@
+/// v1 of the account identificators
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use ring::rand::{SecureRandom, SystemRandom};
+use serde_json::{json, Value};
+
+const ADJECTIVES: &[&'static str] = &[
+    "Affinity", "Artisan", "Benevolent", "Breezy", "Cheerful", "Compass",
+    "Curious", "Eager", "Ebullient", "Effervescent", "Esteem", "Evergreen",
+    "Flourish", "Genuine", "Grounded", "Harmony", "Inventive", "Journey",
+    "Jubilant", "Kaleidoscope", "Kaleidoscopic", "Kindred", "Marvel", "Melodious",
+    "Optimistic", "Resilient", "Riverstone", "Serendipitous", "Serendipity", "Serene",
+    "Sincere", "Skybound", "Sparkling", "Sprightly", "Stardust", "Stargazer",
+    "Starry", "Steadfast", "Sunbeam", "Tapestry", "Tenacious", "Upbeat",
+    "Valiant", "Verdant", "Vigorous", "Wanderlust", "Whimsical", "Witty",
+    "Wonderstruck", "Zephyr",
+];
+
+const ANIMALS: &[&'static str] = &[
+    "Axolotl", "Badger", "Baku", "Butterfly", "Capybara", "Carbuncle",
+    "Chameleon", "Cheetah", "Deer", "Dolphin", "Dryad", "Echidna",
+    "Elephant", "Fennec Fox", "Flamingo", "Fox", "Fu", "Gnome",
+    "Hippocampus", "Hippogriff", "Hippopotamus", "Hummingbird", "Iguana", "Kangaroo",
+    "Kelpie", "Kirin", "Koala", "Dragon", "Leviathan", "Lion",
+    "Lynx", "Manatee", "Manok", "Meerkat", "Mooncalf", "Naiad",
+    "Narwhal", "Orangutan", "Owl", "Panda", "Parrot", "Peacock",
+    "Penguin", "Phoenix", "Pixie", "Qilin", "Quokka", "Raccoon",
+    "Otter", "Seahorse", "Serpent", "Simurgh", "Sphynx", "Sprite",
+    "Squirrel", "Sylph", "Tapir", "Toucan", "Turtle", "Unicorn",
+    "Whale", "Ziz",
+];
+
+fn checksum(ns: &[u8]) -> u8 {
+    (ns.iter().enumerate().fold(0, |acc, b| {
+        if b.0 % 2 == 0 {
+            acc + *b.1 as i32 * 2
+        } else {
+            acc + *b.1 as i32
+        }
+    }) % 36) as u8
+}
+
+pub fn normalize(account: &str) -> Option<String> {
+    // we interpret the account "number" in ASCII
+    let account_low = account.to_lowercase();
+
+    if account_low.chars().next() != Some('a') {
+        return None;
+    }
+
+    let ns: Vec<u8> = account_low
+        .bytes()
+        .filter_map(|b| {
+            // base-36
+            match b {
+                b'0'..=b'9' => Some(b - b'0'),
+                b'a'..=b'z' => Some(b - b'a' + 10),
+                _ => None,
+            }
+        })
+        .collect();
+
+    if ns.len() != 16 {
+        return None;
+    }
+
+    // Calculate the checksum (modified Luhn's algorithm)
+    let checksum = checksum(&ns[..ns.len() - 1]);
+
+    if *ns.last().unwrap() != checksum {
+        return None;
+    }
+
+    Some(account_low)
+}
+
+pub fn generate_account() -> anyhow::Result<String> {
+    let mut code = Vec::with_capacity(16);
+    code.push(10); // 'a'
+
+    let rng = SystemRandom::new();
+    'outer: loop {
+        let mut bytes = [0u8; 14];
+        rng.fill(&mut bytes)?;
+
+        for byte in bytes {
+            if byte > u8::MAX - u8::MAX % 36 {
+                continue;
+            }
+
+            code.push(byte % 36);
+
+            if code.len() == 15 {
+                break 'outer;
+            }
+        }
+    }
+
+    code.push(checksum(&code));
+
+    Ok(String::from_utf8(
+        code.iter()
+            .map(|n| match n {
+                0..=9 => b'0' + n,
+                10..=35 => b'a' + n - 10,
+                _ => unreachable!(),
+            })
+            .collect(),
+    )?
+    .to_uppercase())
+}
+
+pub fn create_id_token_claims(
+    salt: &str,
+    issuer_uri: &str,
+    client_id: &str,
+    normalized_account: &str,
+    nonce: Option<&str>,
+) -> Value {
+    // we can expect that
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("no time travelling allowed before 1970")
+        .as_secs();
+
+    use ring::hmac;
+    let mangler = hmac::Key::new(
+        hmac::HMAC_SHA256,
+        (salt.to_owned() + &normalized_account).as_bytes(),
+    );
+
+    let mangle = |what: &str| {
+        let tag = hmac::sign(&mangler, (what.to_owned() + client_id).as_bytes());
+        hex::encode(tag.as_ref())
+    };
+    let choose = |what: &str, from: &[&'static str]| {
+        let tag = hmac::sign(&mangler, (what.to_owned() + client_id).as_bytes());
+        let mut bytes: [u8; 4] = [0; 4];
+        bytes.copy_from_slice(tag.as_ref());
+        from[i32::from_le_bytes(bytes) as usize % from.len()]
+    };
+
+    let adjective = choose("family_name", ADJECTIVES);
+    let animal = choose("given_name", ANIMALS);
+
+    let mut body = json!({
+        "kid": "master",
+        "iss": issuer_uri,
+        "sub": mangle("sub")[..32],
+        "aud": client_id,
+        "exp": now + crate::TOKEN_EXPIRATION,
+        "iat": now,
+        "given_name": animal,
+        "family_name": adjective,
+        "email": mangle("email")[..24].to_owned()+"@email.invalid",
+        "email_verified": false,
+        "preferred_username": adjective.to_owned()+animal,
+    });
+
+    if let Some(nonce) = nonce {
+        body["nonce"] = nonce.into();
+    }
+
+    body
+}
diff --git a/src/authorization.html b/src/authorization.html
index 02f120f..41395c3 100644
--- a/src/authorization.html
+++ b/src/authorization.html
@@ -4,10 +4,10 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="initial-scale=1.0, width=device-width" />
-    <title></title>
+    <title>{{issuer_name}}: log into {{client_name}}</title>
     <link href="/static/style.css" rel="stylesheet" />
     <style>
-        @import url('https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap');
+        @import url('/static/fonts.css');
 
         :root {
             --background: rgb(24, 24, 27);
@@ -21,7 +21,6 @@
 
         .issuer-name {
             color: var(--primary);
-            font-weight: bolder;
         }
 
         .issuer-name a {
@@ -40,9 +39,9 @@
             width: 19ch;
             border: none;
             padding: 0.4rem 1rem;
-            padding-right: 0;
             background: none;
             color: inherit;
+            text-transform: uppercase;
         }
 
         @media only screen and (max-width: 40em) {
@@ -56,10 +55,13 @@
         }
 
         html {
-            height: 100vmin;
+            height: 100vh;
         }
 
         body {
+            display: flex;
+            flex-direction: column;
+            height: 100vh;
             background: var(--background);
             color: var(--text);
             font-family: Poppins, sans-serif;
@@ -67,9 +69,10 @@
             box-sizing: border-box;
         }
 
-        main {
+        .center {
             margin: 20vmin auto 0;
             width: min-content;
+            flex-grow: 1;
         }
 
         .client-name {
@@ -98,26 +101,23 @@
         }
 
         .container button {
-            display: inline-flex;
-            align-items: center;
-            margin: 3px 1rem 0;
+            margin: 6px 1rem 0 0;
         }
 
-        button {
+        button, input[type=submit] {
             background: none;
             border: none;
             color: var(--text);
             cursor: pointer;
         }
 
-        .login-button {
+        form .login-button {
             background: var(--secondary);
-            padding: 0.8rem;
+            padding: 0.5rem 0.8rem;
             font-weight: bold;
             font-size: larger;
-            width: 100%;
-            margin: 0.5rem 0 0;
             border-radius: 5px;
+            margin-left: auto;
         }
 
         .login-button:hover {
@@ -133,6 +133,10 @@
             color: inherit;
         }
 
+        .hidden {
+            display: none;
+        }
+
         .info-accounts {
             background: var(--caution-darker);
             width: 100%;
@@ -148,11 +152,12 @@
             opacity: 0;
         }
 
-        button[data-closed="false"] .closed {
+
+        button[data-state="password"] .closed {
             display: none;
         }
 
-        button[data-closed="true"] .open {
+        button[data-state="visible"] .open {
             display: none;
         }
 
@@ -170,80 +175,147 @@
                 color: #fefefe;
             }
         }
+
+        .login-action-container {
+            margin: 0.5rem 0 0;
+            display: flex;
+            width: 100%;
+        }
+
+        .login-action-container > a {
+            text-decoration: none;
+            font-size: medium;
+            font-weight: bold;
+            align-content: center;
+
+            :hover {
+                text-decoration: underline;
+            }
+        }
+
+        .notice:empty {
+            display: none;
+        }
+
+        noscript {
+            margin-top: 3rem;
+        }
+
+        footer {
+            width: max-content;
+            margin: 1.5em auto;
+        }
     </style>
 </head>
 
 <body>
-    <main>
-        <h1 class="issuer-name"><a href="/">^NON</a> : {{issuer_name}}</h1>
-        <h1 lang="en">You are logging into</h1>
-        <h1 lang="cs" hidden>Přihlašujete se do</h1>
-        <p class="client-name">{{name}}</p>
-        <div class="container" id="accICont">
-            <input id="accInput" inputmode="numeric" autocomplete="current-password" autofocus type="password"
-                class="account-number-input" placeholder="0000000000000000" maxlength="16" />
-            <button id="showHideButton" data-closed="false" type="button" onclick="toggleInputType()">
-                <svg class="open" xmlns="http://www.w3.org/2000/svg" height="24" fill="currentColor"
-                    viewBox="0 -960 960 960" width="24">
-                    <path
-                        d="M480-320q75 0 127.5-52.5T660-500q0-75-52.5-127.5T480-680q-75 0-127.5 52.5T300-500q0 75 52.5 127.5T480-320Zm0-72q-45 0-76.5-31.5T372-500q0-45 31.5-76.5T480-608q45 0 76.5 31.5T588-500q0 45-31.5 76.5T480-392Zm0 192q-146 0-266-81.5T40-500q54-137 174-218.5T480-800q146 0 266 81.5T920-500q-54 137-174 218.5T480-200Zm0-300Zm0 220q113 0 207.5-59.5T832-500q-50-101-144.5-160.5T480-720q-113 0-207.5 59.5T128-500q50 101 144.5 160.5T480-280Z" />
-                </svg>
-                <svg class="closed" xmlns="http://www.w3.org/2000/svg" height="24" fill="currentColor" viewBox="0 -960 960 960" width="24">
-                    <path
-                        d="m644-428-58-58q9-47-27-88t-93-32l-58-58q17-8 34.5-12t37.5-4q75 0 127.5 52.5T660-500q0 20-4 37.5T644-428Zm128 126-58-56q38-29 67.5-63.5T832-500q-50-101-143.5-160.5T480-720q-29 0-57 4t-55 12l-62-62q41-17 84-25.5t90-8.5q151 0 269 83.5T920-500q-23 59-60.5 109.5T772-302Zm20 246L624-222q-35 11-70.5 16.5T480-200q-151 0-269-83.5T40-500q21-53 53-98.5t73-81.5L56-792l56-56 736 736-56 56ZM222-624q-29 26-53 57t-41 67q50 101 143.5 160.5T480-280q20 0 39-2.5t39-5.5l-36-38q-11 3-21 4.5t-21 1.5q-75 0-127.5-52.5T300-500q0-11 1.5-21t4.5-21l-84-82Zm319 93Zm-151 75Z" />
-                </svg>
-            </button>
-        </div>
-        <div>
-            <button class="login-button" onclick="login()" type="button">
-                <span lang="en">Log in</span><span lang="cs" hidden>Přihlásit se</span></button>
-            <p class="generate-text"><a href="javascript:void(0)" onclick="generateAccount()">
-                    <span lang="en">or generate a new account number</span>
-                    <span lang="cs" hidden>nebo vytvořit nové číslo</span>
-                </a></p>
+    <div class="center">
+        <noscript>Enable JS to save the account in your browser</noscript>
+        <main>
+            <h1 class="issuer-name"><a href="/" target="_blank">^NON</a> : {{issuer_name}}</h1>
+            <h1>
+                    <span lang="en">Logging into:</span>
+                    <span lang="cs" hidden>Přihlášení:</span>
+                    <span style="font-weight:normal"> {{client_name}}</span>
+            </h1>
+
+            <form id="loginForm" name="login" method="post" enctype="application/x-www-form-urlencoded" >
+                <div class="container" id="accInputCont">
+                    <input id="accInput" name="account" inputmode="numeric" autocomplete="current-password" autofocus type="password"
+                        class="account-number-input" placeholder="0000000000000000" maxlength="16" required />
+                    <button hidden id="showCodeButton" data-state="password" type="button" onclick="toggleInputType()">
+                        <svg class="open" xmlns="http://www.w3.org/2000/svg" height="24" fill="currentColor"
+                            viewBox="0 -960 960 960" width="24">
+                            <path
+                                d="M480-320q75 0 127.5-52.5T660-500q0-75-52.5-127.5T480-680q-75 0-127.5 52.5T300-500q0 75 52.5 127.5T480-320Zm0-72q-45 0-76.5-31.5T372-500q0-45 31.5-76.5T480-608q45 0 76.5 31.5T588-500q0 45-31.5 76.5T480-392Zm0 192q-146 0-266-81.5T40-500q54-137 174-218.5T480-800q146 0 266 81.5T920-500q-54 137-174 218.5T480-200Zm0-300Zm0 220q113 0 207.5-59.5T832-500q-50-101-144.5-160.5T480-720q-113 0-207.5 59.5T128-500q50 101 144.5 160.5T480-280Z" />
+                        </svg>
+                        <svg class="closed" xmlns="http://www.w3.org/2000/svg" height="24" fill="currentColor" viewBox="0 -960 960 960" width="24">
+                            <path
+                                d="m644-428-58-58q9-47-27-88t-93-32l-58-58q17-8 34.5-12t37.5-4q75 0 127.5 52.5T660-500q0 20-4 37.5T644-428Zm128 126-58-56q38-29 67.5-63.5T832-500q-50-101-143.5-160.5T480-720q-29 0-57 4t-55 12l-62-62q41-17 84-25.5t90-8.5q151 0 269 83.5T920-500q-23 59-60.5 109.5T772-302Zm20 246L624-222q-35 11-70.5 16.5T480-200q-151 0-269-83.5T40-500q21-53 53-98.5t73-81.5L56-792l56-56 736 736-56 56ZM222-624q-29 26-53 57t-41 67q50 101 143.5 160.5T480-280q20 0 39-2.5t39-5.5l-36-38q-11 3-21 4.5t-21 1.5q-75 0-127.5-52.5T300-500q0-11 1.5-21t4.5-21l-84-82Zm319 93Zm-151 75Z" />
+                        </svg>
+                    </button>
+                </div>
+                <div class="login-action-container">
+                    <a id="newAccountButton" href="/new-account" target="_blank">
+                            <span class="generate" lang="en">Generate new account</span>
+                            <span class="generate" lang="cs" hidden>Generovat nový účet</span>
+                            <span class="login-once hidden" lang="en">Log in once</span>
+                            <span class="login-once hidden" lang="cs" hidden>Přihlásit se jednou</span>
+                    </a>
+                    <button id="loginButton" class="login-button">
+                            <!-- this will get changed to "Log in" by JS -->
+                            <span id="loginButtonText" lang="en">Log in once</span>
+                            <span lang="cs" hidden>Přihlásit se</span>
+                    </button>
+                </div>
+            </form>
+
             <p id="infoBox" hidden class="info-accounts hidden">
-                <span lang="en"><b>Careful!</b> Your account number is the only way to access your accounts. Keep it
-                    somewhere safe and out of sight!</span>
-                <span lang="cs" hidden><b>Pozor!</b> Toto číslo je jediný způsob, jak se přihlásit k vašim účtům.
-                    Poznamenejte si ho a s nikým ho nesdílejte.</span>
+                <span lang="en">
+                    <b>Careful!</b> This code is the only way to access your accounts. Keep it
+                    somewhere safe and out of sight!
+                </span>
+                <span lang="cs" hidden>
+                    <b>Pozor!</b> Tento kód je jediný způsob, jak se přihlásit k vašim účtům.
+                    Poznamenejte si ho a s nikým ho nesdílejte.
+                </span>
             </p>
-        </div>
-    </main>
+            <p class="info-accounts notice">{{notice}}</p>
+        </main>
+    </div>
+        <footer>
+            <a href="/" target="_blank">What is this?</a>
+            <span id="forgetAccountButton" hidden> · <a href="javascript:forget()">Forget account</a></span>
+        </footer>
     <script>
-        accInput.addEventListener("beforeinput", ev => {
-            if (!/[0-9]*/.test(ev.data)) {
+
+        accInput.addEventListener("input", ev => {
+            const p = [...accInput.value.replace(/ +/g, "")];
+            if (p.length == 16) {
+                const payload = p.slice(0, p.length - 1);
+
+                accInputCont.dataset.valid = p[0].toLowerCase() == 'a' && calculateChecksum(payload) == p[p.length - 1].toLowerCase();
+            } else {
+                accInputCont.dataset.valid = "pending";
+            }
+
+            updateSecondaryAction();
+
+            if (accInput.type != "password") formatInput();
+        });
+
+        loginForm.addEventListener("submit", ev => {
+            if (accInputCont.dataset.valid != "true") {
                 ev.preventDefault();
                 return;
             }
-        });
 
-        accInput.addEventListener("input", ev => {
-            if (accInput.value.length == accInput.maxLength) {
-                const p = [...accInput.value.replace(/ +/g, "")];
-                const payload = p.slice(0, p.length - 1);
-                accICont.dataset.valid = calculateLuhnPrime(payload) == p[p.length - 1];
-            } else {
-                accICont.dataset.valid = "pending";
+            accInput.value = accInput.value.replace(/ +/g, "");
+
+            if (ev.submitter === loginButton) {
+                window.localStorage.setItem("code", accInput.value);
             }
-            if (accInput.type == "password") return;
-            formatInput();
         });
 
         function formatInput() {
             const caret = accInput.selectionStart;
-            const digitsBeforeCaret = accInput.value.slice(0, caret).replace(/ +/g, "").length;
-            const offset = Math.floor(digitsBeforeCaret / 4);
-            // const offset = Math.floor(caret/4) - (caret % 4 == 0);
+
+
             const formatted = [...accInput.value.replace(/ +/g, "")].map((c, i) => i != 0 && i % 4 == 0 ? " " + c : c).join("");
+
             if (formatted != accInput.value) {
+                const digitsBeforeCaret = accInput.value.slice(0, caret).replace(/ +/g, "").length;
+                const offset = Math.floor(digitsBeforeCaret / 4);
+
                 accInput.value = formatted;
+
                 accInput.selectionStart = digitsBeforeCaret + offset;
                 accInput.selectionEnd = digitsBeforeCaret + offset;
             }
         }
         function toggleInputType() {
-            showHideButton.dataset.closed = showHideButton.dataset.closed == "true" ? "false" : "true"
-            if (accInput.type == "password") {
+            showCodeButton.dataset.state = showCodeButton.dataset.state == "visible" ? "password" : "visible";
+            if (showCodeButton.dataset.state == "visible") {
                 accInput.maxLength = 19;
                 accInput.placeholder = "0000 0000 0000 0000";
                 formatInput();
@@ -256,50 +328,91 @@
             }
         }
 
-        function login() {
-            if (accICont.dataset.valid != "true") return;
-            const digits = accInput.value.replace(/ +/g, "");
-            window.localStorage.setItem("code", digits);
-            let params = new URLSearchParams(window.location.search);
-            params.set("uid", digits);
-            window.location.search = params;
+        function updateSecondaryAction() {
+            newAccountButton.target = "_self";
+
+            if (accInputCont.dataset.valid == 'true') {
+                document.querySelectorAll('.generate').forEach(el => el.classList.add('hidden'))
+                document.querySelectorAll('.login-once').forEach(el => el.classList.remove('hidden'))
+                newAccountButton.href = 'javascript:loginForm.submit()';
+            } else {
+                document.querySelectorAll('.generate').forEach(el => el.classList.remove('hidden'))
+                document.querySelectorAll('.login-once').forEach(el => el.classList.add('hidden'))
+                newAccountButton.href = 'javascript:generateAccountHandler()';
+            }
+        }
+
+        function parseDigit(d) {
+            const n = d.toLowerCase().charCodeAt(0);
+            return n - 48 - (n > 96) * 39;
+        }
+
+        function makeDigit(d) {
+            // ascii code of the number (offset 48 for 0-9, offset 97 for a-z)
+            return String.fromCharCode(39 * (d > 9) + 48 + d);
         }
 
         /**
-         * Luhn algorithm with some changes so people don't put in their credit cards :)
+         * checksum inspired by Luhn's algorithm
          */
-        function calculateLuhnPrime(payload) {
-            const sum = payload.map(Number).reduce((a, b, i) => a + (i % 2 == 0 ? [...String(b * 2)].map(Number).reduce((i, j) => i + j) : b), 0);
-            return sum % 10;
+        function calculateChecksum(payload) {
+            const sum = payload.map(parseDigit).reduce((a, b, i) => a + (i % 2 == 0 ? 2*b : b), 0);
+            return makeDigit(sum % 36);
         }
 
         function generateAccount() {
-            accInput.type != "text" && toggleInputType();
+            let code = "a";
 
-            let array = new Uint8Array(15);
-            window.crypto.getRandomValues(array);
-            let accNumber = [...array].map(n => String(Math.floor(n / 255 * 10))).join("");
+            // Unfortunately here we have to repeatedly sample random values
+            // until they're smaller than the biggest multiple of 36 in a byte.
+            // Otherwise we would have an uneven distribution.
+            let array = new Uint8Array(14);
+            outer: while (true) {
+                window.crypto.getRandomValues(array);
 
-            accNumber += calculateLuhnPrime([...accNumber]);
+                for (let i = 0; i < array.length; i++) {
+                    if (array[i] >= 255 - 255 % 36) continue;
+
+                    code += makeDigit(array[i] % 36);
+                    if (code.length === 15) break outer;
+                }
+            }
+
+            return code + calculateChecksum([...code]);
+        }
+
+        function generateAccountHandler() {
+            accInput.value = generateAccount();
+            accInputCont.dataset.valid = true;
 
-            accInput.value = accNumber;
-            accICont.dataset.valid = true;
             formatInput();
+            updateSecondaryAction();
 
             infoBox.hidden = false;
             setTimeout(() => infoBox.classList.toggle("hidden", false), 0);
         }
 
-        const savedCode = window.localStorage.getItem("code");
-        if (savedCode) {
-            accInput.value = savedCode;
-            accICont.dataset.valid = true;
+        function forget() {
+            window.localStorage.removeItem("code");
+            window.location.reload();
         }
 
+        // show JS-only features
+        showCodeButton.removeAttribute('hidden');
+        loginButtonText.innerText = "Log in";
+
         // i18n :)
         if (document.body.querySelectorAll(`[lang="${navigator.language.slice(0, 2)}"]`).length)
             document.body.querySelectorAll('[lang]').forEach(el => navigator.language.startsWith(el.lang) ? el.removeAttribute('hidden') : el.remove());
 
+        const savedCode = window.localStorage.getItem("code");
+        if (savedCode) {
+            accInput.value = savedCode;
+            accInputCont.dataset.valid = true;
+            forgetAccountButton.hidden = false;
+        }
+
+        updateSecondaryAction();
     </script>
 </body>
 
diff --git a/src/homepage.html b/src/homepage.html
new file mode 100644
index 0000000..41aecfc
--- /dev/null
+++ b/src/homepage.html
@@ -0,0 +1,127 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="initial-scale=1.0, width=device-width" />
+    <title>^NON at {{issuer_name}}</title>
+    <style>
+        @import url('/static/fonts.css');
+
+        :root {
+            --background: rgb(24, 24, 27);
+            --text: #fefefe;
+            --primary: #606060;
+            --secondary: #303035;
+            --success: #76B041;
+            --caution: #9E2A2B;
+            --caution-darker: #c83033;
+        }
+
+        .header {
+            color: var(--primary);
+            font-weight: bolder;
+            font-size: 32pt;
+        }
+
+        .header span {
+            color: var(--text);
+        }
+
+        body {
+            background: var(--background);
+            color: var(--text);
+            font-family: Poppins, sans-serif;
+            margin: 0;
+            box-sizing: border-box;
+            font-size: 16pt;
+        }
+
+        .center {
+            margin: 20vmin 5em 0;
+            width: min(95vw, 40em);
+        }
+
+        a {
+            color: var(--text);
+            font-weight: bold;
+        }
+
+        div[data-acc="no"] > .acc {
+            display: none;
+        }
+
+        div[data-acc="yes"] > .no-acc {
+            display: none;
+        }
+
+        @media only screen and (max-width: 60em) {
+            .center {
+                margin: 1em;
+            }
+        }
+
+        @media (prefers-color-scheme: light) {
+            :root {
+                --background: #fefefe;
+                --text: #2f2f2f;
+                --primary: #b0b0b0;
+                --secondary: #d9d9d9;
+                --success: #76B041;
+                --caution: #FF6B6C;
+                --caution-darker: #c83033;
+            }
+        }
+    </style>
+</head>
+
+<body>
+    <div class="center">
+        <main>
+            <h1 lang="en" class="header">This is <span>^NON</span></h1>
+            <h1 lang="cs" hidden class="header">Toto je <span>^NON</span></h1>
+            <p lang="en">An anonymous identity provider for accessing services from <span>{{issuer_name}}</span>.</p>
+            <p lang="cs" hidden>Zprostředkovatel anonymní identity pro služby od <span>{{issuer_name}}</span>.</p>
+            <div id="savedAccount" data-acc="no">
+                <p class="no-acc" lang="en">No account saved in browser.</p>
+                <p class="no-acc" lang="cs" hidden>Žádný uložený účet.</p>
+                <p class="acc" lang="en">Account saved in browser. <a href="javascript:forget()">Forget?</a></p>
+                <p class="acc" lang="cs" hidden>V prohlížeči je uložený účet. <a href="javascript:forget()">Zapomenout?</a></p>
+            </div>
+
+            <div lang="en">
+                <h2>How does it work?</h2>
+                <p>
+                    ^NON [anon] creates your identities for different services based on an account code, which you can generate
+                    during login. Each service gets a different identity, so nobody can connect data between them. You,
+                    on the other hand, can connect to all of them using only a single account code.
+                </p>
+                <p>You can check out the technical details <a href="https://git.nolog.cz/nolog.cz/anon">here</a>.</p>
+            </div>
+
+            <div lang="cs" hidden>
+                <h2>Jak to funguje?</h2>
+                <p>
+                    ^NON [anon] vytváří vaše identity pro různé služby pomocí vašeho přihlašovacího kódu, který si můžete vygenerovat
+                    při přihlášení. Ke každé službě máte odlišnou identitu, takže mezi nimi není možné spojit vaše data. Vy se
+                    na druhou stranu můžete ke všem službám přihlásit použitím pouze jednoho přihlašovacího kódu.
+                </p>
+                <p>Technické detaily si můžete prozkoumat <a href="https://git.nolog.cz/nolog.cz/anon">zde</a>.</p>
+            </div>
+        </main>
+    </div>
+    <script>
+        function forget() {
+            window.localStorage.removeItem("code");
+            window.location.reload();
+        }
+
+        if (window.localStorage.getItem("code") != null) savedAccount.dataset.acc = "yes";
+
+        // i18n :)
+        if (document.body.querySelectorAll(`[lang="${navigator.language.slice(0, 2)}"]`).length)
+            document.body.querySelectorAll('[lang]').forEach(el => navigator.language.startsWith(el.lang) ? el.removeAttribute('hidden') : el.remove());
+    </script>
+</body>
+
+</html>
diff --git a/src/main.rs b/src/main.rs
index 90a95eb..8dd59a5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,13 +1,15 @@
-mod names;
+mod accounts;
+
 use async_std::fs;
 use async_std::fs::File;
 use async_std::sync::Mutex;
 use ring::rand::SecureRandom;
 use ring::rand::SystemRandom;
-use serde_json::Value;
 use std::collections::HashMap;
 use std::collections::LinkedList;
 use std::env;
+use std::sync::atomic::AtomicUsize;
+use std::sync::atomic::Ordering;
 use std::sync::Arc;
 use std::time::SystemTime;
 use std::time::UNIX_EPOCH;
@@ -16,7 +18,7 @@ use tide::log;
 use tide::prelude::json;
 use tide::Request;
 use tide::Response;
-use toml::Table;
+use tide_serve_dir_macro::auto_serve_dir;
 
 use anyhow::{anyhow, Result};
 use async_std::io::ReadExt;
@@ -27,149 +29,38 @@ use std::fmt;
 
 use base64::{engine::general_purpose as base64_coder, Engine as _};
 
+const TOKEN_EXPIRATION: u64 = 600;
+const AUTHORIZATION_EXPIRATION: u64 = 60;
+
 #[derive(Deserialize, Clone)]
 pub struct Client {
-    pub name: String,
-    pub client_secret: String,
-    pub redirect_uris: Vec<String>,
+    name: String,
+    client_secret: String,
+    redirect_uris: Vec<String>,
 }
 
 #[derive(Deserialize)]
 pub struct Config {
-    pub host: String,
-    pub port: u16,
-    pub clients: Table,
-    pub issuer_uri: String,
-    pub issuer_name: String,
-    pub rsa_key_file: String,
-    pub salt: String,
+    host: String,
+    port: u16,
+    clients: HashMap<String, Client>,
+    issuer_uri: String,
+    issuer_name: String,
+    rsa_key_file: String,
+    salt: String,
 }
 
 impl Config {
     pub async fn from_file(file: &mut File) -> Result<Config> {
         let mut buf = String::new();
         file.read_to_string(&mut buf).await?;
-        match toml::from_str::<Config>(&buf) {
+        match serde_yaml::from_str::<Config>(&buf) {
             Ok(v) => Ok(v),
             Err(e) => Err(anyhow!("failed to parse config file: {}", e)),
         }
     }
 }
 
-async fn error_handler(mut res: tide::Response) -> tide::Result {
-    if let Some(err) = res.downcast_error::<OAuthError>() {
-        res.set_body(tide::Body::from_json(err)?);
-        res.set_status(400);
-    }
-    Ok(res)
-}
-
-async fn authorize(req: Request<AppState>) -> tide::Result {
-    #[derive(Deserialize)]
-    struct Query {
-        // response_type: String,
-        client_id: String,
-        // scope: String, // dont care rn
-        state: String,
-        redirect_uri: String,
-        uid: Option<String>,
-        code_challenge: Option<String>,
-        code_challenge_method: Option<String>,
-        nonce: Option<String>,
-    }
-    let q: Query = req.query()?;
-
-    let i = req
-        .state()
-        .clients
-        .get(&q.client_id)
-        .ok_or(OAuthError::new("invalid_client", "Unknown client"))?;
-
-    // return the login page
-    if q.uid.is_none() {
-        return Ok(Response::builder(200)
-            .body(
-                // I could use a rendering library here, but its literally as simple as replacing
-                // two strings.
-                include_str!("authorization.html")
-                    .replace("{{name}}", &i.name)
-                    .replace("{{issuer_name}}", &req.state().issuer_name),
-            )
-            .header("Content-Type", "text/html")
-            .into());
-    }
-
-    let uid = q.uid.unwrap();
-
-    // check redirect uri validity
-    if i.redirect_uris.iter().all(|r| r.as_str() != q.redirect_uri) {
-        return Err(OAuthError::new("invalid_redirect", "").into());
-    }
-
-    let random = SystemRandom::new();
-    let mut salt = [0u8; 32];
-    random.fill(&mut salt)?;
-
-    let code = base64_coder::URL_SAFE_NO_PAD.encode(&salt);
-
-    let redirect =
-        Url::parse_with_params(&q.redirect_uri, &[("state", &q.state), ("code", &code)])?;
-
-    let pkce = if q.code_challenge.is_some() && q.code_challenge_method.is_some() {
-        Some(PKCE {
-            challenge: q.code_challenge.unwrap(),
-            method: q.code_challenge_method.unwrap(),
-        })
-    } else {
-        None
-    };
-
-    let timestamp = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs();
-
-    let mut auths = req.state().authorizations.lock().await;
-
-    // clean up old authorizations
-    while let Some(s) = auths.expirations.front() {
-        if s.1 > timestamp {
-            break;
-        }
-        let s = auths.expirations.pop_front().unwrap();
-        auths.auths.remove(&s.0);
-    }
-
-    auths.auths.insert(
-        code.clone(),
-        Authorization {
-            client_id: q.client_id,
-            uid,
-            redirect_uri: q.redirect_uri,
-            pkce,
-            nonce: q.nonce,
-            exp: timestamp + 60,
-        },
-    );
-    auths.expirations.push_back((code.clone(), timestamp + 60));
-
-    let mut resp = Response::new(302);
-    resp.insert_header("Location", redirect.as_str());
-
-    Ok(resp)
-}
-
-fn parse_basic_auth(header: &str) -> Option<(String, String)> {
-    let v = header.strip_prefix("Basic ")?;
-
-    let parsed = String::from_utf8(base64_coder::STANDARD.decode(v).ok()?).ok()?;
-
-    let parts: Vec<&str> = parsed.split(':').take(2).collect();
-
-    if parts.len() != 2 {
-        return None;
-    }
-
-    Some((parts[0].to_owned(), parts[1].to_owned()))
-}
-
 #[derive(Debug, Serialize)]
 pub struct OAuthError {
     pub error: String,
@@ -193,65 +84,208 @@ impl fmt::Display for OAuthError {
 
 impl Error for OAuthError {}
 
-fn create_id_token_claims(
-    salt: &str,
-    issuer_uri: &str,
-    client_id: &str,
-    uid: &str,
+async fn error_handler(res: tide::Response) -> tide::Result {
+    if let Some(err) = res.downcast_error::<OAuthError>() {
+        return Ok(tide::Response::builder(400)
+            .body(tide::Body::from_json(err)?)
+            .build());
+    }
+    Ok(res)
+}
+
+#[derive(Deserialize)]
+struct AuthorizationQuery {
+    response_type: String,
+    client_id: String,
+    redirect_uri: String,
+    state: Option<String>,
+    code_challenge: Option<String>,
+    code_challenge_method: Option<String>,
     nonce: Option<String>,
-) -> anyhow::Result<Value> {
-    let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs();
+    // scope: String, // we only issue tokens with the "openid email" scope
+}
 
-    use ring::hmac;
-    let mangler = hmac::Key::new(hmac::HMAC_SHA256, (salt.to_owned() + uid).as_bytes());
+fn redirect_with_query(redirect_uri: &str, query: &[(&str, Option<&str>)]) -> tide::Result {
+    let filtered = query.into_iter().filter_map(|x| x.1.map(|v| (x.0, v)));
+    let redirect = Url::parse_with_params(redirect_uri, filtered)?;
+    Ok(tide::Redirect::new(redirect).into())
+}
 
-    let mangle = |what: &str| {
-        let tag = hmac::sign(&mangler, (what.to_owned() + client_id).as_bytes());
-        hex::encode(tag.as_ref())
-    };
-    let choose = |what: &str, from: &[&'static str]| {
-        let tag = hmac::sign(&mangler, (what.to_owned() + client_id).as_bytes());
-        let bytes = tag.as_ref();
-        let mut i: usize = 0;
-        i = (i << 8) + bytes[0] as usize;
-        i = (i << 8) + bytes[1] as usize;
-        i = (i << 8) + bytes[2] as usize;
-        i = (i << 8) + bytes[3] as usize;
-        from[i % from.len()]
-    };
+fn render_login_page(client_name: &str, issuer_name: &str, notice: &str) -> tide::Response {
+    Response::builder(200)
+        .body(
+            // I could use a rendering library here, but its literally as simple as replacing
+            // a few strings from a trusted config.
+            include_str!("authorization.html")
+                .replace("{{client_name}}", client_name)
+                .replace("{{issuer_name}}", issuer_name)
+                .replace("{{notice}}", notice),
+        )
+        .header("Content-Type", "text/html")
+        .into()
+}
+async fn login_page_endpoint(req: Request<AppState>) -> tide::Result {
+    let query: AuthorizationQuery = req.query()?;
 
-    let adjective = choose("family_name", names::ADJECTIVES);
-    let animal = choose("given_name", names::ANIMALS);
+    let client = req
+        .state()
+        .config
+        .clients
+        .get(&query.client_id)
+        .ok_or(OAuthError::new("invalid_client", "Unknown client"))?;
 
-    // Generate an identity unique to the specified client_id
-    // This way nobody can take data from different clients and correlate
-    // user information. Since we don't even keep logs here, there is no
-    // way to know who is who.
-    let mut body = json!({
-        "kid": "master",
-        "iss": issuer_uri,
-        "sub": mangle("sub")[0..32],
-        "aud": client_id,
-        "exp": now+600,
-        "iat": now,
-        "given_name": animal,
-        "family_name": adjective,
-        "email": mangle("email")[0..15].to_owned()+"@email.invalid",
-        "email_verified": false,
-        "preferred_username": adjective.to_owned()+animal,
-    });
-
-    if let Some(nonce) = nonce {
-        body["nonce"] = nonce.into();
+    // check redirect uri validity
+    if client
+        .redirect_uris
+        .iter()
+        .all(|r| r.as_str() != query.redirect_uri)
+    {
+        return Err(OAuthError::new("invalid_redirect", "").into());
     }
 
-    Ok(body)
+    if query.response_type != "code" {
+        return redirect_with_query(
+            query.redirect_uri.as_str(),
+            &[
+                ("state", query.state.as_deref()),
+                ("error", Some("unsupported_response_type")),
+            ],
+        );
+    }
+
+    Ok(render_login_page(
+        &client.name,
+        &req.state().config.issuer_name,
+        "",
+    ))
+}
+
+async fn authorize_endpoint(mut req: Request<AppState>) -> tide::Result {
+    req.state().total_logins.fetch_add(1, Ordering::Relaxed);
+
+    let query: AuthorizationQuery = req.query()?;
+
+    #[derive(Deserialize)]
+    struct LoginForm {
+        account: String,
+        //csrf_token: String,
+    }
+
+    let body: LoginForm = req.body_form().await?;
+
+    let client = req
+        .state()
+        .config
+        .clients
+        .get(&query.client_id)
+        // only devs should see this error
+        .ok_or(OAuthError::new("invalid_client", "Unrecognized client"))?;
+
+    if client
+        .redirect_uris
+        .iter()
+        .all(|r| r.as_str() != query.redirect_uri)
+    {
+        // only devs should see this error
+        return Err(OAuthError::new("invalid_redirect", "").into());
+    }
+
+    if query.response_type != "code" {
+        return redirect_with_query(
+            query.redirect_uri.as_str(),
+            &[
+                ("state", query.state.as_deref()),
+                ("error", Some("unsupported_response_type")),
+            ],
+        );
+    }
+
+    let account_code = accounts::normalize(&body.account);
+    if account_code.is_none() {
+        let mut login_page = render_login_page(
+            &client.name,
+            &req.state().config.issuer_name,
+            "Account code incorrect",
+        );
+        login_page.set_status(400);
+        return Ok(login_page);
+    }
+    let account_code = account_code.unwrap();
+
+    let pkce = if query.code_challenge.is_some() && query.code_challenge_method.is_some() {
+        Some(PKCE {
+            challenge: query.code_challenge.unwrap(),
+            method: query.code_challenge_method.unwrap(),
+        })
+    } else {
+        None
+    };
+
+    let mut code = [0u8; 32];
+    SystemRandom::new().fill(&mut code)?;
+
+    let code = base64_coder::URL_SAFE_NO_PAD.encode(&code);
+
+    let redirect = redirect_with_query(
+        query.redirect_uri.as_str(),
+        &[("state", query.state.as_deref()), ("code", Some(&code))],
+    )?;
+
+    let timestamp = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs();
+
+    {
+        let mut auths = req.state().authorizations.lock().await;
+
+        // clean up old authorizations
+        while let Some(s) = auths.expirations.front() {
+            if s.1 > timestamp {
+                break;
+            }
+
+            let s = auths.expirations.pop_front().unwrap();
+
+            if auths.auths.remove(&s.0).is_some() {
+                req.state().expired_logins.fetch_add(1, Ordering::Relaxed);
+            }
+        }
+
+        auths.auths.insert(
+            code.clone(),
+            Authorization {
+                client_id: query.client_id,
+                account: account_code,
+                redirect_uri: query.redirect_uri,
+                pkce,
+                nonce: query.nonce,
+                exp: timestamp + AUTHORIZATION_EXPIRATION,
+            },
+        );
+        auths
+            .expirations
+            .push_back((code.clone(), timestamp + AUTHORIZATION_EXPIRATION));
+    }
+
+    Ok(redirect)
+}
+
+fn parse_basic_auth(header: &str) -> Option<(String, String)> {
+    let v = header.strip_prefix("Basic ")?;
+
+    let parsed = String::from_utf8(base64_coder::STANDARD.decode(v).ok()?).ok()?;
+
+    let parts: Vec<&str> = parsed.split(':').take(2).collect();
+
+    if parts.len() != 2 {
+        return None;
+    }
+
+    Some((parts[0].to_owned(), parts[1].to_owned()))
 }
 
 fn create_id_token(
     app_state: &AppState,
     client_id: &str,
-    uid: &str,
+    normalized_account: &str,
     nonce: Option<String>,
 ) -> anyhow::Result<String> {
     let header = base64_coder::URL_SAFE_NO_PAD.encode(
@@ -263,13 +297,13 @@ fn create_id_token(
     );
 
     let claims = base64_coder::URL_SAFE_NO_PAD.encode(
-        create_id_token_claims(
-            &app_state.salt,
-            &app_state.issuer_uri,
+        accounts::create_id_token_claims(
+            &app_state.config.salt,
+            &app_state.config.issuer_uri,
             client_id,
-            uid,
-            nonce,
-        )?
+            normalized_account,
+            nonce.as_deref(),
+        )
         .to_string(),
     );
 
@@ -287,7 +321,7 @@ fn create_id_token(
     Ok(format!("{}.{}", message, signature))
 }
 
-async fn authenticate(mut req: Request<AppState>) -> tide::Result {
+async fn authenticate_endpoint(mut req: Request<AppState>) -> tide::Result {
     #[derive(Deserialize)]
     struct Body {
         grant_type: String,
@@ -313,18 +347,20 @@ async fn authenticate(mut req: Request<AppState>) -> tide::Result {
                 return None;
             }
             Some((body.client_id.unwrap(), body.client_secret.unwrap()))
-        });
-    let credentials = credentials.ok_or(OAuthError::new(
-        "invalid_client",
-        "Credentials not found in Basic auth or in req body",
-    ))?;
+        })
+        .ok_or(OAuthError::new(
+            "invalid_client",
+            "Credentials not found in Basic auth or in req body",
+        ))?;
 
     // authenticate client
     let client_info = req
         .state()
+        .config
         .clients
         .get(&credentials.0)
         .ok_or(OAuthError::new("invalid_client", "Unknown client"))?;
+
     if ring::constant_time::verify_slices_are_equal(
         credentials.1.as_bytes(),
         &client_info.client_secret.as_bytes(),
@@ -335,7 +371,7 @@ async fn authenticate(mut req: Request<AppState>) -> tide::Result {
     }
 
     // check authorization code
-    // this actuall consumes the code. It is not possible to retry auth with the same
+    // this actually consumes the code. It is not possible to retry auth with the same
     // authorization code. It's always the client's fault, so we don't care really.
     let code_info = {
         let mut auths = req.state().authorizations.lock().await;
@@ -354,8 +390,7 @@ async fn authenticate(mut req: Request<AppState>) -> tide::Result {
     }
 
     // verify PKCE if the client used it
-    if code_info.pkce.is_some() {
-        let pkce = code_info.pkce.unwrap();
+    if let Some(pkce) = code_info.pkce {
         let code_verifier = body
             .code_verifier
             .ok_or(OAuthError::new("invalid_request", "PKCE not present"))?;
@@ -364,12 +399,11 @@ async fn authenticate(mut req: Request<AppState>) -> tide::Result {
             "S256" => {
                 let sha_digest =
                     ring::digest::digest(&ring::digest::SHA256, code_verifier.as_bytes());
-                let a = base64_coder::URL_SAFE_NO_PAD.encode(sha_digest.as_ref());
-                a
+                Ok(base64_coder::URL_SAFE_NO_PAD.encode(sha_digest.as_ref()))
             }
-            _ => pkce.challenge.clone(), // not the best, but since the only other option is
-                                         // "plain", then I guess its fine
-        };
+            "plain" => Ok(pkce.challenge.clone()),
+            _ => Err(OAuthError::new("invalid_request", "invalid PKCE method")),
+        }?;
 
         // Needs constant time equality checking since we might be comparing plain text.
         // This is a non-issue when using the S265 method
@@ -383,16 +417,26 @@ async fn authenticate(mut req: Request<AppState>) -> tide::Result {
         }
     }
 
+    // The token is random because there are no resources protected by the token anyways.
+    let mut access_token = [0u8; 32];
+    SystemRandom::new().fill(&mut access_token)?;
+    let access_token = base64_coder::URL_SAFE_NO_PAD.encode(&access_token);
+
+    req.state()
+        .successful_logins
+        .fetch_add(1, Ordering::Relaxed);
+
     // give access code
     Ok(Response::builder(200).body(json!({
-        "access_token": "SOME-TOKEN",
+        "access_token": access_token,
         "token_type": "Bearer",
-        "expires_in": 600,
-        "id_token": create_id_token(req.state(), &credentials.0, &code_info.uid, code_info.nonce)?,
+        "expires_in": TOKEN_EXPIRATION,
+        "id_token": create_id_token(req.state(), &credentials.0, &code_info.account, code_info.nonce)?,
+        "scope": "openid profile email"
     })).into())
 }
 
-async fn jwks(req: Request<AppState>) -> tide::Result {
+async fn jwks_endpoint(req: Request<AppState>) -> tide::Result {
     let pk: ring::rsa::PublicKeyComponents<Vec<u8>> = req.state().signing_key.public().into();
     Ok(Response::builder(200)
         .body(json!({
@@ -408,35 +452,77 @@ async fn jwks(req: Request<AppState>) -> tide::Result {
 }
 
 async fn configuration_endpoint(req: Request<AppState>) -> tide::Result {
-    let uri = Url::parse(&req.state().issuer_uri)?;
+    let uri = Url::parse(&req.state().config.issuer_uri)?;
     Ok(Response::builder(200)
         .body(json!({
             "issuer": uri,
             "authorization_endpoint": uri.join("/authorize")?,
             "token_endpoint": uri.join("/token")?,
             "jwks_uri": uri.join("/jwks")?,
-            "response_types_supported": ["code", "id_token"],
+            "response_types_supported": ["code"],
             "subject_types_supported": ["pairwise"],
             "id_token_signing_alg_values_supported": ["RS256"],
         }))
         .into())
 }
 
+async fn homepage_endpoint(req: Request<AppState>) -> tide::Result {
+    Ok(Response::builder(200)
+        .body(
+            include_str!("homepage.html")
+                .replace("{{issuer_name}}", &req.state().config.issuer_name),
+        )
+        .header("Content-Type", "text/html")
+        .into())
+}
+
+/// fallback endpoint for non-JS users
+async fn create_account_endpoint(_req: Request<AppState>) -> tide::Result {
+    Ok(Response::builder(200)
+        .body(format!(
+            "Your account number is: {}.\nKeep it safe and out of sight!",
+            accounts::generate_account()?
+        ))
+        .header("Content-Type", "text/plain")
+        .into())
+}
+
+async fn metrics_endpoint(req: Request<AppState>) -> tide::Result {
+    Ok(Response::builder(200)
+        .body(format!(
+            r#"
+# TYPE logins_total counter
+logins_total {}
+# TYPE logins_expired counter
+logins_expired {}
+# TYPE logins_success counter
+logins_success {}
+"#,
+            req.state().total_logins.load(Ordering::Relaxed),
+            req.state().expired_logins.load(Ordering::Relaxed),
+            req.state().successful_logins.load(Ordering::Relaxed),
+        ))
+        .header("Content-Type", "text/plain; version=0.0.4")
+        .into())
+}
+
 pub struct AuthStore {
     pub auths: HashMap<String, Authorization>,
     pub expirations: LinkedList<(String, u64)>,
 }
 
-#[derive(Clone)]
-pub struct AppState {
-    pub clients: Arc<HashMap<String, Client>>,
-    pub authorizations: Arc<Mutex<AuthStore>>,
-    pub issuer_uri: String,
-    pub issuer_name: String,
-    pub signing_key: Arc<ring::rsa::KeyPair>,
-    pub salt: String,
+pub struct AppStateRaw {
+    pub config: Config,
+    pub authorizations: Mutex<AuthStore>,
+    pub signing_key: ring::rsa::KeyPair,
+    pub total_logins: AtomicUsize,
+    pub successful_logins: AtomicUsize,
+    pub expired_logins: AtomicUsize,
+    pub server_errors: AtomicUsize,
 }
 
+type AppState = Arc<AppStateRaw>;
+
 pub struct PKCE {
     pub challenge: String,
     pub method: String,
@@ -444,7 +530,7 @@ pub struct PKCE {
 
 pub struct Authorization {
     pub client_id: String,
-    pub uid: String,
+    pub account: String,
     pub redirect_uri: String,
     pub pkce: Option<PKCE>,
     pub nonce: Option<String>,
@@ -453,43 +539,47 @@ pub struct Authorization {
 
 #[async_std::main]
 async fn main() -> anyhow::Result<()> {
-    // log::start();
+    log::with_level(log::LevelFilter::Debug);
 
     let mut conf_file =
-        File::open(env::var("CONFIG_FILE").unwrap_or("config.toml".to_owned())).await?;
+        File::open(env::var("CONFIG_FILE").unwrap_or("config.yml".to_owned())).await?;
     let config = Config::from_file(&mut conf_file).await?;
 
-    let mut clients: HashMap<String, Client> = HashMap::new();
-    for c in config.clients {
-        clients.insert(c.0, c.1.try_into()?);
-    }
+    let bind_address = format!("{}:{}", &config.host, &config.port);
 
-    let key_data = fs::read(&config.rsa_key_file).await?;
+    let signing_key = ring::rsa::KeyPair::from_pkcs8(&fs::read(&config.rsa_key_file).await?)?;
 
-    let mut app = tide::with_state(AppState {
-        clients: Arc::new(clients),
-        authorizations: Arc::new(Mutex::new(AuthStore {
+    let mut app = tide::with_state(Arc::new(AppStateRaw {
+        config,
+        authorizations: Mutex::new(AuthStore {
             auths: HashMap::new(),
             expirations: LinkedList::new(),
-        })),
-        issuer_uri: config.issuer_uri,
-        issuer_name: config.issuer_name,
-        salt: config.salt,
-        signing_key: Arc::new(
-            ring::rsa::KeyPair::from_pkcs8(&key_data)?,
-        ),
-    });
+        }),
+        signing_key,
+        total_logins: AtomicUsize::new(0),
+        successful_logins: AtomicUsize::new(0),
+        expired_logins: AtomicUsize::new(0),
+        server_errors: AtomicUsize::new(0),
+    }));
 
     app.with(tide::utils::After(error_handler));
 
-    app.at("/authorize").get(authorize);
-    app.at("/token").post(authenticate);
-    app.at("/jwks").get(jwks);
+    app.at("/").get(homepage_endpoint);
+    app.at("/authorize")
+        .get(login_page_endpoint)
+        .post(authorize_endpoint);
+    app.at("/token").post(authenticate_endpoint);
+    app.at("/jwks").get(jwks_endpoint);
     app.at("/.well-known/openid-configuration")
         .get(configuration_endpoint);
+    app.at("/new-account").get(create_account_endpoint);
+    app.at("/metrics").get(metrics_endpoint);
 
-    app.listen(format!("{}:{}", config.host, config.port))
-        .await?;
+    auto_serve_dir!(app, "/static", "static");
+
+    println!("Server started at {}", &bind_address);
+
+    app.listen(bind_address).await?;
 
     Ok(())
 }
diff --git a/src/names.rs b/src/names.rs
deleted file mode 100644
index 66c9dc9..0000000
--- a/src/names.rs
+++ /dev/null
@@ -1,24 +0,0 @@
-pub const ADJECTIVES: &[&'static str] = &[
-    "Affinity", "Artisan", "Benevolent", "Breezy", "Cheerful", "Compass", "Curious",
-    "Eager", "Ebullient", "Effervescent", "Esteem", "Evergreen", "Flourish", "Genuine",
-    "Grounded", "Harmony", "Inventive", "Journey", "Jubilant", "Kaleidoscope", "Kaleidoscopic",
-    "Kindred", "Marvel", "Melodious", "Optimistic", "Resilient", "Riverstone", "Serendipitous",
-    "Serendipity", "Serene", "Sincere", "Skybound", "Sparkling", "Sprightly",
-    "Stardust", "Stargazer", "Starry", "Steadfast", "Sunbeam", "Tapestry",
-    "Tenacious", "Upbeat", "Valiant", "Verdant", "Vigorous", "Wanderlust",
-    "Whimsical", "Witty", "Wonderstruck", "Zephyr"
-];
-
-pub const ANIMALS: &[&'static str] = &[
-    "Axolotl", "Badger", "Baku", "Butterfly", "Capybara", "Carbuncle",
-    "Chameleon", "Cheetah", "Deer", "Dolphin", "Dryad", "Echidna",
-    "Elephant", "Fennec Fox", "Flamingo", "Fox", "Fu", "Gnome",
-    "Hippocampus", "Hippogriff", "Hippopotamus", "Hummingbird", "Iguana", "Kangaroo",
-    "Kelpie", "Kirin", "Koala", "Dragon", "Leviathan", "Lion",
-    "Lynx", "Manatee", "Manok", "Meerkat", "Mooncalf", "Naiad",
-    "Narwhal", "Orangutan", "Owl", "Panda", "Parrot", "Peacock",
-    "Penguin", "Phoenix", "Pixie", "Qilin", "Quokka", "Raccoon",
-    "Otter", "Seahorse", "Serpent", "Simurgh", "Sphynx", "Sprite",
-    "Squirrel", "Sylph", "Tapir", "Toucan", "Turtle", "Unicorn",
-    "Whale", "Ziz"
-];
diff --git a/static/fonts.css b/static/fonts.css
new file mode 100644
index 0000000..5385548
--- /dev/null
+++ b/static/fonts.css
@@ -0,0 +1,39 @@
+/* Generated using https://gwfh.mranftl.com/fonts/poppins?subsets=latin,latin-ext */
+/* Uses the Poppins font from Google Fonts */
+
+/* poppins-regular - latin_latin-ext */
+@font-face {
+  font-display: swap; /* Check https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-display for other options. */
+  font-family: 'Poppins';
+  font-style: normal;
+  font-weight: 400;
+  src: url('fonts/poppins-v21-latin_latin-ext-regular.woff2') format('woff2'); /* Chrome 36+, Opera 23+, Firefox 39+, Safari 12+, iOS 10+ */
+}
+
+/* poppins-italic - latin_latin-ext */
+@font-face {
+  font-display: swap; /* Check https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-display for other options. */
+  font-family: 'Poppins';
+  font-style: italic;
+  font-weight: 400;
+  src: url('fonts/poppins-v21-latin_latin-ext-italic.woff2') format('woff2'); /* Chrome 36+, Opera 23+, Firefox 39+, Safari 12+, iOS 10+ */
+}
+
+/* poppins-700 - latin_latin-ext */
+@font-face {
+  font-display: swap; /* Check https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-display for other options. */
+  font-family: 'Poppins';
+  font-style: normal;
+  font-weight: 700;
+  src: url('fonts/poppins-v21-latin_latin-ext-700.woff2') format('woff2'); /* Chrome 36+, Opera 23+, Firefox 39+, Safari 12+, iOS 10+ */
+}
+
+/* poppins-700italic - latin_latin-ext */
+@font-face {
+  font-display: swap; /* Check https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-display for other options. */
+  font-family: 'Poppins';
+  font-style: italic;
+  font-weight: 700;
+  src: url('fonts/poppins-v21-latin_latin-ext-700italic.woff2') format('woff2'); /* Chrome 36+, Opera 23+, Firefox 39+, Safari 12+, iOS 10+ */
+}
+
diff --git a/static/fonts/poppins-v21-latin_latin-ext-700.woff2 b/static/fonts/poppins-v21-latin_latin-ext-700.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..6b4c85da89152af88c9e47d97f3d36985b4d1052
GIT binary patch
literal 10736
zcmV<MDG%0nPew8T0RR9104eYQ3;+NC0ALIN04baR0RR9100000000000000000000
z0000R9vm(PU;u)63W1k!`acVWKmY+Y0we>9d;}l`gG2|7DjUX46>MCM2Im2gsLy{I
zQ3M+Y!eP7?MVTbE+5evsI2j_XTcGN9;l`pxK#4UO&EA@WuA?**uCRjZ^~!#)n}`*J
zEPDTNp@8fN#9|&hv>#8Uj+<E@{X1;la;F}hFT3Pwmd|taM`-MmT%PBDfAH;d?)%b^
zeI^1*be;s~S-*~%#SW-4!uRT@ue*R;cHt?lH|5jyxI@A+?yupB6G)T-U&%mvDImGa
zrS;+Yx%ChQ1)Hd`pf+H^#-i8;tY8dSvk{Kmh=@^jVuMOceFPKZ0Q;i!PQ|F;qLB6n
z6#qZyrXH%t&sj60qC+wW7A!T4Jg@6R4D!Dg01CBbB(HgV@PJeW$})p<n%LG3Spkv_
zXg49p|J8um*av{Ewu*zv)OlPyBk%v|EL&+ub3_U-wCfFbD%}Uml+xFXXf*c9c=p-{
z-Xr!Ac;wrAv%3K~=nYVnv`Iw-RnlRZF5HwU+BQYg<fr{wRn*%=Bven0t`E_Vn6{4(
zBJvl!K_ZHu?)vPRNP=r7?JhLYkgiv8-}b705)L67)L1>^MX=iaJC^VKm%S%(?z)PU
zYpk`z5<;lsf4_N*%@*z>QX2#YC@66U|DRKUwGIJecI@$CO0b#%m|(#_<-p9bw&NAB
zh{X1)#KVCoeC=hVcGfD;t&IYllGe#ZNC`)2wL_y-zLk^C5JrH0V4v+*I{!cTm9%6x
ze=p!RfbQ3GfW5jLUSKTWjydF+E0eVR3_PpU{L(f!LRBoyT;d*LXb~qm$*Ia$*_Nfc
zRNL8p)7!nfM+1Bj{twa?>5POUkw`bB7m|tO(@!HOk*AS!C>xZU+h#Yrp`hWrLFtc`
z89bO!!$?@-Vq7u)U&rUGfq#bojkG~JB4I0-k$UQX2{M113+A(Vah{)N=d6=XIOd2$
z`t_pR#r-c8Y&>pfA1mia&Z9jdKk|P>dPIDLe*}AE^B`vKBmh4=@K8LL`9RVR0W*h}
z*r>W9T1?8t@3C(HIU3k@6M&sx0btdG!1A1g0z6^b(N*b6GzbHi;cc#+%+_f|dqdXh
zFpBIh3EY0U^=ueQhgPY=NT>rCl;fq%FcpnqQ4Dz=l8P9_EqbBdl-@j}wvQoPyBn^o
zP3L&6qv%UyG^d?lz0jj=i-b`IZb@zAE!=)xt=OFiU6*#NRlMUd1*hpiq&;LV?CVS1
z3TdXT_sS`fFF{SyLGesiZhFgRJ;hI9hLhZg?-EQM<19zg3N_i4)KFrN0`VGpz7SJT
z@KP59POhL8JNCU5Jp@_XUc*vhQ?9+fi5${LpAlN_XAGqm7o=&XEe;MDl~)-e!-M*5
z*ZX&ZvJtP-5oE)tF^{@14xx_U7teJLV!))f8Jitln6fzem5N@`r>{)Lq5Y9nBzjEP
zd+JEx?{9i2z5Qw8$5%E%;YQTh3jh~q14YstvBzp0Ly<j__{ZI5J4%k#MOBIoc@Rf6
z(x_x*_d68dSBm!R$JcI@J_tYB=B$g!CfQtQV)A@)cE|Kshtd}KoDDG<5cL8BS*t;O
zkh4GJerE$>_S_z9qJ<`wq1U0>?B6iCve_BLSD1z%X-Q-t07|KyGO{v@2rw5AUX$kn
zN;jL5pUoiqLW&H9PkPP?LRMLP@K}7I2GhkzIu6>xMT3}m@rhm3I~T;_j7^wDrLnCy
z&a!@~EPwfsjD79BqdUg?5%hS4(h|f6PqZI?c>k+eymN&;KSJgp{*~n$DQ;u(r4ji}
zwsH#t+1Q$id<b$ez2GM5wM9gwO-e{*)s`#*0zwI%4Oltk7K#XrLL-qa7Bnfn?Zfpm
zXV)isXc<&$?bEu^(sX7z0@RzAbX<-sFtHze>$1bIla_ySJT=O}!+Uld^!|E>kit&Z
z7zhYm!J!GSpW7OEnxpv9K4(*yOja&EfOKocBkDKwHY1xemTcEKlJb8b=I&`>a$$Oh
zk!PYc^M*qz>*fR6=W?yFs}RqLBMh?E&UwOD+E5l$4AyF7>F()9OU1$tp##TDv&Xg|
zwL<!;AUWKYtpfBM<XLLXZZYFX_Qsx$&}=!{T08>r5YRImOeCl+!oaM*-`@o{ai4Xx
zDahkG$(pl4O}_atfwxjzntwQ5&2`|J%OiM;rd`yZCe{I4!HM0M&1U*^q_GDK1QyI2
z5Q6#bo*I>c{U$a-3*J$qO?qi)kZxMmV9nA!Lkqo{)r73w0o|(AZ07Qqv5LX${l@CN
zLlw)aZkfitEgGxyJaSYhFfWIxzhPV?@Cadkj7xyW%MXs?fW^pOUudxiEH6UJOVx48
z$rVj|4EtXTzd2X2t)=iOvnc(HUCy(FKn9fvJx%sSP-o4GHrK;pG@R>Rql;=zh^lUS
z8<rI0*4S3;R6_>{YYTx|6`!KhL<<@~eHhICBX8szMw-Zd2`x33tY$|wkT_wUp{y9T
ziL|UgxRF*U$6U@CL9236=S+9zy@J~chvxawmu(pF?71y}=HMulNt@qR(n%WWgsi1)
zxbV{~KwiP4>zRZ78cN_BeTNkyM+F>hIt<u?_jXNgFN}WMSP;Gs)Z^S!G*z+0mXs0n
z3C1PwAS2Ra;23<%HI|VI*R-&$7>$}{rLVAc=VPBfr1yXKo4(m<1o62wXWJ<*X)!S3
zh3g`bD&;3O@Z;-zpZM{5apYLhXb2hTi8lp;c$~xO0b3)!siBW{dApk@jfmXgg~}6M
zYIc7<g9&-au=5NonaWE<@FPXa{AKJas15iYYwc@o>dQ;MSmQrPj_z{_*;Z2cQ|Hq)
ztWpL0fa8tkRbb`~ZeDv{JkA+4v~4%umu4tM)Sg6^PUv=mtF++rgE@Q(Vbe9!rioz6
zuUl$p(Utm?GRp5iR4u2u=3c@cEQWmYUc7_k(62BF4N>;zoH>*|=u4kK-TH<BgE+$)
zf?VS)iM$A3gd40;opfFkmb}85u2%Ug8x~qd^_p%uh{ylTSVS`2B<r`y8<N-0##zd!
zH+3!F?BNOyU}R?7@_lnk?=a~ECevJLAIQr=d&K4lvPSsD&_%_UoLw;$Y8XHJLG=br
zWFk+u;&ocD9AlG|8F&hWWB`bgCI)n?Z4H09POz3Nn_u95?N@*EdU;AE^n9P<mGscs
z>@h$AtlM;%qAl2MHxiI1P?_$bI*s~nTBZ^iq>Ed&3iDEmLE$YAp7c_Cea4HKb7iDu
zqn}Afz*J%P6mP8<SPJ&2)DPVCR+pj;QF(<evsu>LuXt;2LZw)Fel}Ks!2!!>Awj)m
z7^6E20`6@J$d1-UutIotV=_3}j2@Q>#lmO_-%P(q*x{GjSs5HeO8q>QbyW)Mk3_@i
z)5a50(kZ{?gw3(m!1~lx@shLb9b<dCj#D8hTbWZJc6v$7pC&-l|0ck*f#==XaqYl$
z>$V?VtizA%?i~-wLDUF(k0^<}W|=qXiN6}$f*&cuzY3S=UksVTE6pVHOlxlq;NPV;
z>_r4g2W!o4@q7Y{)NCt_dQQN#e(I!|IN*k}a$I_2YoXfj$2s=FcQkO!N7jz|s<Bs<
zesaupcIk9c)g!Z%z`<p-k!SGQE(QlXG?B;5?a2#6&TWTeD3-2Jc_}q%o?t7fWPyp`
zC|erTZKa3D{LEynM+wFFAt60^mYBhcsPcq@6hH?06bDF!y0Rtx2!Wr^5>IS~uwO0{
zkW5tH6~bI{(Shu23DlIg2@Au8@1(J>V%WTG#Kuux;^VDZl4kDT!)P#dfl6mkAfQud
zR3tQoYo)E!+T#+rE-()Oco*hE=TQJ>@>*Ow!Vav~5&U9?ih-}^v*$T+^>vmB5NBi|
zFc)!*pv=+NtlOaj>Cxu(89F?=9RwCTfaCXF1~Mqd!YHe|C&7+qRnKOX#Ne$c)Lw%u
z7QyQH$>58ieqoWvBQx_@q<v4t$Xu0MO|3IYid>!DI@)h;wc?Wl4zL#FIOU~^Gr4>9
z52ou%<RpT*?jfWp_Hoi0VJ);pqOzELQLdcWGOenao`)an{C_ybXEyY2YeTP)XsZ<&
zpmXS8z)Vs*b)OBI6PYM|^D4GEs~`K~fn6l$YNK)7OCwP`^5{p_l9vjg0~@dhy5zFQ
z&ddUQ^6GcBldIQiAnQN`{_40P)k6IQO%WV17<N%_bcX#FgpePC3BMC!@)A7*J+SfZ
zXu+Fzwh<%-QJ{JxYaX`jL!4Lc1kA}Wemi5j>ul+fcovXNiW(Y8K@v!3TXlkoU;Ib<
z^DW}l-9KMFAoA{|KxH4_5{P?r@c4oIjM{&<n~vhw2Zs-xdLbk6vTyUl--E27hXw>*
zK%z>=o-CMf+emg_J9YPNgRygNz7yu5hp>4U5-8!_r-}V|9Lv`(X}cdG-Z#L!=k&Ke
zC%z~2z`W2)R9$Y_X$%WbK;QN}`j*dA=3^#I?3#4_)a#P2QT@zY_ctEGhUM>>4~I2v
z=5!r!;+*>9PiVlM(qP5wvA{!*SUW2K<*!_F&JO%=+@-dpryIGaAJoV;a!1dU*41+u
zvAv(DkzGbb4|`;OH;#bF9rTzireuYTCr@2%$}o?eiT3N2+QfJY6d}=#nW+{sp3G=j
znrabyLUnns++OQ0l#8>S9{tpI?4xUUnJ3H{{MQNKc`=&M&}fZJ7OfI71ta@w&KzLT
zZBYWgpF@|MfJiBhZuHq@ckoT_)oa9Un*-4BIQoz#SuvTX4-68f2~mAIcapy>0nZm~
zArcgu2CRN^bo|fW?%>Z8Bet3JaEPFu@EAKVTt(TtOXR`z8YC&;$iVshbkB*&Y@d|a
zv5iJUu3Jxcrc0t><2cxGWg|h3=<b;Z8pnZSHK<2SPT0OMeGJ$&LrX66Df4EfCTbi_
zg$|~KsDSh`pHehE#h`YoD|V^_^o>(T29Hd2PaPdRItBjNp9Rlkz=7U!4vM-Qo!NLX
z_kf@P>sEhh$BvlEsaN_`OOkJfKmaV6zah%P&(FgDWATAAv(N7K5f%^+q2eQR4ANYx
zcdVD!82NyilAoJH5fqn{CZu=G<fzxT{aFpDMRobPk~Dv+mL3!+pI=!Us1b1JaTydz
zNoS#X(TMeDJbKd8?}uPy8`A$V&ZF4fONtr=ex_E|g)^t+JLI)ct##Mv(ip(=>8%uz
zi;pBB7?;j1tZOcbETnSd38Qg0F@!rL;v(MdP}+f`S3w7(z>`5t0BLeLnv_sfo*lx>
z%n6Y86rVjlUv;uwlENf!5%-mzsU`Rch*%Fi!HxjFX#dqtF9~Veo&e#gbSf<>m#k3a
zkcmj8k|IX53|)Xolu|~KNC*%i;*9T5@$b-EH2R%4`hPF4C3O8y+i*S&etyY5*g8B|
zY?M-bW7Fa!C;~5$OgBnG*_k;k>5jq^M{Dt8SsHy<8jBv!?5&vJjP>)!Vm<J_9)7^Q
z=7+mc<HnD7D}j8>Zol1xFCiCjm^Z542vGR6COajr%$NjLhVEK<iY<-wB)MzcJWAXL
zVAS{wx-{$Ur2fA@*gG8+*Pp6lcIBxfD17hZGa4Uqs4_|#!m3G?1}X2<xBC8zT8~Bh
zk;)?Tx0>p5X3`C(b4uGAsuQK|&KdDOWqFgD*ny1Q9l!sb_Q=p?-=W-eC@e!lMmeCs
z=W+}0@}o<0-z?1?S1qem0J!Ty;sT<|QnEzz?DUd&C5I>5vc$;ox#;0>$tP!Q;<=~i
z8sCb&RRH;|cCcTUQhB(}HFs7Lh9gGAXU4?DXGRdiaFSWq+{3k%Dg8R_fDs&>JD}0^
z8V$O>5lxomyrs%JJvBZ)Jw0BwM+RP!JD=4*>oIScnxAR`7IQ7|9SaQ$FlZiZc;F`V
z@KYpaM8_L5Vz_E9>sD1kA3>Md793?9)aeF{M&00m&R8{B>XHuj&&@+9D-<*j*;v_t
zm!o@g9{e$PKf9thExVzzU;@i_LpXTd2iM<FsL(t_e&zrD28~lPcv<(bzHJ@?lx_3#
z(1Cr!t@{s*K=VIbe0KgBI0CsIIt<N2u1AhSz{_GdT0d+s=!b@*6BCD{<Aw}|EyF|6
ziHf~R*)g$6SxQw>W}LpIRY2KGOUe&Wr~MDj+bQ!IjO3tunk65fC1UKMSU@b+mK1v>
z62f)j9X!A8lYZsffhr}nGGMrCwf7pAzn+sg!tl&6`vJRhQySr&59S>q4ZOD~C5q$C
z_%qa-o?b@~&M41!!L};z09jB%M^;`zN7l-OQ=1k%5RnMCKZ5Oo?UmjE5nMJqKA#Z*
zsB<l+DG=p!3wSm+%nb-;v$?_CVQ45W!qgb3P}K4ywQ)n>%G}>`3+W2Z9NaXu3GjmE
zXXY+v|D6Bx<->C)lD<@YnJxa3`~|%2T&P?)|1jxU)VJ+d%deilAO9j6?4J94{U!9$
zi#y-s+2{!t+wkolYkjA&?Jj_Ga93-)w7m_R0M4IwU6~D6ux$%>K`Rz~KRo%#dE}$>
z<ZdN6iy6)s2LFCv^f9RcxMcE7*#ZG8ick~*;h~7eC<2S0E#%dz2ROnIe}AEv#}kGs
z9>N1)m6pI17{MH&R^Qxqwot&*;2XoCr_id!MxmH|9?a{$$D&XkaLE*!ss!@X_Ds9P
znd~3}P0Z)Zt_VTdGj{PE*+zMlKxoo1=0MZoc9}y@p~&LKE`mLmSbEp_kNEN$W){Sn
zOd?-iEfASB8lg$gpF&m{EUZ*cVX;SXz5|&+)fdwb^>aEo8x4hNc{Vj&D{`@`Vn7&0
z!h^+0*%cKbu@&6~R*B=)$FP*Q!4Zubzfmc*Ff5__V;}qP{`pne!U+O>KasefPJo_5
zW;?XLbdX}GM`P-7*n0Oeo05Tt@F4l;-l(Px23>4$mp81?sRRPs$6vjE-060YJ-+(F
z;gubD`Q$0|6i^?N%PMn(69j52iPTCZyuDHg4+*y^FcfYA<?zpm3>H}QFW>=cdl<Sy
z<3j_lENca!CXHHBTPKjq>jYY$R)^KrXOiD`z9=|2NJJzB3i-i2WC62P8Vxs?Lf0{)
z2n|sX9g5&&<eLh_0*b<8E3f)Xi99d&rttGce3N1Thpj@us{(L1b`>1niNgVlFIqC~
zIDz-4z#PIuvEYVfE-_F|8OJWVBQds)_LXxHa7GZrj~t$Y6Q!0IR;zm11McuYZ5`3k
z52SD=e+`iumg36?1zWo`u?C&tKEIRS3^nI;<~(#Ngn=X+9tztLg{AW1>6G*k1xS)`
zK<_K*n7M?zn%4aZK>3W{g`3l)>QZNS<Dl@)*v{i|?b3G8oYtf5IduXyyYXyVx3>G#
zX~#3RpcrTOgm$vp<+1abnwaVsaIgJy$KmD|j?X(Lnt^V}Y{A22O@!qdwY$m?rxCZK
zkzc#oTS`~!;WV;HyFy16(&4N1mJ$coStPn$tTDuyAVAn@gp1ovGw{3yIs}0fr<-mB
zWYw0lt`3$Gn{={Jw?a!6(M+ZGu3yWl_SR#;tQp`qDXHN|w-uGHo2jb<t2bpCh6e6t
z9qWp%39JMkS<y`ii#sY@=yI3M{Zk;OeyMD~g}gLHYboQ&ve#6!W@k&#ngPt907Yy+
zM(oevF`05@{ei^P_{Bl-$~RW9A~RpMIhes`CuaJK3d$?ZllD7Qd1DUwIZO{9&);W`
zMkwIm6C0-r3|bzb(GD*wlCqA?ffd8W;w+hTIgovj3dcPx8^d6_k%;cY+1rBvtH+Y^
z`@sKa^S*0@8o$ds`+pzEPwKQi-$ZSso&^@$2~ZC-VdvgU!D_cif2z!Y6D1d?n5)Lk
z`BXa5Zu-${nVTXifJ6!}5Hf3d5=o(@g`%HOsGq#NcI<(FdN%^mgFtp85#zDpCl20z
z+oy{fG8)C8FWO-6+Y)t#C|X^JusJ4L*isj&)dDmkI%W)WT+5LrQR&HiJ_Fw%UPP{T
zL&$bO^4v|O?)G%@PT9UelB0<Pj$&V##1|i4gEi?*K3P(~FkfF8t={t#5_#J5qyW?u
zE2g4GuX-vx_<c{n&Qlgp{cJ7ZewRR{#&bE;1diZxr3fv7!==UN8AZh^jaa<BbM!|d
z97r-bI>aJWd@b93C!)XxwsFJyjWE#ts%UEwa7@hA$HwO96^fjMn1EO;Sw?g8o`WOi
ze0_gHz$bk{Thf-P-CuT3d5b+$g@c7_9vr+dl|<2(hU9s!yKn8{UgND3NX3#soQLWQ
zu&+}H<N_rVkD&Z%9%2)K*HFbOC702Fhp*qTaT9N|8y$v5t^cwC#wi2;p8S|p^f4b4
z;_#5XS&e5nXx2{9{TT_AcCb0@j!h1-G$v8cq`-JRgR*S!&_haRFl0<dPh6cXYyEnr
zt;l4+0-Kn`IlXBKI0{ISF*r6Gfa9i6{ADqCHai+ml2L5Dx)Jae47wD7=<x#0Uh1h{
zrApBJu44dtc!86?X6``RN9Sq`$Hck7@49#77G|(cS`!WuW7v(+PFqr)A!f!X!J!z@
zC$mY#IGb2$Hr|`l=#X{{tYBeM7L#ugtV`jMUMt*EP{#z?saqe^KImO)8Y_CiDm;}k
z=h`&N5e*B$p`FlhgPoJMRT<Zz$-3J#71}i|agy#WMqtSfoSYlcXnTzYZJ%<@wshon
zavd#IzUk>;a!>WL#yy>T8fD<y)YjJKmaNR?*82MFED5aj5}7sI+Q4pEFRo04+4!<E
zP-jDpiJ4RQauEpQS`r%=V#E#{wsgD4hFt}DLH(Af-W!Si4S>>vmYB~{r!_$H<Fy&e
zd^#h6cTc<Q6Iy;>j>Q5$9Y3|2sgdOQaTG*c70OM$)p9+$J`5HlWm6~-3E05I(gf@1
z{Tv0t<&wPv9H`)8HV*OOVQZc(VzUp0Lb95$2Z5W`N_ta*Xn0J(_>8TxJYCC<!;eJ{
zMUH9-j6i>~xdI_w<NJO1KsZ}fD$e0^D&<q2>w~HOgkXQupQi$$KMZ&zAg?8RX0tLk
zUAfj%*Yht+*-*Z#K!bX&3UKFhC!-BvU3H;yS%Xk&Qme%^m3%3?Gwy~F5&YW<&i;FG
zu;BG2tAa&*zCcLu;|q1V$PZXOF_fAAW9(kueZBQpDd2b`NSYt$>G5KMC`PJ0gcN`P
zu8Cs5sF(p3G<IUhGxkTkaPKeP$pLpFUla^b{^^1Oaj;3D2sRan1V)x78hQ^cFFuRw
zgd?i3INa-Q!NHO#{TKg08H<6~b^~3Q;8cIc`+3u*c>8Zk(wyfIl=SM~`v=OIH01LT
z0fg+N#+Dnl5OjCbhIqTlRVr;M2z<H3b6c50p-d1+4%)~quS;$RWs^q2IT5YH)l?p0
zmQXGXhJrZ+o3X;b<FuBm>BgV)Q!VB>lOJ~tfoACqyf{7I=6w~EaqII?X|L3dDPN@`
z&pnuCb^I4B*%+{<>+ALP0jmzXG#7J@LGx0HyQ0f4^3X1!$MjUeA2<x#G4g9_*X`WF
z5^D@FTtl&gs{*i$8bqNv;8@E#H_2?EJJ#xgxP*4Qk^fo6{Y>-#p`e%_Fb6TI$(`4Y
zM0UsV7Oe*f0-ivWu!tHTXHOsy6QLcuZmMnD$lJU%A#mu8+;J=0bAYA`v=KqJJe#g2
zfeWo2G|okt>xQ^&5yEC#MIZk;`aJx+_W8b*P19m=c<qY#{n60}jK=7p-e^6?fYu17
zn^wB{CuQfJ60uU5ykY?-*OFRCEyM<<FcMiSvy*)=QK>!wa_nA>o$4zRCHn>#6+toO
z4rXxJk;uhUd~xs@Tmmsr)Xjq@CW7R1nQYvx^b^LAM$jgq`B?kEF^b&?z^cwD+_Dbi
z&z4@L-nukvg)SGK7_?z%EUi+Vbxz7kaVD@aJY7`8T2HXWn<HUWUX;@<h?dh75R4df
zyW?u7*dBqcNE`Mcpi8sf6TlRh8W)aGAP6LT%y8uK{$kTv#=`=Qb3=IrU&Yy(Ev)zZ
zfDitybx7^V8G;h~u^_N)>2%A_Owu5{85wrq^^g0s>Y<Db)sTKgW-#=~Rr}Iy8ULGy
z#;OFAaKb;QH;ZC2n*$U)YMi(_0vjz60(504!8USThm8EmDk)E{cUia91w|!)qO9wn
z+FGU7#8<B0`iBKW7i0A8ldmyF(If)?1sQAa@9q<NQkT{-F(<8*bsZ(GXF6f>ej@hR
zK;{DWC=LuC=#drmgvab6z#V*z=uzXf0C9(6wNhz}PHv+@$p{1)N^P48a0E+xgn?wT
zAdp5Akc5y;sNIB}?S#D@WSe$r2Vfub?AKN}MXmLWiE`Nfc_bMckQbF2dZkHoB~^Q+
z8RQ)3^z8(cb0eMho$YIfr?ai|LDHO3*q~oY!j$!t3(YH!wzn=QX>Ex8mL3gVS-bH(
zlr%1{t<~7L2*CsgS7!KVG~e4tKw;zkspR9`$tQzoh<1|!;SAU;1s?8_;B@~O9#F**
z6EZ7Y%U!+MW(`*tfy_KoQw{>plum*r`boS~Ms*if+iqTcK|5{?^Cbd5;&;Q6A4c>o
zhMlm7mG)_g#HhA6R6AUl8f<V(Yj9vT{%VCETA>9_rIjK~df>c)y|;F+9FoV?#<An-
z;(YBC1vG}9!=~x;8S2#9MBH7p*L_?fa6X4jRDk~~z<&zTp~Nk@E54I`r;z=2HFL{|
zuz&eoJK)U|ohLg1Xkr2Tu+a=XtLEn}XnlUyd}W0_cLJdHDp#y5HX*Oo6|Zf}Qlj)Q
z{M5}c45ROq9^gIqX(zW*N@PJ!XWgge_!@Z~r$i=_^8@StyvzMnAqbJXD>3Jk=+H1c
z1;(>PN6&9lG3DEo5}BZknP{AIMCf}}xam-F1>ls(V)+QVIa=B1>(c{V<DshNPFYDQ
zk%jD6XsqPlw64B8wko^m73~|wzq9y1a)lPOk1PA3OIS&n0*&@4yTZ9eqWgAmoek(m
ztfNdJ9mIirJt)o?Ij;NanHRbPeMXxkHI&oBGG~Defn(Iq{KqaXZY~|5w6KFs58DkR
z(;c0u5qlr^tZi0!z>T&Z;1Vw;1eep|p<#)EEKy_6$Tn+aduU`z=S;6TwgHKq6gI3|
zHnQWbvty3%I%j@M!cgXXvYRHD=l2!7pBC19Xb9_9osGwdCX*4fvUyfN;{F-?1g>yE
zdF-N#>1x>;&AkYa9yl2)4ehxBlhFcJCiY+>*L|I<pVL&J)2c>k=_at77N&i(!n}yn
z<!mwrJSt<mT5&pMJIdZl4zAn947uh-MCaJSb@PVm?Q)vHS7`z@X<<2-9+qBXfcwS(
zmyKM<b*>S_KAaJQ?I=cPWSz#LFRo!6E@t<Ee0w<80yae9786TXgW{oKTY#BDW0)&7
zRLlzVY~K3PJ+o3*Fac}CrWYlt=2NJo)K-gR$MUgJhHW=S2|3n}N>{h<-*LJsz8}?M
z`M3@Ha@2XnwpV?CecAXZP0S;u_BtA@?z75Xsd2dWk()PN{^P~vF#7>_I(+2s&iem<
znY4WQe|^rb-i#c_yv+#A{M%wfEU&J%v4NZa6v=%{*<&NnkH(dRAzX*Mf;-Bi{9=hA
z49)D~;IA%GOq~CC``3;)p948+a}LmFMjceKzn>7t8suVT7naf#2Mn1w+!FNe2M3#f
zH+68JIZf>+z6=y{TVW#z*!A4z;20p=4~}Ya_@TpTE>=(P@(6BArmq!Pb1n9d{E?Z1
z3+KO09vo;+n{|24|Nm%7iNIuPHLuXjUlSkKer5-#`Cl)OYjxh>K-)RB%i6Tbw$`Q3
z56DW?Ug^A7v~@kK?{jT@>Ttnb*c?O56~QfO@&9*PfVHmqU7qjIW*3aQc?$^eCtNY}
z^?ZH!5o3J*RXue$aKVq!DCf=S@ZY0iM+`ir%%Pk+fsCN&2`Cgj&G9V5*MwKLnwq<{
zD<|eb)#q^bxCU7_HxD8_y{Rilpa(>c*LlZ35w5_mwehLL0pGzPc=q*uI04IIK4~Qw
z7Z0aMb0`uHRl1O{WS?;b0te@V!O^;=c3Fe0$0!z!v2|RgXxU`lkeDN}?R+o%3+Lp0
z{i<y(b$Q097R(9jXnsGzQ0<x{9{w!)l+`@W*JFkmu*3qrcU_UUf&JTRbMuz~Upzkk
z9RPg21NHl*UzP^r!9~eTUm8HbJK_7+?5|At$8jt(heze&{4V@t>#JFw#HpHBnr+Em
zn9<C(+h9iu#DMc~4<?PO`K~Q%FSG?%L2xb~InFS-#H#IZDdAEU&&KlU0mQaawi2ff
zU~NXN!K%W(o@k_^F?tfeuDEsPywHX8k&WGs(|@6QLw#4`?zwVjV$e&2IQLXm?nPr4
z{EvG0W~k<<wo3cktbtD>IQAS?Z(Fm#IQ2)oTp!CSk@7{!aB~7Luj?i7u@=~IXVp<K
z8Q?S)CKRI*w&|J;_Ff+!ulcBHI{f8*L8;Kn8jwVp)V1-D*~PB>{V|$n%}B7aVOF(d
zF6Sde7DdM$JBviE0CNq<t+uq7Pj~ZZAhym=luD_UfG3;Pum;EFI;Y~``ZI#<$LR`i
ze1@Z3E`2+N*s120A{(*_P|uO{B3OKp!eC_^+x$?wHfd~z85F6MBQbNcyd4dWuUU}d
zD&U}?IZT}Yta{$NR(cSN`K=^SX758Q0l=?D|3<W|El*f*HjiM$!3pG{SZp#ETLb1n
zEY?j#X`yv2004eLf-#|2Ji*wb!~$XoZ&mil{xJqiuB{PJE003^|7wGtKP7P9QeUfo
zh5w#B3r+$_dIcwT{GR>%!94iZ%5RtaN>rY)vevBnF`9*8MQ%<!84*Sk7W9N=6U>ht
zVZM)O4l@O@j%AoLh`LS69`F|I-6I6E3G)E}I5P@!5}URfR^Ze`&U3Mh7CevC)E}bJ
z%tTBms}sdI!OJfg3(!A3R^@9}y~HH;rg*j!gkz8}OkVAlcyOv~w&d4D>}qgOJCX8-
zr2Y*P8C+yYWwIJDwj+pD2W<`-XXJA!0y&phL6D1WwboP?kmfKJz!iW&16CWy94>1B
zc+@P8MjhVrwK{(3Xx({ojy4=1>gW<O!0%JS)Ga%l2gp%!;_(f;6yMV3Eo5M(9jhQ!
zeSGl6+P~GjH(6lAK)M}mVO7Y)5{b;lc>1?A-1O#UdIQR>P3Cfi-54=zXY8ewi9;->
zQ;Cy@MsFn8!Cz1_mLV^$G>I~4I9M7vV8?)n_9}!sH1k-C-}e9WQlblw^IsIxXD|p5
zD;!?hJd!ua#XxFi4)m-vTlG0w3-r_fePf5Qboh_W9yZy`hAlhx95`~~%ms`qI0PgV
zH|{)m@`8rp&4({696SO)L?r&mD5z-Y7?@bt0&sBg1PT(2Pe4dSEJP@YFjC<nM3RwH
zP*PFTh@zzvEk>+3Tj<5d0z9u?gE_mr)TmRN{l*Q)5~Oacv)yNlI<gwv?t=S1={4aG
zzx&gmgTD8zDG3s7mE=dszVn02e)6+lyprOoD}FW2;G-@JuDQ<Wjdxn4NtG^BhAjQE
z<;syKU!ej;ioI5%OsR5}Dx5T+T9q0mZ@u>^PRDI5+j0BP?$ln((%Q_1na_?r2acRL
za{=Sp-?n7|0SU#8I}e_`pka9TuU0~QVd3Br_#q<k@3AMzprE3mV_;%o3&6qcki%(c
zYH91}>ggL8_SCbCj7?0<%q=XftZgv1cJ>aAPR=fUovWKaY|p(2*GPB*=$}Y}$ldhF
z9e3Sx%Y!IX8XaaZS!_;695v&Fi;g+&l3Gn5^UjzJarf}7-G>zT`k674$ya;zYY_uN
zFVY3X>eo9^L`Mk@PFk-_+)eGj)-;7;>!8W~_YLxZT{SBK{<<(lA+*HP7O-Q1Um!Be
zUo}97XYUsZ=jO<C3t5NiJ}8D-7r}(5`yk_?X{V2+K@+4IgXalPpL&V#B<iA?p2cYB
zAXR_>agiD-&=3{yVy|non}!IA=KL%lO<0~d5U8uPz>~bH5N$}E_%n%q)Vl(hRrJ=2
zFOugKLP#%Cb5$HO5%9sheddz)MAO3%O=XGW$5{cadi1t9bSnr~2(9yQElaWSgqx<i
z){Hjy2ptX?J2iqCPF&R(L~_5(m%8PC$yukL(Vap{6k|3?o!;FqFzfuG*h%l>y7!^i
zs{oFppm)M^j74AXDQAmYjCyaCgMS=aa+L0!1$KY>P7Q*`dARF}9uIWy1O)#qijw<r
iPymNJu@^(5g~{1M$`!AlAB7tWQ=9?Rx`<U(0001+^~u!$

literal 0
HcmV?d00001

diff --git a/static/fonts/poppins-v21-latin_latin-ext-700italic.woff2 b/static/fonts/poppins-v21-latin_latin-ext-700italic.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..573984f15a42b1725ac02416cd966bc0c3c06316
GIT binary patch
literal 11692
zcmV;dEmP8WPew8T0RR9104=Nl3;+NC0B3vv04-Pm0RR9100000000000000000000
z0000R9vm(PU;u)63W265frcjwg+KrSHUcCAihKkh1%rAAjVc@DQ&mQWjROGmlQ%Fj
z5NsR(Y3n`s|66iHhNug~`Fda?DeHzCrVU|i%G3AC!%iq_3HP$2rm~sA=gndg78h3f
zi!VdB0we2hby+44h_P`oeJ5TtxbVjv?1w4y98Wm^rz9V82DXj-Nlsq)fAWt!_suL>
zts`{o%nINSeis3)E4F}VqoR#xc$i!NaFQFbHCq!Kj0J3L^jNb|Yv=)EWQ&9hBue2t
z10w-r3MR%m>pbg1w7*&Z^ujx@44xjwV7|MLHr190$r_2|lIV#h+d`j5@lS+1gVZuQ
zm5B4wB&j8zFF%(DZy(b%CA?e*01lm+P--ZH+Y<=fviy2Al^k`ufO5Lhokyips^#~w
z|L%i=GB^Wg1<*!?7HAoc29<Kg5ehjh+7_Ck(=HP~;!?yb`QuE29n%@Cu-4(to%H7I
z=hojuA|&_nm=0dNbdl|%F!H>v4>7RSR&g+yIxNCz<o*9m?bpue&9n38cttY#$552^
zLaqdrIMfuq=IZKc(sLM%>{W7*Y$I({AlUwCMq@9MNV0#@7a=Fd4N;^VDyTTWg9=KD
zhC|WOmZ{7=Mbpq!_+!89;gRmdkdSDfyWej`s9V8uisJ}FZshyFD3jrAFCwL4z|e3Z
z#rJwCFJbqVmhFwG7%?IuV)Wy0KR^WJQiaH==k;VGaKi({4;ZO!Upj;r;_enT^8iW+
z1+Z~~j_qA}k8=jw)Qo*ENnJz~GhR~pcs5%;S@2f(yP?#8EkMI*;Q!x>^*~J<t^u%{
zU&-3{G(erjGYxQRxzMHdEtGZ7NMg>!zR?P((-~JMLi`h!h^UgCqI70?zRIT(n%Uz$
z*E_v;W$pZ){0|kSz0Rt-=!t&l4|Rv`)?@0}BlpXaFI9km{<hF;&clhEpa>I{<d{>+
zd_NYq-HQ2l^50aXwmLHUKKSVWBuM;i=RV)FduC7V@jbGK_u%f|y}NlguHX~$;B$N8
zsK{~ZiLp@|B0_lJ2VMvZoIni7PdT4=1MvACsXj-4O8TV6iLL5F?T!p(c4_?EXg2|M
z2g<((p!yR4StkI0MbHc=k7hfvB4$*GN8)nU#%-lIQX@kx!$9t~Lrv0>OzldQV9P@h
zsU=DvAqaZF85o*(;sswBw-8*0mot0<gM-~LgR_%y=uqo`xR5AM`%ySE43l9y%HXi)
zidSb$K-yFns7<;zq;?_*Vg*|gu1oRDv@#2$vSL_^auH5Iz=%ud1c~sON4}|a`jswX
z#>colQnm}TvH{FU@8q^cjG9CWM}#t(BnWdTS>nBGY(hRbI15x#%2dhd%SAc@#fXbe
zxRfeSZksmHx(oMsZ3)L0Dh=?(L}fnbWat99u!Ah@PtoR;$;8SbZeiNH5w|qT_AyJT
z@m}J~wU_(75U8&2XOVT=6RB7x(QALiyhueAB1bliT{-aE#T2;XQO><c<b;1erz>tQ
zE(hP;^DR4Wc=X1Ulv0hY?+jvNaHYL>2@Vp_A5jpc#hKIvWe2Y`%2Xjuo}IcxXk2zi
z$q9HJIpChDqctTSaP^d>=NP|@9`w%E$B3M|>M4z{h`=d?!x@CB!OcWXTn7ve;4RFP
z6yFC~VwWuGhCq|Kd`071j&=z&i$G$7WD1HbgS*|r-HeT35!j#CikeGtdbZYBp4aKs
z$3dPwGJ$$p6ey8k$1C0>CS?AFd7)?$i>{q(4$F3k)*|s|BL&x0mF&y59kkJyUFg_Y
zY{==}XJ059Z4g6Pc?f}2T6*i&D7gRw>a*_|*XNwgH^e9RO|6mgUv_ctoL#YwYxE}c
zD~jr4FWQgE=KW{{3eO8ViUf}2l*5?v7s3g6Doy4<#FVBU3W%!rtLPSu?^vSMY~q%u
z2%gw3c~W3ea&l5p5#n>eh9xO!996d=^!GcDn~6)7IyC-bB%DGUjn62#a7n~xou!w}
zfI|z*;%0LD0AM+gi$6kS>_<DD8(!5NYYr}r_^6;wh;!h|ys(i1OYBRCh<Q`Yc76Mn
zL7>a*RPiy`S?C`<pKCp+6$i#(aVEp*!a5P;!q`eo=#j+{h6>SDen(gFSf!{uYBVGP
z(->R;HOG;wy`ve#w{n+T0jtvuCB{czbt~bqr1)u`g4&>|aoLq%3XV0w0tMVaPDQ`c
zKO9I-AV<l%2ow4Dup-P6xOSce&h$&c#SNM{PDE8}3+pa6sI^B9S~AB=UoIqbC_|cq
z3vASeIf78gDqQaFs9Mt{IlLM<7rJDuNS3v20&UU@b?!0b((AzZWvX=5{F7I)CTeuq
z&~2%*-%X?p*OI~0I0j~ph^eoP2?C|Tf;RtUI}1h5`gJ>swg`vk`t51Ej@cup*9ebx
zT-H2{zb21*`cNkk&36%#tJLSj5o$_Ein}i&33QdPPKG(dI=@ghFhN7WjWi}|^v*Lz
zE63qz4#=;t5)LPVq;jgs1vlzj#}*<`6T^zsfBf$_OE@CZ<pj_wC*Vu~M>3++cm#K7
zc>$(w(b%4i>3llIBejk#NwXH3uT|^H&McpME!++d<>Jt6_k;nHCaNJTR_uca1vsSk
z)n^Ys+Ae#$(r!b-{T@dAxMANAVK=7>v;8wBaXL0ktqW6n-pyz-S!|g3_3rYV*oFLB
z$UT*E$@@9t<|!((?s#l|Fh(GOhw@Lu(l+)Tn*o#3NW(5HZ2|6%D%q=9+!BGyLgaP<
zroL2(o5*aJMCRpYaPv*^`~9$c$gov#0dfOp6|2HIIiqnPTiI1H?wvSNB+W#cjU$Iy
z!6*WSF3HSroieQRW4g#pFpdkMS@ww-)ia8k$cz!b66wmOfDDSf0w>$(#H_~DT+Y_R
zy|t58Iq^4A;)!SNV|*qRMSKrcmCO7rZFKHr7%cMU;aI<AWoAJkaw>FzbI?MEYSy7<
z!oVfu^t4)#7CN|G`mA1<p)UQA)%C;y_PB=iJzWcz4ex?EKt*2R-{YgXETAFHB=95V
zFsSZ`Znt4Mr%>u+-TXg3n*Ne9vu^jd7`>S#op63#nvYfVeJ5%gPg_J?Cr;A{65+#s
z$SDkb11Yx`{@j6BzbZ$pseueHpd`PU_%s%ko~_4se0Jna(2wkod_~zytbmhZXx_p)
zuABUFX7h?1pE!*sOMl|;(!3+OWHo~hA~BjW>kj^qstKUg+MFlmIXqppI2@&Glr^KN
zbb65^x6Y()ZrpNcan$+C-YJ^IdJb>Mn3oP5#IX@{o)R0WB8ST7?ZIjA=8OWy5t=a=
zctGX2Y0U>b8}MnEGvn(p)$fY<cK3^yDWPG`N6cKTy^lBul=XMG%F}g>Gejj$^D>sC
zR0_t*gfPu%rGXlbhrBwIl1Ht=?8mTehOV2=8f}?xrUrY$H-vXkWA;t^g=rk-pilUM
zs(_Y74K$oe<eO=B!0g5xOaFSDKHH$nB#ua_xX*$iDKUc9co%wz00IMEmj>N1(db*~
z&=iAHGqC7#;RklWfZU%j_Jyb5J@~?mui&8Ugs2dbW_v+$U1|tF4;x!kYG(Emx6n8%
z{EZCeKEXHRS{htHcQ0N6tJNk%$fda^uQT_3+qPphYUWcxiL8dK*;c|}gjp}!0|yCr
z7)7mFJzu}LfwzW?<Sezd-v#Fh(}|h25LsEtEn&eA=bxxr0r!Z`AC_FOrtI1AzUUVu
zd$oA6ulaT#S$fA_V+nu6mi1i8K}y4lZj>h?*@pcXoSZl3fM@oX%@<I+dE<mm!rkhz
zi?qX7@?5`kVky&;JC`s%h5G9xDfA=Z+j_M^>f@Y)g??Ej2CS?6vU!<#!R)?^Jlh3R
zR>LTj)uEHOEE{;M?`+0+L>h4<3V0s7TR2Y5nvtK=WA~R&p{qi#x%uCKGj^z6(Kusm
zHtY#33~ER2UHyI^Fk<zGKd|%8YlCmZJa+fWd!<KCRdoAyOn_w|Vi*Fzho<W~Ex_+w
z(-N_(+TACQYLzCEE0>Wi{+M!jMnNp#nLFSUyQgA!*Dc9+gyK@ALz(3{ku9RzL!O-(
z7a6gH^s(e>q?QkQ?jtRkDF%g$t1{FxVQ6&kSbdU7LO6S7i+Nc0yC5gXK=&vO+OE!U
z{nWG@_30j{?x?CWzhSq@CcEuyN2*CUs{$xQ@y((B(j$bLS{@x~gF^M-)_P@P;UKYa
zw?UX_tiJN+QkZ(R_Ama3SWz#@OxP>d`ZwQyz9`Y6PwqiPp;lDX#gIx6D)rMcU)3KN
zM?PT-wd*uH7O*`9K(H=e<20SMq*<EBuBlAknyH#x|0t_*<0<GW5xR>Z!ycoN0YCBb
z&!W%e>%1wBOCCfa1t~O!#zh8+cmx16bgMm~MsJB_!9l{2jSH(8)W4ZvW`@fnGRp}>
zN-te<j5-_<EWq2LcStr)!(m)6;fPTS-jqXwzdL$p9U@20c~fA?cGs3aQVmz!HfY@W
z`FzOE&!fvfb$$5IpFz;L)>>^uH>1y#diZfX>}?K8Rb7Dw%TF!ytoHXmj>VwX4=3VG
z>_|y=Q+QH!QvoD<7kgts;Cd`pxp<ulD`yMDIV};|%IacB+Ekr0wL7SsG*f2wP6L=k
zdm5r7o02h{(^A6m5<~>3%Qm8{-8H58g~l|J4%1a)b<25(LzEEhBvd^dSr002mOdC4
zKS+G=hQ^V{^BH&i*zXO)fX{m>?_LA$UNXO06FfV_>ux1XOvJ3&-1KR#d_7kVp5~9?
zC-z0H*qrofskEn&xM}mVHVqDa5X|D&CZLkZvC>FrOrJVuQFQVGPi?%X&g@o|rNQ9m
zayf(zGI%N_Ru+loduOeyE_XKjv}w(*C0SZ`WD&%Tj>Zn1ElBDMcV)<MBhPx1KxSP<
zdZIX4Dnju*HRb7vl4O|(>9=FUr;}6s*j-srDcqSw$Ns9LxUd<=n;~~hl8Dfu{v&Ip
zE_u11fqks~lG8!oe8uqOd2^+Dpt>{Ppeb%M1^mK^i#ONtRayDEcu(qPh#T^26hTk$
zuN#>reBLceGpt(LwQAeH{<I)=y1qTY_;B3$mO%~b>t6~rJGmD9ibvWnOA_%9ajD#$
zKrzqFH!gdS@=trS{EAe=-5IZt{J6L;*=PCN{8Vs%j$UMAHUy`Z8PlC?O>A3T2D8G(
ztYah=r>8mfw1oBmf%hKr-bsGJJ@~aV<b9JrjXmJ?mMyf}LK?tk@ICNH&XKHjQzT;@
zNQY0K`MRaLtAPtu5T~|lLgi@$vn%5Kc}<}TQJJ@SPxBuzpb8{xM7N*apC1T#la(p9
zB6E2y8%BCdNkLUk`*uurR+L(EQ*eBE(adaDx)*Nf1G*D5G_P)`D=f=YA!tyEM*nW%
z<uEB9!}rNu(O6rtI5*!jY?|WY-xS2oWC!NQP;o=lIxh{uh3HA4-?vQzv<*8r^zEsX
zqk7*JdW>y1)}|l7{%HrW$Rn|XO-Tf%IipC2)1VsH4J@i|vYOn{(_V`h+_rIFc%sG+
z9Ggnoe+`_7S{N85EkISA$z<@1dD%vq8m3CAS{#?!QruJ%?UhDzY&<etTu`cmyKUNh
zQW+l;c$mpL+d**)SQ7*U`YQc_+IXSw*b`8HPzU$xQDwJ9=+zb$H;Lmz?G<ZYG%}T3
z3?G(|QL<E!T+&sLjtierXAf??T~$hQrdVhpM?<Lveg%F~eh10b|4vAROwJE@6%772
zlfV$f=EBQ1>S<h4VWx?qLe{MBX>7FCRmFOyVr)s<JJQYNr4<Ia+os7AB1uHRN(Sp-
z2gSv2buf6@we8+-_ip`uZ}J}47EG83OLtrFIWiGC3u>cpnf&emN1j!t>u}*dxud04
z08d<nKN_2wL9buvLHJAxc%|R6KB1sFGUeURr^?^Gx7N*Mm^YW1qQ~pgG~x2#@21n4
z;Yo({RCRP$S&Gbfcj*x8U#>R>g9+s=*4B@Ach}BUlpd>X9qnCWN%1FC7BCk#*wb^j
zRIVQV<L_jxlo6-m`>Sc}sHAWjg9>i6xx}{}Xmy;kISw&C1wnctpzWeYw*()R#P{KN
zrH>X@C$u?Y^GZ?_aN5ts0)w*$$sAbgyRt@c!i6*z*iP8c$%-ffqVvsLXS0es*7ms9
z9ls=J@iYyU-dRa#Wr|K7W@KMF9#(g;yCbVtk+8%>F9h!#Bl5&{BdG#j+`MTnz1p?S
z;R+2|QsJGSf=bNP8uSShI^ZkBjX%e9JtwS(VEbm;95dKHpmAXP$iAy?Vr@6WNcJ{|
z14rAJRoc0x)urP28F2vD(7b)PQZR`ojYeD`zIz+h-bmQ^u)1osEF*hBsaj$pRe%?c
zHiw<(=aE$VWLGHC111P-gMnLh815sh$6LzttMjrbs$E=9@_hoOulT(ISY33d=*mHX
zPyk+6z^C#rfFEp+Ft*|OG>G;)K?@TnUrr7grq$D{8(yk;j(rZ6*yr~q?*+C#zdw1u
z9ejaxYISdVTiL1O6^pX^RqCZ_+L6yVDqFKR6v~A4GL=TBl3Hs=t^D_~UJWWXs;!-I
zY2~c{>}?Kobxpp(H~d7VPbS5c+Re-*AIJg!aPp3ugpK<zOPdwJnWMZ+l%pEGTH3so
z0O6>!Xs~>!qM%BLsYRc*xCL|E?sO6MwTIQ0KY6yCTh$6?U6xt0-QoKK*M%@nQ>gt%
zR;!o-btI50irNHPRShf7813yc2XP}>`~uF9$%}UFN@NR?BSn&eHlYD5abWtsDHPfZ
zg~zacfa6eajq>1x@?(=^Gc(2Bzejw`*6y)*Q*~cmCDowX3S1ppxCeZ$(Q&ig0pwRt
z@En)PKb-yHvcPfJ<FohKLHh5+f8cuduI%%rH@Dq9L$U72IA3yY^R+YJkwbnX_@zDg
z<>nh_3<1Xi!2gChxZz(hww76z`W6Eke-(Cc#NCiGf*WGNtQPRgG04KYsj&!f=ULdH
zF3Pa;%ZCLHPVUy?r^oSovW%cFh_J1aunj0LqMPnpF-t*kRl2QBp@`9NF`lV*3)}9M
z`k{au6O$zfv&g81Ngwa9eiq-Lnx#!T212sxlOWjnk&Vu(ZY-(=UZ(W!HswzQ&PFNr
z?x%Ln!s~~;c)(8e$unD6d}HD#sVdhtq|leORzV8qW@TKN3Mvc7a`(}t-iPT0TWU%x
zJDW==I;V;v^lUnN!LS)m&0l%^LGub_lpnpTg3iVwnp)V}<Lt@$6eLE^`5U)X6jgS$
zlu)!@X}Pvxg(3cta}Yk5B@KUc3*>d3Zd;gx8_iK|+O66o!i|c!h~k0rdPEm)40H%|
z+z+0q_5zk?vc7#tozvdi=u)_oD`yGRu~4aJ>WBQ$I^tz=`a0TS&b`$bzB$)O%!^X&
z5^$)V%(qOQEN=AzL8x!7u)bhCGZIXdyrHob@w}ireyn3&m^!L}ZRb%i`Su9oHN97I
zG0%UNditEqcPyAVrK)bRgT?40=<8jtf?grcOIUsR@ih?nbSC$!fG9+`)oj9#-tP-%
z{(mI8mmK1j<1FCY3)pt3@_km2K%61)ORb8E1!#UA=}@0FV2KOOArauTYfW9VOqrLt
zZbL?asx~@KJ9>WB+KuT2lCPw^04<AW3Jyu9)Um_DgF&!!J~t+-x~YhAn*3~|HQd11
zbh|q;((ajBZyHpZWwWUi!lVH0Z1+I0RllrYL997KV3m>0Q*dwo6qEemZ98|;H5YtL
z!1~u389_P76|03%IeUTAU#@T~*y~yv9FrL43ZEh`rBhd9&=<mVDnGu27Z#OT8lq4X
zu_81)uXUt`KvDu40}InB{Wx5qIHfj71%5xd&<&x%#rck<?-)gE829D4Q8~8X&Xrn9
z*Mb%7v<OLGPAs7@&upTqqZGTsIb3h%&&*J1<fKptXq!%s9u8t(x3K3x<nNq+*bZ#j
z+Op%}Y`g2S$z_Ld%T_D{y~t(AQ<{m!iKDNHBR<a`^0kd?kAk1svK&XwQS$qUBl`$F
zc<}AWd*6|LxPBb&1#V;~wjVTX%ZET!W{3`wX7w_*nA26bVLCM=nWlj{r*-s+6Uv;7
zKB+iwHA3ZU#xTMexM5Xtno3SWnULab-d@CxePBbE-J@`?9YkVbsuV~f#MtR&Li_-U
z$^3<Kcjs)&YO%81$>fvfLu<uoFgiNH8P!8TT|<WE72z|3(dtOE<wyer+Yfl6*0NOE
zldDy4;X<TjNkH}Dxrh2%5dyTN69mS*0z~dUc<yf*U>3{8J89k_?^ymR$2OvLLnYa+
zo?0>AJkPbLJOd|2)~p<?cW)7NU!FOMp3WNv62Ns=XHU73Azng5V)G6m>o-7(Ifl+`
zOz&qmLs?8NRKB1RS+8Y~Xld}`wT+df#YHA$0Ql`WHyBRaaQwRzspd*#L|tOMK>EQe
zs7yh{gSX0CB$Unzc(W-Ifiz{G3xz|VMwL)xOGGNO6i|0qk@cIv`jg1I3)o&eS1vrK
zPA6{$r(Xp{X4Dz2&>=hpV1-<J!o==mv|Tk}2ZJ8Y9s+J;7sS<fDA`X+mM4XIacV`0
z7r%6SbGzlb8n!CC$du@g+-V*oxJH(~!6g56lX(ans;ZXZ9gpzcgxdEu$7)J)Lxx^x
zq7w}?da{_{Opwq(eFY64AoVB0mC8N3w*WBD_bL;Xm>7ldlBR8YvrDqN*d-#qtY@=I
zEW)uw^MH4@!LMpbM`Pw#Qr@6fRt2%LtF0j=wOW{11eFPW^+jfr#+FG?e>KJ<y9D~s
zdeZ~&7wIcNk|kXWQdChoeF#^-esx!Do^2IWD@slhV^S$6o*2-;Cd<PEOH24n{mjOu
znTQ#g<~tHRJ<4{rV|u>mHn8P_#hi-e?@?JQgz*NeIR(d`Q594Q;}?C0h>}Z1s={<w
z0?j8{E)yjbWk8jtN;ckiy47E2B&eNW>cqfnHG(vp7i)nB%on_QjcOW0H35BLcYdzk
zoGgday!19pjy^xNtnKUNO7p>!;}%m~s9|y~RykNx=$*5NF!7nId!7ou?Lsz8l1zV8
zK*mL}FbKM^@J~5eLYjdW3VibV)n}|O9=kjUJzW=yl_|i~ldsUltHXi=eoS95A11Jh
zQYXrw&PzEI9|Ovh2&eTE8QNsBH(9e7$c{j)s3zwIFvYg8?Vj3KW_A=dfdk#;j*PrA
z&tD)21<FxtjEKHRMniqDrB-vYcg#*{K~uE025bosv)JCaHQCWoYkhLNQ57UM9+iOU
zDro~rIX)IgT%L{f5$N)}3bS=)jns#>RIIadVs*J%nGX#ObEeSnlz&S}E@VKUc$9!a
zdc@4e(uirO83%c027Dix`5zrqpBy`v1UYPuZ#`s3?jH!e%^2<}>`DdaPgc9hK1*z`
z8`kY+w0qH_UymPZKAoKWcyfo0;pp0P7Al*$@1Wlf8W=4ZO$GK;a)bSUmL4qwhtPNV
zBed-iVZ$eE-wssMOHI?Urw*dF_@O9Ld0z?EtYY%7XNYxYXN6}m$JjrQ=(c*;(p8P5
zN_dGJXc_$B7?G>njdTmVxM|Z|dW~x+R^&S>5((D<G5+W4u)Pzw(KTpASI}AEoez#!
z>xX-)>xQ-rW>?jbs$T8(l}pzxeJF4-g_B^x=Pl!k{qrTUrEPVg2}S&O>rRba8e3Aa
ze?~~IisQZ6rtUog(iCy{{Q@R`wWTvAtsJw|-saeewpCQu<!iD0cbUt}@cP??av&Gf
zc1?HoCX@sVl&tWGq+8Z>57;&ND}gjJT9jE6nowL}U6{Fn3?WnSc;x?=CEz~<`K@js
z|AqD4Ll@qt%XZ(Diw4o%!s>bpMXPS!i0NksjlMqYZ(LT98EfL;JT=?-Q@Iv!qj=J9
zM2A8dnHmxWOWEO>qB6BopSUn~b2!O-r}rx)eENCF81z2uXY8p+gITTfP_0JKg8D3e
z=guoX-Jk|P$SQ>w7mtr6>Qyxnq7o%e>}AU98jz=m$j4i&DNv~x@zuKxgYOH8P^qY)
z$eV8s4%I24GCv=Flk(Cv2{0MpK6SqA`$+u6XTH)l{O4XEyfLAJp{o{%d3SR1(g(FX
zNwLhY`X>8E0_D<?75?n#O7AjR7mr#3n4IZb1?c(Zapnj?k(8Y0rO&c;B`8YR>9JXM
zsQ)`V>+_Z4-n{AH&@?4f!u1ZHW>S8-*A7UFf~Y@v=ZSdHN-o!x;&=eBt9MJ#XW)qJ
ztcPFKZDu^uGY(08=aWa~$0#`*da&dZOb+&|c$s*A!e#q5M&_`}viSHdMQ~*w)jt8M
zFzS?0F&`@7#-kVa95`m#=W#bRt~7NJTnNrFA6b>)rBgzscHUgXY#FAEY>v1b*y9<r
z2PLkgWSZ*-G3_P>URJ!gIxhi9QGPvTk}w52rBW*q4t@=O%&Z-Ff(EKE=@cH~aHxc$
zlOmw4CX>a#3i2L4>`!2MjqxZmY`sP60ehRn1;86<qQVHOCbG8Q?FH=r=b{+@2m;Gf
zpu05!idvqFakOkJOA0~kCO;l3%@j%U%l$vwtL+fs@i=XB)eoy#5>9;fOdeDCU*R$K
zy`|!)Ia+)wfxCqJSYMBuoI|@PeNodIGf2`L1!qQ`1b=N*amvmPa#E*cengtc8T`Rf
z+j`4vh#W!ODo2K*cQc-(;fRxISjs^lQX5&Jz|LN9ydrU%92pU7=eU<`dYG7RH+X+A
zg>kt;YBh7VaXaEsi^H6zUSMo5@av9+{?7y~AuY9MfvGz|)syCLM3l5_o5{`>6);{x
z6*JgANXqXRl}@iRw$^y(B%xJ0o!Zn~<&y)1PlTOKMZRMGdYh|P$X$jQec0cywX!HS
zmwDkx9Wzc<C5SCnkj-8uOZS*UADbU?YkPG_oal)wgAl}$2_D}X^7ZDMm|>|29<mq@
zo<B28r-Dk`Dor|_#CmxGM5x6At$Ee2k+IPntpD@C<qZ-Ql~WO=a@H5;7cR}S$ei59
zX#%V*LhlulP?eG8ZXlNzM&nVC9xohO1L%5?O9!($=to0#DLLwCywcC{#_qV-gm-Qa
zD*Ng9epRQhGT%Bsq#qV1+@n`0q2h1@B_6Z5=cR9l>%n+fo&K!AWrunzs&ROk6_p`>
z@?2h|5~VBG<I7ZA?T1xQ8}OW*6kkC4rgu<zh5HAbc7XrBSEcUKEh@iwvU!oQTcKK_
zm!^Jn^%f_pC4vlY=23Rdxt>m{uu6@TXk5Ia664}QQODZlMjd@rKl~fPYSZTv8Dm7s
z^vG}F^ihG4TsBtFK_6?&MMEUn=2lARBkd@_Vu{DK2WyR<*57r^e@;ZpIY4NxI4@r9
z&A=7GLDi$KY-O3GgT+ZBm8rGBn;pB-P)$1x!v>KAOQ#+_A;W1q)4<eRWmbwbMG+5+
z;h6|7xS$~JKCQ_Q)K~c617v<l@!fNQxN0Tg>~2;FLn;lRvwK*s@LdEe0!#Hp6w%3P
zcu@Uk1LkAw>kJtEhm6n_KOG_9V>;NGQC2hG&zmpnK^_>G!i|QsDG(u<hKlLOe7SFS
z6SN-8Ic7IP8-Qr*kD*^9eb8(CPkl1<pK%p*=J6xZX#WXTe#Sm><_ZjB`w@nFzdPpr
zRT!9^Q^<v(VLCmR6RC*Y6`>q~X|HK4&|0I+fs3mQhx2b=`#Kw}I@LQv1jprwyfQW6
zRTsM2K)&OS?6VxI55BqGEAwm)%j;Y3jGceWL&5+Leu22H=F;K(!LnsU`ok^^yv&AK
z(~W@__h4yfW{6vcaEP)&?9L&q;{RV3sKyU$Q)!C8=933v9QAn`Sd3kj-w~BoZeNG7
zt@F~^J$1PlTdv)V={AQm(cH;;x`njE!XMy*rKjN*J?p<Vt{C3$PDq@&j(VZ_f+6H;
zz}2ca^R(ZE#tQ&4<vV%=$4YNkz?2Kn011%wnbv*`xxFRJEuiEmz$n$kJop|U^aH)J
z5bP2MrT&WYqEX}oeCN34jf<PXw5~Tv?J0uy0?kMR=gboZ<uF1JcZt)zA2{D3`HqJN
zn<QAp?J0tP0)pQFLVp7u?TP$BqZtt7rWD=nTP~U)PerBT@DTF=4@zZJ?uU=akc`Sr
z8gHEIJkgpQqKS+Vd^OOFEEV5Ah0*JRG$6g5qW;~%oFBQt8ClPbxlA76Cbp-D;R!rN
zrbJKm-Z}btRsixn&0>TgduSF}TWyY7Z4QThY)l-@y&=)7@l%XjcT|jRJg6VK54dVk
z#T5J$8=1di-SUn0yEj@N4HoYt7O>}zGkuawF;Ot>-itCxGfgA|$iA^|`o?<Y8?Bc|
z7tdMN<S9+&+sF}4O70GXaJ-^@jLjGqeW&mv*?SEnpJ#nz_TQeEUoiy9GQtuM#pOD&
zk8MukM*;;mltG?wKFC{YAZKxBy@~l?^LCIt<l#y1cM25ihMd0fK6vA;Fd`gvyDp{+
zHueFqpQ6p}Q1l%hIZNhwMhLQ+Mw0zT#_4&(qquVIlj0Sb;aR&!mIgI`BzF3d=<-vH
z^Ztsl(KpWDzHu)5#=Go|H%(&Cj7o_WMh<ny(-0x_)K;0F8zdPRna8I?97bNEV=sZ?
zu8Q?5w43ap@y4bTbMxHhLtW|XFfQ$iWL8;`;{P)AN~<wh<v0zR@X2V1N;RK9Cnn>K
zbNoxZ*G5&DpI+oUNn`_Vjqtdn38Y_*op~%+ko94QSl&-vy6~^C>oM=kf4sb0c0G(g
z-#=9sPVxU<=EckZ=ZmL~An=0gLZ@kv_^0_%@8j(Xuaf&;lqVnEY0cgT?D))&WF~cP
z20+LA?t&^E{N;$wc*gIjc{5K}8GCd+I`dPrKQn;4|McIv4!WO?^sOX#K=U(CX9~w@
z0SkE9(EE2MMg)o2+YkH;h??v5Hj;=ka_0a|Oh9yrcl{96{eU=pjeWDCQL+>e?Pq@7
zTtVyow_lG45^-L?$p1fV2N02d$vt&u+Wil`sV5w7AASGpyZB-<%F=jmzeqDOfp7H|
zT^s^-zbAOlHG+xN$?{;evRumQ*qW!@xBtKOWsJ)>x2f*T00f}x{Q&LO+B*Td+Nn#B
zt8o^c>Ix%&(x2pp`J*=|-`SRqh|X{#cvtTHcarvZO~4%o0y&k~JiK{ht!=MfNozax
zQ>2|~oO!U66GTL0Mn(7zr~zBiLq1R=|G>1JzL92nhe+=dwfEi}Kl*`TvH*V2%nAqG
z_89h?&-8<_GX9ilyV*0pKLh$bB9g{?`$d|${SfzB+C7`g*!BQ+M2y*=;+|Mbf8rwA
z*%fJQykGVWeNhn~=xyu+2qpH}pXb*{mp<FMRan@}aRR(t%0IpnkN1xK%?$#11;Fc{
zaR7L?9sfU___sCZ-2o#ASr`C<pP!5zUFYifc}EV{@AY+##^(>lkI#q4p98ftK^YL8
zb;@R7KlUr6;ZRKwPd+HiCK$h?_E<6M+9)!9d%JSH;6e1=&UHj+7Ew25KQtGyQ!pK(
zYzI-X&>cW;iO3K^l)aD3Any?&CGjtw=s+k*AMgFH0JVS7drPV$2>wA?xZ5d4P6}p6
zHR1lKTLtx3c_sq4wIWIw`3P7wS~b)?P0%~^2Z${Fe&2KxZH@b-_+sHsp>Uyn$KAoK
z!otw)&|@5Gxg<j<6`~N+%)aeb9}gw^F0pb+^B!f}w2ryay%&w4vRg0YfN2#L{x&jO
zFKR5po4mKWh?9QZmG^Suzwh&YciVaL1JGf9Z9(a3h)RTZ6KpzAn#5H#v;zgLbAz~S
zoLLB(RF2mLpnoPQbD5+~h*^S{X52V~u06ePdR9zAcq(dl_(yUsk(3QJ2!SIIIBoRB
z@B94Su9^8}uT>zB9Jn81%-KDVI?7_I9U^69pH^Zg092Q@J3!{H+;M;%<Qk=Tph)26
z+67Zbc@!7ow`uRN0|2NFMu-e+%M)bqsB&@UEl?+g`07DCcqC9OMH}c8Bk3bxRuTwM
zw1Bhrz!l|8=RrHj?^mEb9Q*f=LiwG0u_N}JQ%rNJ2J*3-#~7Beo?2*v-1}Gu;E55?
zK5OgA+TUc{FX(uAK37AXRf#oNHAB|RBu_Z(DeMXW!1fh(ru<m^QBbs-*U`}foK)TK
zWqnplVG_-lMB?$C)1*|6?R0SgBeRw$-;k_jqni)JW``+eD@CG3S!d~cuK`*|13C*k
z+A>M`Q+fXekq&1pMKyYF4Y4PMPPTR5g+av)45i>bmtO!*pz$_=v78ISsNn)k0dN?Q
z%`_0?-2t5PJI)n_d_C8w^wYVHo`%l#G-o|GgIq?Pn@LkbwXo&@Gc*nttkobISC+X#
z^~wyjQS0MqP%BBTG1U^^LJg&4S~dHbwaQe-*rdo+vQmd*1uAQ-P&m}kp;q`*JGGkn
zUZ`fIq!D8;|AYzqvM0bI>L_Qb%S633tX`7C9x9&DYmCZh)Gl%Yhgwf+xkoRYj7c;}
zy)+-t)ecHDQKIaOHL<)(3)QH?y;F;|T$5_nU#P8AX5}v_*aC<Lhz-xzDKs9CIYEHa
zLMP`RF8;R<+2oK*9{ChdND;;05Rg#NFtBiZ;Sms#kWo<4`0*DY5FJC1U`!!c*f_XC
zh2h}~Cm<9dQj};hV#N`OCng~!Bd4I0Kt(N4l4L1TX=v%_85o(QNtYp0mTWn4ndQk>
z5EpRTQoS5jd8N-X!#3DyGFPz49X(d~-Fu_CfepU(z;8C%<xhY3V5>bYI&X$Wp)pq9
zD{{dlm;K;JKY6X#HS?~RRpM9UZo2M<QvdhXpmJp@RH;;Lvl?}3)oakCQL`3rEV5Xu
zHXYg>vBeUdy4d{eom*VZ-B`Bc_D@Q^BH{!E`ZPL&$zpT3yncGk0-;DOk;>!>rK;b0
zOpR8jHyBN3OO3u1ZX@jur_1f}`utt6FR_-kj;@}*fuT{)d@Iq!)Xdz%(#qP#7Pqr^
zaCCBZaqXMT?jA%h{K(RDg*5cf@MN;OEqLd>58n7x1&7Py3xp!Er2P(<bJ$r|9P*u2
z`q`au((#(SynPz+ONigxoKL5j&N?4afLJy?Z3<7i8Y9oFaqx&L^}e*b<^I1}Jxrva
zCI6?12#6}+()@Rp6l@gPQb+rVAHHhpu-c@dtHcnx-j~%to)rn}jX+WA5v(iq25dt)
z8X8wZ3wn}ZU1=cNji5&<0n|;DMv3WY1ha~=5gEx08S|1#`$Co_6M0l!ZgOZU6eS2w
z6>8-vlyV_W;&kSwqdDhb!5lo$i@v5R?m|JlC|eNZzC>d_d}^P?b61SOYa!PWlvI7K
z1#5c)qo}#692W`_S+Ic&is=|DdmTxoZEqu)8$7iVQO>Er5+`Kl`TKvGc~VwZc?g4O
zjPb;yy0X0gs>|#r#n+eLx`D?5UkgrQkzZZubc*ck*Yj<3OOjTw5aRTwAtkr=r_O@?
zkEBW>yywQA0C_)maj#AM0WD+2_r`)_5B)0vb+$g+RL#HZld9q1Y=bj6X|IUJAqD^q
C!l=>!

literal 0
HcmV?d00001

diff --git a/static/fonts/poppins-v21-latin_latin-ext-italic.woff2 b/static/fonts/poppins-v21-latin_latin-ext-italic.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..50f42b9e270a0b75759f490f1d67b93f71b213ac
GIT binary patch
literal 11788
zcmV+nF7wfMPew8T0RR9104@vw3;+NC0BE!T04=uw0RR9100000000000000000000
z0000R9vm(PU;u)63W2Ezfrx1fg+KrSHUcCAihKkh1%p%vjVc=eRYgXIjROEA^fFP@
z%tdN;QItti6#QQ&a6?4IKd7B>2uBGSh$13N*h!t5l$=mReLD}2W8))4_qzB!QD54J
ziGh73eo=biS08q<Lt`l)Cc5T$Ebu4CXlNuciJ~=lzq<DV2r3#S5%|P~9k4}|1S+3|
z0v3uuy&0aLTW>_I*hXx?$QZFTEQ?kA1+1u1B^Y2dCMtGd-U;@lo>7-!$EDt)P7A70
zb{#DapbG@&o@d8-5B~qXjlW@#^MwTzXk28aQGajKI)T*R<=VfAP3BiU$TauxN(g%w
zSJGu;JD%+)at{dhZc9d1chfdBeVuk-g3+yyY?U0mNwEL_ovOR>y^@_0JM#$PN>}!i
ztz=G)vT5w@D4j>%*xF|iL9&8ak4x}!tL!kDI*%}nynnB*Y$X=XtW#u5$5eDFR3TQS
z^rSC|{}C$$tQXi@(gj^ea0zhWOYB+b66=sd6@k4J*>j4aywXKum!3Wqo!j<YxpeQo
zaZ%d;Z~Dz9|IXXeidwqR2|~?5#b{K@%x{@XO(?Y-zo^7z-9M<sfkoJL0;54<>Sy~K
zo6=Ud!B{I}LS!N<iUP0vm%dCVVgcGFm>kc(En};~`>G40Kx*U$`cF~-yGxM*cFuV!
zBZv|PFaxITixmr<6n~Gur$XGu)WVr|EqPnUEENv)nOf%+r7XgUOGRYp+R5(7cG2>M
z*GM#A2sr*ANZPTLZ)<JmvB0Y+>4`l7IJV)o1*|a#3I&s!g~d1K8a&~_K5TnQH!YE{
z<Yc8h^vD9mpJ`c=<$2fS+Ip&=_lN#;^pyH4_3!k!P=qFgFb?zZ4!`LirSDHak$yS@
zHyV#=>^p?&gUPTtF|gF+hZbg3ai#ur<o}AFAE_@>|4PS&EL11YYyXq~OOSapZCYpB
zY?)27ZYJjV9GfF^Xg1Hrq4wnXB?hAm6|$cD!&tSViz2crR4$TIgmXvPpTJ*UFS5dN
zrSn^g-Qlc`LH=ykz1<*tKhix5UrVzR{u=N(JOdaHZow<;PPRawfqbNPOD~-r+E5Jy
zi^5Y+DzTP}s`&a=h2@k;Y@rL!Mt3IK+ilEdpPlG7ftm3l#`2v#tIh!|N|Uc;k3|Uc
z*fUu+u}`TsH3q7kWxX290$e67yk%^C#g+~tx}<?sR@Z#^CWlgk(6)Aqbn3nY1gKym
zr2}`GbfbVG!iQ*n_8qbMs{4~V;^UzUjsdU=Usm*Etw*R)%@AVEjB?hf*gAa_DK{vU
z0Kow~#ngIgB#kLYK-93#o%Q6&9I~7n6zUAm0%5ujE(iEp#F(1cF~-PQxvrvm2YKXK
z^r}D%F?d_keXLyn=7yL_IaIHsq)S*kAM1K5`U~<%HMRZJ%-FFsumEjHoEdo96d68?
z7M00uO&gL<TVsCDs&_V9Z7WqA?ZF6}nMN}9gYHQAC;xt#8G}QUD`8+@0F{#^DH^M#
zms3=wyvI;3LKI@4fq@>+2++_WyLjRekwt45BV9kfy<KLgafl-8^Gq1Wjip1ekvx;>
zoY>JRBts+}j}fr?Ac2c0XjA~{80@QQcE;3}ST3x-#32Gp15vY-Oi?<EjGRalu#9nv
zUOpFoZos$!(!2?P(3-gA1a0@mT=`)-ko($2`8x0LCu!}I*;+%-g9b+bIB&yvCC>~_
z&`yfguQsT}$@z2$*bO;RGpo`migiJ2qOvRTyRDa>?4Ml<sE3|Ml9{ta1|bEa)q=>5
z7@PZ*+Zd^VE~+jvJh@4~w^;Cp4EAvGXK$BI51`)upNV|8H+r5a{E1*Gq>#F^3sPBS
zB|<56h^n}p24cGGlyX2D^MGcWX`U~#h%kR6hsYR=Iv9RM89T#HdI5Y<`S}qtNi3i1
zO~Pw|?JCf5(p0)VcJyvw<Qv)}CqD$tCTcpnJy9at63ta#+~DL1+Dv{H_kob}JajH)
zXysb<3>PfNA6I2V({>qHFRljANmGf>np?X^5p}LqA8-%D#4cBXFl;*AAD`=-Hw-CF
z7PQmnl>i@&l4=r*6q|xvOs6nVDT1V{fXFZ^l7$`z{wQ0<r;P~<L?_Xifn}WtYA(SQ
zk%@$pZVKCqjlHJL62~$r5m*=pHKrZMTV@FbCh4eTC@_a-1_H=DYy~<;szvN^U<nA^
zqlR8Zcd=0H^bKrnKLrNXI@iPu=xDeXSc78Fm`zd@qCo|dPGcmN$(?u-TL&R&&d_9G
z=y{i=>nDJYlRu3aW+}wlViU+|$-wkNtPB!a4#uqzeE6b#0BWN`R7aN8zSNZC2Dn3N
z5MaqS__hHGsLQ6yN9lKeEpe+Lr%oE12XoF$S?Ju^<NNk#%ZbC-wT{RlBj3Kgo3oTn
zpuZ!44NWNtff@r=D2%v;WspeIbQvYEnu!}`R0`9XF^medODZmb+3~=}SA)_7<w%e&
z{tAaGz?i0l0dVrz#}s6XR5l0R@5xbKr+!tty6iY$1%iwM*1GfqBzfn?&XRUrQz9^q
zbsa@f(2_235I5nxT867pO1jZ`a3t1OJ)asQ=X>!1kV*?+97#yZZ>QP~6J^4|C^M;?
z6<DtZ!c|EZNL_ZLFYDdUuLSBc*dussNj7Gnh=M8?ozYgE&QEJP2TLi(OKi=oIbdnl
zJ-`YEDQ~!KCT)3-%zGTlL10>iz-(Ur<;-;kclP)dra|w{03zFC^l$I(m-)-#VF4E9
zG_V91LrkTrZBqhxJJG7OfB>*$1vOYNPB0FzDMxtoD?yKnb(4f8yUbGIn~Ch(KF#-#
za@HsexN#SHEYC9##<>hW;$)V3Tb&aMq_KTuje~ilt)|7;SPGA%*i^dNThPcvLoT3|
z82bre5#1pfr_;Nq&+ZZpy;Nq;jJYhEQ&6velC^~ix<IWxa&;X=tU%EN@C4ONiZCEA
zfngZ0-ow`&j51?F5WxwyEv`m4XLHo_+&izoyGvxx(33nSJsB6@ee0dQkUh;$G{ik2
zOR|+c#!V!8dI0!A_Fk1S9C*_>K?i{r#R~Twi;BQ%{Ru`ZBU#~rYj-tfjn;MLz6MHy
z_N#IaaCDLqvPa2F`KsjqC==M-D32k7p=8<JkKlGh)Sny4s6i?XG^-DiFFP)=S!E;z
z|4g1D;2`HyHX3H18XcqsOLJ+gY*U_BQ>&q500zYKehyoh#OBWHDyX9rt(hck5<Xls
z<wy4j!%~FTZqy@rX2}~13MP^oJ7xsx{~D!Zf$6IXf*T(Al6TZ1E)LOPaDildGpTVF
zG21aP)Y<w2Q%({$V3<!P6EXDqZ;pTnI@#s%9Bglkj0kEVNL3}W%NHst1j#>Q-!aKD
zu;NyO2X9VMv2H*Mzp4Hll^b>bbTND0gVYWY0~~v#Rbvz<Xp;qvrJS*|@0VaR%D4~+
z@05s|vpfqbA)^r?Jp@GLCol`B8=EMYy!$-#9ozE@e8G>A7v!90{C8(cbu_Y<RMP0g
zNdilb^aN63JzwthRV#Y>HieWBAYc`?577y#htbuG8>>8+5=a*)*X@5;?Geh5qL`OG
z%t+bKxgnHa#AZ4wFPYKFxyB|BmO9Sg$+;BaIZxv3AXm&b1p1kLRy;9DTp3Koml1nj
z2aYEByWhiqYjcA-nbx-6EQh&{9EgS+^Gnt_8D0jt9=faI*3`?c6|?7Ww1%~#Q@xC8
z;xFe&Ths#9B;>n4Z@FTyv#k3AW6O%7HVmN`2}2}6I9K$O2=5ua?DBdis%OEFiQZh{
zB82OQobkgP;psbN&a^Vrmaxrme%+(xfb4>*ndh`ekFJ;@VB5JK83Xm4cu^F+XLtUe
zh{EW#Wy9B5j-BY+B8|7z+z_!<)tOhZ>j8Q-jd63v4Ag_Y9jJV#7OGD<Ns<IH&Ni4x
zGjR~km(>mSj=3tNY*^n$bke8^reYZ~j_ia$Y=Zy#lw_YO1cRfoq*12N%2wmt;+er_
zkW^ZUm~cr`zA8-vj#gDtQCz9CvT-tzVkHw*iZz8g$g(#SM`fsUrlGdgdx+=+>-#>F
zdaw{GPb<oLrMBjx&pPE0?1hO?0O&K1U|piok#y=cp)SA)KrtRLCKqcMs-BQ)nHgF<
zs*Ck0iaaBUeAQy8OJ!(PEp%oH(SDT<qv|{&9InS|S$x;NU<E5Oh*=?vvap)RghEBn
zsml#x*oSUHf@Sj2z&P5W`Aa#;86s8W_0#B^-9CJFpk<AdMj|^G8Zk#*K$%eQj!IFG
z)0Bv)AnyOcB~`i1CRP5Mmr`{w=s>K8{fXSjSV<!N6fu=%55b+yyB-s{5W%t9^C=ag
zCjtz^C?$B2@jRJ&FkB|)mx*kT#6)<y%>+(+FTyDDj-*{2l7_8tk((0<X}}awg}TWg
ziPxPV``k7kW?wqLclQ6#l6OEBo?GXFYvTUstMX&gs~>$F4`%I8e;ORUZ?H(OYW%Ra
zpyaz>?!4xgyY%9`-LIeM^}v14-1+4d*Y*j9M&CVM+AW8_e(I&-n;zxl+ph$#O1xn|
zc>l9^m0ode-$4bl_nt1~-TRng-S_;v;;k18t`7V<oRQD`-1GTY-Y73L<Tvl@nMkI3
zWt?uwp`}HN^7d;z-|F+n$4`Tk{z>FBuNH=)ui~>|d^QuX)T`t7?jL_v*c%?SCfa*#
zXc`H~M+e-o<6^HJfA`(hWpnq&QfJFsW8c_mFqzz^e(d$u{3bJQzw?+++VP403>{%R
z${z)@W?tdTW(g5q9!H+eF$b9ZP^6ZI)M_JK20<L5w%~MR(ceoXDKX{o6$ss|dRI6~
zPebVqktS!DvW*a#Q}|2XU7?IQ{0A!{H~QCtM*#_U1o%4K8XiNyrlHc|f*LLN+@p#u
zrO!uCLa~!B()%V7BJDXb^ZfumHvL74`qUOnXVF94e<!Bd-wl%BX&@!@-2fhw{yYT;
zKAb;eeUAb<HdrC^w7U$()?sH>RYnq>YI2uyBswW08UuyJqz-44OcvnVmhZbBw6=K~
z7gvlq3;x@6S)OFHvn!;WDu6VkkUr<ee-8F_vOnuypotrO>esrX{QA{*bP==KxL>d}
zQEren8MSg~Psc|+q8kzo-p!K=t_;jpB1ay&wBWN1c-|;;29v~Zv_!8`<gc1<O%jeW
zr!z>rpe1ItvS>B1i@wbH+LH72mq=}7zWG+)d<7Oy-H2fKBETI}u6c%VoanRKiAF1E
zh+BGgQP9!Vz(J~sd%xJm<?q#%OBpJ$$RI23MVXMgil=`Di+a&!P}7dmpBnts(cBI;
z9NaZy$|ATR16yjU6xxhvi8ZlxwBK*{S*r0Aq-NT>72Pe>R)q2oI1fzgTTvH)+<Flv
z<ABL_DqO{qu@G#uWkGARr_*i2Mq4W-N{QGa8%syBY!o{lsU$$4j&&d{s%RO5W8sF|
zK<s9?=-8cR{f|CWwJ&+IJ!P};l4cMI6f<k`Ze4TdQ|cUbT7nwavT9L(LrW9PX3dv#
zxtdxRQcX@|3D`oKxniAJy80;i&rx4xYn_+0{#7?iVD-8z8FIK#+SJWech+_U#V9SW
z1$Z0{VOrzmmAXupWVjMuC6!7g9y3Bt#<K)GK42}Jx6rqI<`6>lBiOmTgkOTmSS2=h
zR;YXp76~R}Ol@9~PFK*eS#W{QGnJwW^tkj1WVqPo=3xT_2me4?M5&lwRj$b`78RF?
zDC}W=qXaG?p=c_OSY4-y;iseM)pP;aI`=1zJ}`tIyWCV!WovL*5;WMx<-?spS922+
zWr?3E+cw4ItZ~&;BO{CtmihE>NhP9EB;-qKEeL5Qjw#>^LE+pBcks763AfV$z)BcW
z8->*V{>|NVV5Pp}!fpJW8P5E4Hhttbs}jlB`W3#GIF}}I1JT!CiPDo$r5{i^2Emwl
zox~n2=Y4q|SbtOZ&)8<LtnzBeOFcG0g--F%Sx!}%9U3KPsI^++PM03gR-|WOs;C7l
zC9#7sbHkD)J!d+C=lf@E99iO$WL&XjH#Ke1T37iN58b;vXQ_y%AQ#zaR63tpCS&A6
zWU871ZmccWudV4m)-dB(P5$p(?`bdKeWBGZi)2^RVo9?^#?~@P*uca;t{M$5HXVY+
z7M*3T&c8dx)m6>TEJTom)XI%Te{T_5_+vo&ao^T)sHS68bG)xPrB<MlPZL-MQ9601
zr=z1r)z1$$GrXsQ9j2KQ`3z&00fbI$Uos=#k8SK)e@x%;{lLWc2_3tZCkz?Vz1_ji
zX|?&&z^(Rzr|)d>yQ0@A2x;%YWKXtFkUD{okP4o@O}(X8LfgU$Iu6=v+ZgXo9)Vmw
zqp-81wr*@nN`1nWM~Dz7n7T%`>mBA<68VrZ(*O=kOqqb_Y!8DC4HTxMk-bzhcs^ly
zcp<>633~|IJjHKOnKe>81tOvIHWXJ}9<hahXb3>Pci4j)GWb@02N)8+Mu;`xwFT6U
zWBo@VdnhlIw-9EBK~s);)>e8e0SAgH^b|q^lMuY1wg3Wv&6LSzntB?~oowl{&XP%o
zO})?cyM4L^cJ-Lu+urW68n0?i)3y!|AdfEW=$}K*Old#E^>tPSvhw7RL9{;u?VUcS
zBzz8dmDzpXM;_VR(>DJ<re%&y?eA?J<I?Y+Jn-{GgH4I3L`eP3Cd`zq=FXJniWF#I
z;<t_y=(1b<*`$~`3X^O<*cs91s76QF)A?eNNW*4iwv2=vmlc#t6Ig6puuLNIl$7f-
z-GqaS3;ESm)HKz!u-%G6vXsWEw6{_efIoqdoM~={@T#0aNWjwx^>H;$q~wcq4fa^5
z$n*Lrv%P1Csqpsuy{X#g9ShD*w3tO^&+tUU!U@2`PKqW1oU-ULKafs(N>wOT9bNJN
z9bM3BsIDjWYHR@KSPcbw(AUrbFm<BzFew5eMXWv?2)gdOKv%U1RecU2J)EJ*nG>H?
zko3toLg|j#cEN>I9z*zQK-8Y_E~`D<X9d?Mk0F$<m`}cNBNWF#^KO?EZd?L)2iE~%
z4$2URG=SWtaN*f@WHq4G*{2PQ6*4C~72|c(WI3>YZZ}8DtEEx>!c^B+IK13!6p|gK
zeCPm$pfG(tt7QVm0dW6mH(TuK>Gl(~D7}4XSSpvg*`*jCG<*vp=h#*f<R-nS!nvdD
z-`_}XCgU?dZ?nbK{<hk1vxhHXR#kU2#@6x@<mzgEm6hJ<$uf-kymfuufi!KeWzG~U
zxL%f~BEvC!%YhA~b9pdmU)KZ0J_^Ofj#o1meu#?}>s7)^E3Mg+RlU;VsT=I6BWh7b
zX!;zHX2vZHPb=n2+U+<E1WFH%%no!S6rG0eApLg|ghCRCg_?~G2qoB2>}I1dUWca?
zp)ht0@ioDz0hk%m>8k|FRwv4c>)>{AISiu=@;yr%!dChiekt+V&FON6z)qu564?T7
zmCR>DnL?;#l3Ye9icn8tfvtm=6H-qQL#mNtt;vFL9Bdzqvu#AK_ZVKmWhSANhE(O|
zvJKs9An*or12eeqdExWvrc)h$_hK6O^Hzz6lLMN7<g;7SWwSTLvw56KQH>s>X0V^l
zXo*#Esn@=mR!gCpEC^Yh<Sn6#UF=7ME-oMZRN^1SigVQKZT6Qiz-LkQ3}!&&G_74_
zbBY@otbo{Q8Cz|0Dphq7R+ms^(F*u}3B6mSFlhPU-ji;Qgy*49Jwkh0TO}?|HK!hm
zx|I)Me74aBY($Z6?E;DMI-*{2%Qp|%%aw5fyrkPNR3$IgiI=*RXd9(q6Yo$=9heo>
ztP>-{ZLA#(hNv(vqkA-ypYc;Ei6V97vW-m!5i-I8&%atx{wODF_4%yplf`8WsW*oU
zwvCeDggaS6q)N}{l`|7441olpkS5M|U}dC`SpsUZ)a2DfH>H~c4od=$!Lw5-vUG9Q
z;Yd>`wG_NI{d>hj&uZ$<@&Kwn8=mE&9=&nYrO0v?U;6fvi+tho1&|syJ+97qY4fF;
z-_g@?b&fAKeNh88W;rJRnsgCo=DOEL4iZ6=0*O>~BNW<^D1^KXAqO+o)ML<Qf4D8&
zF$|YFl_D0hx*+%CI#q-o5$+tqbu`DpE-ua`;4E1ARh$V^E+{}%vseNqJvq*X6Qj^V
zZ2F4xpsxXn37riAhIFT8ahNIGIt({NIO-!mQs;`W#K0pU&n&)lA<TlYpi7O(UV_t~
z7EX-H$VUKM`N%ODyA!oZwFY9O&=iZ106O0!r6=>3RiDNZ4lfoF<mFv5l6CE*E4VQm
zgy0DoQIG^*2=6{qdi=!$%&FEIw26!tsHFn7k;XG6$Y<1ABVwJjSf@R*CTL33U>cS!
z3Pz(L8X7W3xNE}XrgT1y4PLy*M3>buSSBG{Oe18?`1s&Bj)`#_ltF~@jF&_=jb~vn
zk?jYesc8wKSofliTFCBFVY0y4Td2a=jIkv#(aCI9r9;dr5VL;C!DVh7NG7BpSgb*5
z6~XvnY|$?{MRML65~}!lZn2oR2JD(PKZd^_CJbDF3oazDhmzNyDGlKE!D9IHo0;ML
z6|V#ETgi~1AA-d|!YL3qolzOZpa~1>!(!4dX_8GTMkzyJ3Fs0#zsf0N=^M&LMz2&5
zje)8XnN&ex<9K`O#b<|Tk}>%9dQIHyFLTQ(^^IjBqem`?!qojCrf@1$+50n#Bvi48
zoDG?vqj@flU?kw?VO=eL$=9j?(%E6LWSTM8iwSgYK4ACTW`b|Jk=WE?*OvXZfG2l#
zwRZ&VG-kHXnbqf5r8#lU&r;j$;XaiiNLSV)#OgSsuU4xZ(54BEMS7^>Dl3tK)Ig@n
z;ssJ;gv6y*0i&3yGZdGWeK8D|$f}$&xI~~RDC4L!JS4LSg)A;FC{^;;kdP(h{4$kb
z9%$+1jZYi54ULP&?VpVOkqO7a`GYxM+VKnX5K^$_BgihtW$zI=eH2!;!?u`EF(z{O
zDV5VEv6T`rS6&ApWSJP&E~|h2Yl0~R;-9<n_17~su_z5C=bPF{9wt7&As_yb08V}i
z7uLXqz+mrmSBo@q9wrM}-BnvH)F^nkOhPQG=$VmMAp=!>CAUPv9Rtg{(++)!)V{;Y
zmxYPHLg~IF?y_*@Oa2}Q>heafm40Y1Z04W^I_L<CitoYU|EZH7RI@6{EAk_ffqTS2
zV^zG!%{mknQhx+b?3APyGoBU4gh^w*NKR`{iTj#Rw4@+?IuW-6pOiOK3`);DXom|Q
z4FZ2~d6XDWb_1;{@8|!`?NPV#?UW*AJXa*Bl6q_?6HFUl>Y9UU`T5Y56JzT9W_e--
z+P1L0>tE2txR6KFiK;r+)@EeULnE+fh~)S_b_@?#=B}Q`cFV|lz*gJq(Mru~0VZoU
zTL+a;q-Ko}lTnC9l?d`nWrBUB=#sL0l9Im`jOGf*ZTi}hIxg(Bfxv{uvGV7WX0Z!e
zR~cL+Tl(?-^DkuK<1+L3;_+6nVJ@w`@uThjq=lcY5AMtEkZef{%>Spk+HleSVZ)XM
zk4tM;7KNI#k2_!IL_vVmZ(8^|sip3uwJ{xQeG!v~5Yn!Yg5|fser2t256IB&ra<JZ
zGIjs3alz`aJ~@9-n`yxKYmR;(zQP!|{d;Pe1#K`>$>0CTY##a4{0C=IhO-3^r_I^9
zJYfhdXdT`pVh(RSu`&7N#u@8GEPC?e>)_y=x<ckh=Y_n6Jikh!=m~aQJ>D+<e2glw
za>q{x56+v1thLZn#h&@|YUy?y5W=v#m#}ORlXk+=x%Kr{C8F}wkP$XbNBdaPAI<c|
z3%WX;UJW}h?XfEAHw?CE`%x;7LS-1dB#z!`ki|wi!r_JJ63VBg$%bpf#AA7Rf8Y6P
zTV~D#ZG^DIodeaD0VcMjmRjMeidQ@OK8ZjoY+4@AL34UCtCxA)LN7ZG(_qHdd%8Iy
zs#R~6SS5lOB8<-zi`TB^1^u^Tc?O9<)(gc~H=IWh0bMCXoOdomJ=<fAXxG&b5!+~q
z3UoNrbSNWgeWpR{QE!^DYku(vroMLR0=ceXpsy}fi_$~W=7?3j#Sqd(SIsXP@}x25
zIQO2eENa^Ec%?}vtgw@Kb~sN1tj^~s6*$iejFH8&@wy$Qd5>#%vTlt9q#N_Km};VO
zJ@E$(-$eR!cq>(5AU^sgk8FL($=)MIStWf-VeIUA0zUQX26ygtoMdEcZIU@9(fk1j
z9(o_5lA$?w59@+A0=EsHvS{CioRWJ5c@)I~{M?#5Z!a&UFHG=~*+uUQ8L%Q^aNX(b
zlFthY=we<P+E`K`z0nm%V(;2oqc~HH)hGP_BUBFCWXH7y8k6=YXyquAgLzWp*Sq9k
zH##Ok{GeH;OIq7D+J@9R@I_*O*Ekhj#DnOxz}f5#kKPyd6_p-$@Kl{ugn82cu3+ys
z#rQfM<;dx?C-9#f-fCPLExyCoPui7HhSJ%A)q%-&;@bTEguRN~GL#8Y=2kN~-2euI
z%@@+#3QGERLIWRwJAZ*#474{b;;Wi;SkEy|4EQ>$)Un#5NYp=w7I8Cgf6194b>&VD
z*%%p1RJZLQ?ZTAGhZ-Tos~dT^jzE9eT=__a(FKKOrL~azuJCdcCfk8+4@@cdODfPt
z=&lZ|pcdN}Xe8`W#A1}m0Y)dFmX5d5{PMXtf{%dfBUE_(kQ8*kvbV>Gd~0y{u6n~_
zgt(eoYED5J={~7sM;WFw7iFqTiUFasmC4)&h$(@6qKwKUrVJuyo9?<q8eYpH(6G(f
zhblAO?2_OXdyiKzs6qZU{2n2BSNJL!A??ABR7h8;t%f0~9X&=&pl{25yURML!i(_>
zdXbXk<>XXPS4XXUhR`}-hs1kUfaIV7{YZ(ILUFPa)R|k4#Yc-YN`94vHnrCNwTxF$
zFX3LBBT<U#s7#+I)rB&;r!NpyE1JZv@nNy5DukdiYX#-@621e@*Tg9e8h*KhByzw7
z=gQ-_Iw?=u2H|u^Jo@J;5I~!Sd+S;+VSgNLcI*cV&o2aggxdAFhYW_To+^P2XYjkL
zSseq}M5w)_3ji}_RE#%46f~H_63)$#L|QcL@>AM@Iy2<hM2Wa|%&`<zj`pIpdj~Lk
z-MBkk5kDhJkXWR)aQrrrzWe~WpRhDDqa1C5F8y|$o35y~{jS003H5Po)AS)bHYOHj
z4O~(o>>kq*m=knJcEJF2hu!6c3<-~Tus;6HD+J)@risOay6(XFiJorl07u-dWyVR1
zVc9sSp~<G6uFMcLl+~T?>m_w}(ltI5|AsPNUk6!%{K%s(uXf_(U8C4IxtTA;$1AWz
z#EMa@6epKmCD?j&fjH&vV1R5{nFhj1rEkt1`+kD@B7#dkPVYKKSG)i@>eRQRhx3!7
zqcg(!z~$oIuUQoDl7->-Q<0vDO-ri-eji_BgiFWtQ}hTaXxg_%KTyyHjLjzrI`>*+
z!pa9_k(hKEF`TI;MfhkLprv^(4)4d;mCwBIPcfr7|G(Ubv?U@&NggsclDH*(SA0@8
zF@8;4@*E<tF1wSD8$e7dkeD4l>hEugzWx7wAN`0%{Zuf^%65+Fvd7qsV;a!15}`sP
zRe=2asAPXBUGa5b?jL+`c;e(up2GYtUOf-z4}Y85@IP9{(ZBoKKPw48o{8+g2Q9ky
zQ6yY?HZuLWz2f<~NU-eYyrSHEfiN$Jw5GUlK2dIN5n5jCWB`9M_Fu$2@JQLqAN*h7
z9o}9&z*09wNj(RRQ3`sWalDq&a%px?`>N(RUyxYCR~Z(X@|BM^{?|uWMEzHMh>|z!
zb>RNy+#kRE=CslgU+`>4ZVZ2CF2=hjcYIHN-XE^4OA|$K{zPG{_gF#B(E&5gzAYKq
zbdb0o#7t0e9c4!7)5p4hK*)ZG?}xBrF3i&$>$V`I7MA+=_7f!i8J(*%i1q`++0`a;
zo{W-bT78P+78bu>`<~2(mB0jSx04gIF$O$aiEJfMy{H>4322;u1>kr%z%IAxd?ruM
zzaa;Nz#P^Ag|);&Lv-v!?t8JjmZ_n>Xqc`Ia-4@AbakHX1q*9eSJF_Q1*gJP!yrli
zYAg-)8H~^0iZnidksJ`;fbw3PG^;7p7Y#F!8pr?Zf{7q267C7hVt+n$RwCp$aKe}L
z7VcjK)KFi7>Tzfs2P1+$To2p#RMf5>!BC$C*TGc7nE&KZiU0c$=vxl+&vSx*q9GVI
z(wNKaNzr1oszr4>G>-M_g0|5PoD#c*1$V&ofbDcSI7(Sq|4}=SgPr!~{=Cz2mPjgH
zUQeZ?%%6{(2+G=2_T!XP#b#luK6h`<V}O+i|9V(fx&n;)nIT6kj0uac@Y;X)N(#|0
z3an;f>->5UQQ)a6w2MRqu+A0N9#2SJ)p@<RJEa;=3`p~wd0{5w9_QD<5YahbF6;az
zlFE6brSkW;tEd{f^2EorP^ZokoD;ICMZ+*~n&f`*ix{xetn7TJKYZisopnAIZ7@kN
z3?}QwW}D7U`aIVu(gWeLZ}Hl{>q_XA4-9i*T}*}-Cu!{hL&CszXWd#4k;zzGXMMQR
zzIxbDXU({8_v#+!eGg)9Y_aKVFLbu^I@f)2b7$2@<gDBn9ZQM-9fzOVW*NH0#mBDJ
z1#Kla8Ep66UduZG(%HaobgTLLDXepoaqi4o7jnU}=KBWc_Tp+D87u1WXAp;G)nQ`4
zTlV_0$C%z1=Uy-}tLKB>fkW{}xwxvMiRc__M>vmsb^@G}<Y;=mW>?VpaVw6^47>aI
zjD7dH_P=|_?G5K{w}0xwIr4XH=+}1CFz0r~;zyQWGAd;LF};~{X+C$qS;zk?Jc)+0
zVx9uMY;BU5bN9w&gVfJ{EUCMv{aYk+TJ=RvqcWGl-EEu59sjJ~E*r}H-PdaeWRbXM
zTky`cWo?o<AJ>C`K8D}PoIg8zp)lDua)I9h<&@bwG}$-#x3RlNaYk}-_d;ZF=i#HC
z-3zjO-?6Sln(TYIaX!Cc%wMftsL8(h@LMT6-iH{-Al9?o@7}k}@%h;pIG4YEt8D)1
zv;IASh4M`Hrp(S?$L@WMlMz6_>m(0o<H<5`Pk1s5@yJb?&DZ#OuJ9fIj71M+zQ=ib
z+2s6#y|DY@GK+Q(w;jzRDcmg>&0Z<^+5FtOeqEg#qi^=?g;KNQ%@Q4X^D4_?`Ck^~
z|M}eobtm(dx?nUv`J`U9t(%C;`5s2c?A|T(Tt4qCJBPH5kr#9^%V#oI-g3J?=1GJ)
z%eMSi-1GmI&=D+PUE4SFt<ISXiDUKiubkh>Yty_1@~ee{+p|$`dS(~Do)cIvt{vl>
z@0PnzK$CBR?_^u|_UJ;<0qs&-VtKxGZ`x>~R9j4Z;p655mbZE&0si0H(=uw~);Jho
zOT@=NBWL$MRsV?!4ZRQWoA=hc0KY$Y{D1f2-KQqr3WSIh0wBP*kI{B}VDkP=;@!1}
z?1ty|yjB7yl?B_ik~%=St&2&?7FaUaw#e@`xqT|$CUrTlC7(}2?yBiNE}zem=Ha_3
zBtK0{yKur|C>N}1neB#Y7kUTCo2k0J^4ml0YaxmH|5A&1`XyVFiHZQq^@_M#=V|?t
zRv0MjCz1*SN%>3CiUDOkD#=?(#fqy%QVvO4PDwp0x5c7V$i^`>&srr&C31BeUbl0t
z>)dUge<}l&IR9psioA0~HYT=PY=4#!7=S$f%rc%-H}PPC>BtpnJ>i`ZV={kDZYV-q
z1jvk1$+GJ6#2ZRCPZ|Rf6I6*u#%MX#qG09MsVrGa&d;e_)s-x%vSW@n62{TW<wzYv
zZ%{!A%4?8nU5#=jg~h(`sQH*ISM2dWutxAY<Q;2f(q=7T$FZVN6cvg;NjiI;)QIaV
z;fbBYK4s0ZI*sBw1H9Wr^r$}(3BvNXDzj_Wd^eIdn2aOvc0|917>6l}I+JZ-=Q&dV
z!00kv0hymAdpEhj4ndg5=$$5O9Ol%$j1l_08VN-J7#&FH8QPkXkiksc5N1?)388;w
z8-#pjGYFVxm?={->&q6cMP?~czkUly=n8<2q;H;_(bEndY~jg25b0m=o}E)uz<78Z
zU{=w_Q?W5*t`f|%NE^-*alK&1&1v^Ut^_3{T2+o2vYrtHYYM9Z07&Z!D`PHmA1I7!
zrp#z)Q*pI2idNoo-`Reo37!0*S;FJCgxM?h*eGHpYfDQy27<AJVRe@seni@*#>tt?
zR3uLGrXD`t8fHCP#X^Edq9w=W>Eu=s^x{CaP2{*j3u%q#F??LU31C2Ow;jTe2rwa1
zMF8#rEFpkh1%!fa(ExbIWo<_olruYqKsd5vD3-n*!=!NR7%qn1A93uV6{64p59lg(
z-KG;uX<;X?4h`C{StnAgK~Vk@wdzo(l!k<gR;xB`8nozCLas}#paxzPBxTA_%==HD
zUd~8DqmnA#z*b)Qd>+gPvkFA0lKwtOU58`RRVXWC>5K<6^EZuYbs*Nr54J1D*DXnX
z=U{Wr&ni);VT*P1Jmh<|YF2vW4`_wmTKIJ6he=ELERDfe7k6U5Pyy^#klTS2779WW
z1`GdYl>hb-C0YzP1SAx+SQuD1apEONgh!AhSqh?5Y0_oLlqFk^TzT>pC{(0a36fG}
z%2gnvprWB;U}C9Mg^h!YhfhFAL`*_TMovLVMXj2KmX4l*k%^gwm5m+5!O6v~Mr|U%
zHnYrj+A8<WF=C+&_Sl|Cu)q&yTH&Qv7AFeK^NC-)u+d&`y!O^s2YlhYaUNbv`CQ_6
z!9~|xcEwc>1bpeb8xE@T+%n(z%Gc^W^2B_N8Z>DZ)MB$%?b>wc)U8X8UJvz|qThh2
z22I#vx@l$@^4L=+5)F%i!C?p(5{3frybl@{>;Hi57i@5W!Qv91gd_$ZLXwi4lo0*p
z@1!Oz>B&fDvXY&g<R&lqDe#YPQ<$O@rzE75rYz;D2-zQQg%WCLp@$J>SgA}^*x`ih
zki+4HA3=l>MI1?_kwxydJ5fX#Rn)1DCfewtk0HjGVvZ%&*kTV9N1RT^6?bY<>#lq8
z*coqp@h6bF)TbehzVo{u{p4rg`!!7ora3KXO<UU2k<N5E;;0WD_o-t(@R?zA?Q_Oi
zr_!CC^rp`u&ocGb+VRb%F+Q~m$`EZo(Y{EuQ!q;W4hBkhk4t@q@&A5nLnem8Q2q}q
z!XPd<Q$RocuA5$H=!G@bX=P7;4cCk6{0JsWyhN@aCu)50R8(yG3W911Y*^D59KytF
zUsquPQwBDyIR&2S8@fx(@(6)t<wqL9zbM%<jPk9S#oe~q#>zJ+#rTK|8=<H|h%W3Q
zle%RxF%gZnHkVt`qXKsBU{Zc6yJj+kq-6VmOxc(@c(CvOb^SL_QBWKSs@zm9;M6Wy
zlxp0)CPOF+ID0~+j9Z>Gz9VpXwyW+O&sLFe(ts5QU1{_0je4a`;-JfW2+=jhlQ;69
zef>3{+kb9-)Bb3|d*D~Vqc8j$)?-G__Mh-Aw-~+1<nl|Xq#pm61=l|y>kh)_&RqlG
u^Q(E)KK^kr*UZnkfcrD@AE#BHc4zzY%HaGI@AS#1J<I@lo=9#nDF6WByPy~V

literal 0
HcmV?d00001

diff --git a/static/fonts/poppins-v21-latin_latin-ext-regular.woff2 b/static/fonts/poppins-v21-latin_latin-ext-regular.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..115a5135c05d88d32bff2f1caaf083c709b91261
GIT binary patch
literal 10832
zcmV-WDzDXdPew8T0RR9104h)b3;+NC0AX+d04e+c0RR9100000000000000000000
z0000R9vm(PU;u)63W1tD{do(8KmY+Y0we>9d;}l`gIouVDjS$j72}vyz{UYE^vJcN
zs9B5Dm!c?>oGSbOV}guv+v9!}K~&vcqKw!a)>>N8x~I}u`%2>Jr0OH1;%VO=$0@fm
z&q@3RadZd`Z0S=AEZx|&h@;fOe^GAAm$M$H+*JM1MwAjR_||s`T;vFieUi)5!~S?W
zGxz<4)fJ^`M>i;Km6SGgIHYax8=jwA4^UbZP@yHph*hwRzwNK`FW5#61_MT^q@0*_
zSQv$RaN*rC`zp=4&^s@Ty!J5iysi&1Sk!4jOYBH)6k^pS9K*NcqT}0fy|a2<pEJ_x
zU|RA<&HzJmOz98l>AhurJbj<c2RgG<&ZP7JDMN}3tKCChBlN$3Kf?4E2Sgd%03=8}
z*POql8=9|9J21iM_ARhgawQcH*5Tja027dkdcU#XR(Fr6V(}z5$macvCk4)tms@4W
zlBx3uV&wh**X*^)!Y5MM5~hxX0(2`&?i=%RXZU3%1iM+v5=@|!-JbL2EzQh+$VV2Y
z2$M3iBUfSE_mw>r#@C4YpVN|B_x0z-v+FDAl?7ny01`C8hg`H(dfUBetstBE*iKLa
z6Tre64-3FSJOt2~*)&!*t?EEP;?gFM*ZI1~G|$f3H|RnqL>=NH7g@-n^MCAPY_`m=
z)W!iO^c`+@Q2<-Wl`HDRlVKBxHw9o#RCdI|ipk8p@~TcU&72)xxYG--d>La_n+o*a
z+5l&ytXzy72+<Aq)otntI_*rE7MunS*cr0_-=%s9HM}2z`v7`Sj{^2H1yH~Mb`m3s
zW==_U*O>&Snt7>htw3MmqH<CkQYr%lNlp5)Dr@s!b87GLe%kB3xzED(S^i%IGo_SP
zM6Ar^PCoYAEQjT&oEWE%tqpB56e!-1LOYTem7lWE!wejE>W`}b+sum^XrJc)S&%Nd
z)JK)Kdyo7lf%V1uqkBH~q0^2x+4~*o?cQuh+oQ?(?N>d*{CuDO!L-pjl`fn+b84>^
z_4~v8vf>x$tUgmL?hm$&s*QY^nM>Tjeo2mJ#~*tdJ)1tx@;)jzU?#W^=y7fs0vI?Z
zhe|i`(I9hXY+GgYEYx&7c%9stA{}0%lT~a0gYn9RIt<iiE~dEaJ<~t~t-6{q(j_yk
z`!KrKLMF%t=}fme#?;u+cs-r>gZCgcicA@pNQ1};9{jYTL~m9oOle43^odgnylP;X
z&3>e}Qy_pEX09tDL9^1p96o;aw9hMciY*Sug>h@5iW~qZr`wSlhFZ6%$+HBEj`5gL
z#q8^yid{q6Q=nXch$F5eE>tL-RO>>R#t_v=+c+t@bmbl4m=nmNrUKxKHaF%fB1gkC
z(qO*biZ!Hu1pniJL-s6>A`U6%;n6o#YHjqzM)AI30?M_HxENZF3|CyQltmPdDF#GD
z2Lam|Acr&~@-W8q?VGXkH4;8OR0|W^d8x}CZc$-Oh2j8h2P+{!G{12UZKjoh69e?O
z6^-yKMo-wPs@3mTm6}-MAonngJYpJ1e$1RZJmobc&QTU5R(O_wVVbQRoel=m7+LOx
ztTdF>AR>^oog+$Ej>vuAAm`EcyX-N$TqX%BQoEYvG{^D`NYiIZG<Yww6iAeq$&ATR
zaT2Kues+$NaOd^`eJK3{rcp7dxV5x|%lB~a+$o>@hKpA)HAi%vuMi|0*nTi6(Tz08
zu)GvmK1&xD-fmo3E?L&!{AUP9cJ6Ijr|*ze+2!?03Y$L0B&p3W`ai^NeGwARn0G7w
zF#T8l_El$hzk<Z)?!VigWE8*cKRoi)?yh|?N}JvL8fuo1umdMVFcqm6?IF(Vb$rKf
zhj7X6Mx{N=W5j?_5~sV$X=I8^H)D?D9=Ti$mi_~}gduaTVFxqHC{@@ahC^5&Msn-p
zUhLAgv%UnEv13APuO|_)j}qHO!LJ*J9=BQJ^7*65qse9OatrdLicZdDZ%X6&?K8L2
z6_dLk5xG4Nc@v*x7<Q$`w1M(x(PR7`=LYbVm|k0fB=Ot^L1-JVbgKGyy+Wp|dX~9P
z@jNPv#g!+Il%t)>)w3)B0V4WJ6V1k4B>|eEYnA)DvZ(9SQXTDL@71>y;j)65_V!_9
z9vz|d_(_R_+}EpwfIvbXxsFE>xdhTl^Q^*o%4Lt*1b7|nj7ws>+S_h<c2JUVRFa-J
z*63K5MaP@5DivaU!hl={pJgN((mJ!y49YTdE56hFZjxj9V&#mWEdFluMnY;gp05_X
zr%!Uh7fEveHzvtqif3Bbq-b?UCyB+V_K8`t7>@K>Fe+?+w`9tP1s~doq$G~4UQ1%?
zY*<2dS#~@rGtmq_Ye=i1T92o{{IDvuiqvbU))7}Mv8S?85)jbqK%bFJ0m<}{Pw~l!
zFs3p#1B+{NRZE(OPM*{_g~gJpj;6~h6P%(Jw!WFnHl|`NL@52k&sSb%?}yzrzh}~?
z(w$#uW!%YBf_tG@Vhh9Dk5N_wLXTgH8W-{Ql2!$IkiuF^Y`tNGWc^){T|Z0yp!=O{
zCT&xao4=w1PdB*9V0=RAO#fG-C+MWJko(zvUDorlb5qPItvp*xrh=fajv%IpEz-i?
z5Co6+X#P*B_aT7X?XY;N(7oApE6Fg>QLzno5ycV_wIPp%V|6s7h0hvtC$+SvPkLI3
z;Kld`m1;as>aAs2*jevlD(Ny+cc+1GwBOECZG3(ks0LG&?E-w6ip!9Q0(yXPUBS>)
zIC;#cGf0bSoQ;LKN5=(SR*i|#4I9d?s2y#}l4Bb;QkHI!>jR0iLG4he%I$w8?`m}(
zmY3R&56FG)$fW5K#>yL^NcGcq-3gKvfZv}O;0#Vmw${%Z8s~I+kUww?`RWk2{{(#j
zQ$yJ|B$|aF^(ukfVfu9)1y!B!8N_B=jN8zoT-SbtGqx<x<B#U#-JjYPL&tAv;QB#M
zUva$8;ED2Y&hQHA!1yrIViCV1N}L7KiFzme`1&pLM;Vsz;?l-~8aD1pfs@*(u*-Ce
z7oAyF_w5B=qH7OobrB)I!t|0Pa^-v>1$`!C$rB+VrUF3(C^X{cz==8kg|ep>Syd*L
zzfh&S(*v|211B2#up}|2Q<x@&LrvxH4HTQ${(xo)!rV|6N4$z%e~fx?dXIjCk01q|
zfb9+;YpHYc!Mb+Rc<hzU**!KXQM1nr4G3BxkVrXPjB;J9KOk-FNjbh!kL3(}?qsm6
z#*X)b*i{mFG;UXJyXuv4I#XxCO;KDs-_MLOR&AfoY_1MtS`8XK<eLHI$A>zpcS|Lj
z!`0+%nxtRM!8Y}?W!(6C0OnOCk1L0z0Q7P<Hg5(A@y%#S#TuMlq)Xcej!2pec6o(N
zTH{9|b2QjI?Tzd*$gx=cV1mIq46ii=FK7N;=0CSwbfjXl^(`D~G(cS;Yw9_hLz2rE
zBeQmNm0!N0D|hCKw{d4TJiOS%ZPEB4XN>2hm^w}WxJ>(Hxwf>f!Q3VE?cWZbS*=!y
z_bF#70DxfM*$h@4mIrg+g}(#e#Q7_#r_}|@kytVj)$&?w^<d|_$w-el9=W2)vOqwB
z^lryr_^akw7q#7i2*U)BIS(Kq&Kb_`Vag~2YV)!H624-Vc2E*V^*BPg!lW)4Ktrr7
z_%v2s!9~OqXrYf`@vGrqUZF7glTA~KJ`j%1o5Jq^N~`g*JMcIrnP1u%xwc|s!!o3-
z`k~5>z{<XV=nW2N3{7^`S$2ie-4feYzaVAh|9<5))O>W~-M6ADrSf|pFIX0wt?C8A
zh8_SJDp8yK*|`Iqo_mST=is(Mm}`ly#_&o3$Va}FO6lgB1YfEEvZFOo4<xmIHL7Sn
zs~C4HalB7O%nG&9wVsSeb66f<>;1UDyL<{kxOkOA%C%wHwVo%Sq~QWG4D#3R;F6wB
z&N~(A7z(i(F_cOc;e#boDF(%`;l>IbfrY+qp>}Uk)}dTn07xkGDN>q!)5}wfjK?Qt
z;H>uR-;|l&VUrrpJ7lKQ6R&vPX}lj?u;G(v$Lfsq!_dNw{u(++@)-hq=Vwy=69}++
z6wFlrH#tj&x(Qq0kxG&2J~HqU{$e2q+>ua!9&sN_3S%jz?U$+Rxj|ggi$SZcOR`ys
zmr1i?^SmR-kir{~41rc*rr7iZEyF>;etC8Iz!I&bW{Hhz9iRCR`ZGM=wY!&?#$J7f
zVT8b{|9ZUaYqJ9Kci5Vcl#|7w_vbhYkjVF)^V%GpL&GXa#^uYU@bJw4DVum)nZu>w
zC~`+B%N<5y4Q{TWl1|%RnlEWfJR#4jAmfOTvw~-Da!%2?xclgo?Pzc=Cv{LX953Oh
z+X_9}MV;*nOu%1PQ{}I1@~>zMrp&08iWF%Mg}6XG2tJ%ld<IY3WuK&EXZy2?`wJ}2
z0&(kd6F=oAeR^wR2im_Xd1t9^OT}ka;Pcb?Hr=>geT(jJ!!q5o^YyduJV;qdusE55
z7(HF@h-<9|YA>@X<8RRneKAud(6<C!Q;l?^DYniXr}Byz2c8RO7>XDwVaLpMEk9GQ
zQf?jP2=SyNq2EDySg#WZI4qIAYozie>m!cg@_Mn&czmd+s0D}bEBgIJf<sp$(djd2
znw@=kT;EvM_o@Qb4g?h@E1+fy$0JY}nsswtoI+!<GGl2aU0YtN%tPW|q05qs^W*Bz
zoXrup`t&QNRc+n6OlT=@{Q8@IVguWxmVmf-a+5ygCw~eqBMpTI4!2a)S9uab^)2Yp
zEe%<<fdmgAL=psj{98s{6hbCSp|t<-fwI4t#|0K_D;6weE@PC4x~<bUs!}#~+tA{r
z%%znm(R|zVP4J9Oz$CkL)qM4$`r<Y7wM*b&Zz!1yB?Il$!MOD7^zl@b&5=6O2DrJQ
z)618!+u@1O2g{c4eqyU-cDGC+mLPFi9kb`UBx0H3A1DVX={Fv~;2Z#NjjvkZTPYRt
zlro9Z6fLvGg!<>!)OEL38+}`QJG~kk{Jju}y8G*DB|akANaM-u%clyat6VUX;;5r2
z8WuIj)z})1Dwzy|SSr7;CIikyfQ!YWN%#VuieF;~r8}hVdrdd1wbeTvJ7c~|?wJM>
zhdg&f_A;umPJ#_`AzEv*&=44GoMyLwZsZHJTDL}{HEC!Xa*pNocfipNVY_uP*y?X!
ziR$L{w@Rpu4ScvRjNo>5g@7*<NYI(yUau;`%P6qbZIBr(N{!a027fP`wal5dV1ed3
zSh9j`<j`rB1~Lpckm(jWi)%5RhumTzzp9-I!);W4l~64AoJ+Z)70RSqA&+4Yi^K*A
z<IaaJiB#ZFtJQY3K#a&#;P_&Q%QI>QqefsanIo>JvjeKe`3u^Xx4e6#54*d;?5b^T
ziZhwctT7wpDkB2R3|2^?w`zc7(c^oM?}ne;eR2;3|5r~PcUc{;1}?*2Dct`dydTUB
zxdVgMp=h@@W?P;=#5Qu|QZ7#>Vp%vehmRz*eb)E?rcDg&Hd;6OwUpI9yNIl3{pu#s
zV2e|$;ths0a!-N$4K1mlXa<K?#!}_AF^0CTTGe&3t?{$DU}$vZO1Hf5gbmf$xJzf-
zSiNHK{!a^6O9Uz^#zCht1XLo#D0Px)E(*B6nOM2G>YpQlzmHVu@Ai6nJ>X2$_b5dL
zjb^GP%BDpAmizG}Etx0Md81Gx0x6qDld?sd?iQ)|OqNz8-u`kYsQ3`swH@)cjWwaG
zo4yT-VMSOh>@gXIJz=o|4vM~QLi@*pZQkt;WM?hdG`Y`Y+t%1<+q%!tb}e#kxM{`8
z!38VV4ELe>!2af6Ua4L^u2o$}yHw!vq>}L4OXW)z5&_PKUpI*qiguBx$6yf6Zx<<Q
zhvp{M%~p2F;>^g(4F;!o)ZyG&TkG64>hOjRHlh8XW-@|s{2U~Lko{z^e=>qZz@f<)
zOQ6<j3)CY>G=W0NCB%Tw^0_=Df{5pc!fYoG0s9rtmD&gbNYO`*AXDze2!5I}wSL6+
zKRdQoq^Saf97USSD-ci`JL+)mq9^*;h3u@WLvm?8NYgGB^%_m0p0HS{1cKjWG?Ck1
z0rEF=w#^$Zw)}Rjjy-*HA$M^7FxXH0{Gp{waWpTn{?*n|7&kE<SW(tmQRS-@9N(MU
zoQFid*9K`cgbf**45{PA12w}+1;ph+V%0FX8yh5YE%9D~Oe7I11(dS4gjs!(R6{Wf
z7BZREdV<8)<Bii*%M~0hQ_iBHC+@G3q#03cSVW=O1C<c?Yf^bKgoI8h!QRP;%VF2+
z*v=I}Cau!WPNq^>*+@FAlVJH|>|{X4z1MB}(FE+ZkuN4|cM|s#tHFm6?<UQDP3<WB
zIt&8HC8TcO^zGAYE+Utlwfkp`&Zq^{$sgW|L*jmXtL9Kubz8xR#-u$B=?gX5qYy}6
zw@>By!UG?v0>{SE*V`P_0SY5WV9%qjIsz6PaQ~WQ{w>M#?iSEfVw!0J_f|_TwrW8|
zow%=4s(=FA?bS|{vv#6^Cs%aH#e>E(91>z8QYc1(bny5jr}2YKM7NO#K6=>5l`1==
z;y#m6JlH8$$Q!s5HOO5A9d0a-6DZ`82C|dOV~=9ym`~$YcS|)j3%oNezH>SzN8@Sm
z`8|yqj<)hg-z?)$wO^A;iTf?wlvE0uSZ9iycb#=R0@eQLd_D=1vF}aMRXZTIhW?*#
zmS)K3)6A1f2h3)1|2&CK(<K&ks$4RhQiCQ+tE{nV2f$nnUqi0RRq|4&+Z2E~DfH4X
z=)g8~!A&Qs`0brSZE#ghveoguiz8CGUFPsafX@Urb=P8jb%T{(c{9#WWdvZcgKp4U
z<dDg3As}~=lrcAs4ZJ<ps{ms|At>PQ`N2J17wj{ILM*4L(dY-L5d`#Ke)9A;yLZk%
z?T?xfod)**NCWNyax~sgWmbN=I*U|pbXf3*?-)TL+Jg>Ur8L0Z5(w~x;23UxcN;5@
z0t(TLIdKf|Fuq4B8!(%ofnJG5(<_1c&1U65zf?oinsHP_B%&ZjEQxHul0Ggm5z#k+
z4<9rP2GRGT%sg9929PqOCLEkXkBai5kHm^<XPGmwt&tBw9n;OjslRL#fje_#Uj>3f
z?BGnizk&%Dx)~A*gL<ME^;9(D3|v4L&?-n$q>PP(kQgme@gt2iQj}99`F%o>ua3fz
z<c=~nICfQBHlsqUHoz*WPApf+mm*77sQ|ech3H3|c!r>c$_l_j2TiZH$Q4Gr1qU*X
zV`sdViyICbA0W4(4i>wI-q!ycbRQ~q^?tSJE7xmZ&;J@U4t~}1mFLarZ>HA`emVb3
z&qT_bGXbi2=5DmRG45tw&7oss$G~dkG*yQxVP(9sRSD`}uSv6@6OaTi7SgFCENywI
zp)4=Xl#&o&X;fKbbR$(x!zOrA;#6Llp|o7flIT<rHo=>Kpe;3N;A8+<h=5nT@@4Y<
zD!Zd{z*`c|*|oFpL29;$E6H5bk=^=1-|h5l16K^jDI$rp#q&0me+ef(^MO7sOy6OS
zSG0I7v2MD%F}`bgV<R`jJLygb1)jz6kolCVk_)@5EEcy11_cWE<g@K%W`6cis{r}%
zHd;V;`zV6irj8i9DO)7xvmmjo@cNYx1>-~69vKWyaQ-{E<k$li=kURigSR-mf4>^}
z`Y@Y){A+z1llY4}PF7Y<U@BHJ7`+&<v2Tg!aMbS7&&8i_L$;lErSBYy5-r)otUc)2
zpPX6{E6zdYA&x|3J^~{0RRj!C?kwjy+bvOQgtMPXKZwctSX}VDrqE}UF=Q4|TG`6<
zD!wypoq#zo<7j#I_Jz-@3;efMY8KD@r&TYMiZvo4S<jb9G(sYvH9eR;`{C?a56Sgl
z*7958?GC<eW`ifEwmB?2>gw3F%~4Y;S>d!^dabi`iAJ%)?NY2<qIEeJYsK$!n|6ye
zPOiaM$*h;jl&z1!Q8nq(#il$1^2E(r9c~o|`}b$2G+C1x1_e@#UWFwPM5t+8$PID+
z9WEVDgz*>yP08eo2}Hh#$%GA&z!x&X@-EMKGsEs1pMki?Wyj~W0j`OQ$nxtDV0?g3
zDNYuP;*tQ1Jv&_vr<N^mu^|ct$03D<VEU}Izc*m1G<-+Urs}9ys)~l@bY_+({g#yU
zD5)H@d@QMwfE<U<qtSRhS{hEP!%#F;Rk{oYOMt_&1Wfiy9PShg40gYFLH(cl(tDTG
zmkyc_s?9AZ*vyWi2Caz&c{$%?WF9P4<cryCri712AC1vef;lT8I*XxVWAZcJkB%tw
z%i&5c2dX4Ptc0B0q|8iAE{0g1mzA0EZ*KO_Vkx+H@?xvxVh^Y+Mj_Q3+;nc4C{Mt0
zlsT|g6C#%z>=puu)i<e|^!Z60T_J~~yS4pq@IFIIAri!u^f237_+w_qkA>v9Tp`F@
z#OSMn%0PjXpf_QuG$WQYbQ;lM!eOETcSB2=0wJEj6S7%c0Rb-*GQoPZZ`|J6soCS+
zLl~4)(f$UhBVswO=l*u06q3GQvF(ZX0kLDec{~K{i|DCm|1NtlVr`0i)!!ZmAm$Q;
zme(TYp~%K|0>uhKu^;1kmT2c^Q2TZPOzWe6W&ge?p^hy{md*a9kqM}M)w&<ng7Xkw
zJ=4X=#>VP6+KzTSdz&0n*E)?`eYJ?U7>ps@+thlEWHni-*A}*|Si4}siZ#Q1zn(Uo
z{;dyuw_*Dx9y=PhY}vdO;xP=|wjHd{jpKSC40+-F7W79vv9c;Kik~k>gxueOwV%`F
z&8x%=F9Ph0YM?=(pDZ{`g8V5EGixn!6j?L8e#`A0gd|)ZBvlQ^4g>az&h~bx4@XvE
zi3HKweLXW~-x17$GK4T2s<zp!O`cezvtW!&$SOr0^XjrCY<#g%ke`%`laM*9R-+LT
z5I#xvkK{CswiGKc(r@`@Y5IL0aSQk325sPcBTot>ZoQ<hOA3qY8B=QD8d=j)xLv~U
zgj@nVtSciy^+>Fy!w<ZnHP1^XL8}-#os@KSyU!X+?t`<ZQ4$+~So5@I;B_wo<KL$P
z^3{C`y|zatSztCw`{qjFE-o_1ErACyWY?Tm1Fkmn0u1H(RS~U;Kz0d*B$p9SCL8cX
zhfqXt>xpDQjT5Nj|F=#3O8pb_Up`2^@Vv;&f)p3#RnWHy<(d~oJ~rOC&>96}LU`VV
zN+|wQ1~K9xxZtbio`{4!P5^xHbAtpz8XqPoARFsJ?jzK&YjRCBt2rDOnj$AsibnpT
ztPI`yJEp%iGvm*kxg7!Ar(msyIlUzm8IdCQQp}*&WJ1G<hU4YMi*xWw>kk#FeyKiv
zy@Z9PV6yEw86=DIx3v&wgLO`>tBlV?>_fDrh2Elf>bY}NlzsczKMqHNdv&x+l^Yha
zEYmP?PO{A=N<9&)=9W48NPEQbbr7>#gOW#lMEP5Ong$iFsUR}ahz1A97{a#JR1oMH
zL<?d-gX`$BRlE;?eB}K|BwEo_J+KbTo;8urGb;^2CBgn;z`X#kE0`@XFF#NbuC5?(
zy8`&9XVy#;Z!U{=5V#R<Jia(Rx1z?2;PJdzu>=*aZLW&sxsodc46Brk$+G8Wkj&0y
zdm;hbT4Qe)$jKmE8sSMKG>2Y@umhfrBl-dON8~PYh&h*M!HjD$3mlNjG*o@ARG-I3
z@`GsEAx@t)t7JLth<<j1WZ5uMrVqN4(>|J69~sZ{96Hc{Yr6Y5x*pda++FaW{J-ZF
z)VT^RU#zydw>pqrwROl&xeAwUi3%-S)+x_%){5o_*fZuE3~IYvTr3crOJ*F2(R-W<
zP6+mH{K|IOqdD_rD$V>5<JKv=r75pEq_Cz_EbLH@-ZkSXE|G}rG~q}j153{N2jSG?
zNo~bAji!t!uR^Bi9iY4^d@njDTot{wy^m;NLo)iG0|UiIpM}(wc$0&9k7+1R?X9l3
za2?Q&{!c2nZ1PyNQ?2i*P8VN;#E3>Ls{nWwk@vf8M(C9Cs`6wA<e`>6%Ah#EeoUjR
z3UoBntJolTHgbVDN<~&xdK$@s?D=j<3xnPVV4a){)(=|J8qC7GU<)v=l-8lvN#sGs
z@?iEFZJGmN;M9zuqChov;J4G8?8cq-0mBY?Hu$U7!TNP|c?I}r88=wR7HZm5vqgb|
zy0Pv~UPm33R~;icFJe~LS4u$i+l^vPI9AbKnHH;13FVow%JjVB6hoBN=ViGj!CtSg
ziB&zWiB%eeVtzS-%jJj`6ba!TP<>kZENPq*$M`efn{c3lT}n0?D+m49I~EJg!Q9md
zLHA8Erkdvm7i<|@YJ!#;mKY#VvTuogsUBKtT4DmYT}ntSRza*(I(j1kzY$GO1EdiP
z1S)8`H^JRapW|`Y2!v}m{O3f)!;FlFSy_)VG9G1tj5X4-^uw5Ij%leKD5~E4<@!4J
zukw4Xri2F6Hm+zy&l%y!M|8lxUY()_<TV@Ax748bQmy9)A#hCATvY<VY*U00#kD^~
zhi?9`n8axF-ua<@apQDc{C&rPE(z)#zc?OegOT$x8HM^>C6`etx-kujxHaI<$odF!
zys^OyRZ#eKu*5$WZ0&q!urTNq7|XM>N{#%gSx{B;Fh|=u)>Kj*{H9R|n|jRIs^9tl
zmS*MA{}KF_tLQQ4!MPnb-?)5ISvBkNC|Wd%uHJ>_?<)Jz{q>s|(VG?3hs#BW%TK?=
ztsIzm16(Ysx~{lB51D6CSgI_LMe~sIrEKkNo3~Ittb!z5zFYzigUnM;8Rjwwlv<8e
zR*CDw;MJitHb!)*E0`GC0$jgey=nkxT)zTvfONp7(t*6LRJzQ(AzJG0Jy2;Pl@l?^
zE1FH{yHej+lPTTNFuga+^9J;wch_@WMTK5*9x2@k;D=ElpT$F$t}m7DNSN!L?SkuV
zP)yNrN2O}wNa>D->9NLhf4iVZWtJx@OJ$W=E`TSZ9YWR_oc$Kal<ow@_o4AjL<GIJ
zJzUqI)GNLXr8@z(z$nm&c<@O{e}5h7-W=x7>jZy-(F|>e$&0hc#bru&g5q9iJlnPl
z+5-pZI6K}&rqDvxA^_YXY@p2G(OW?TXTw%|eKl;YawKeTZx7o$D2v2$JlF(C8;2>S
z^_)l@lwEay{fA~)p0p%n*8}C;`51^kM1?it3Z+-vT+FV?!^+AgHwQW1w=B)<qwZV*
ze~STa0alNGDZ|4$ENT%*xRxZsFZ0$b%`lwdeXSS~UL%`@KZ%6B-q6DS{v-#b3rI1s
zCP`nv(Bd>GWx4_51n5Mc;$(}qhh-nAj?$OH<Za^L9>-Mr9j2_Z6Y2cKuje~~N)z<9
zuzH<d4z4qITUZy?8DPlmXbfP>?0^;+)L&G-ut`|goifvgxy<^A3dg$9wlXW$!r>LS
z7vH^RM`foQo$IR3^_kB1E%;s&XD>4fBXBMv{qJ}*w1f<`Oa0qUw+mVf{`ht&JCB2N
zmx3P$`V5}TZVO(S?}qcZJ9nB~TFW7Eurtd3RxPLvA3++rjWJbyUq0NOF(Z0+T!({!
zY+4`mAMqgl_|5L(1{ZXm!C&xh0S=VznB=F+Yj#R{G4qc7GT{FHW49}x`Qzs^eC!T?
zqW@c;pQikKhW!7TSJmmIVFk(;*#Nu#ZC{IItgU_A;?ln&B*R$NDFk}wj3yprJJ+x7
zLuw#j%_tAvTQ3gq1DY7FkI~*p`RfZ2PyL-<KX#b)ul`(ph~!`k%k@;k_5tu<jGO5|
zk8J(QAGJ;j1%1q);|dW8LP?8)KE@U6y%d-c>d}vD(N}Pc=10ski-P{aXI66?wEkJj
zqy&9@?-j}a|6fVSAT}Fb!(thq5chW;V*lU$a`vWLhGc!v^E_-HS-t-73`kI?Uu|So
zMq3C?&i(w5eSDq=>?3sVNb~=nT1i>@V)EDfr}i0p+S<?8FE<=9maY9{{e8pcG5uSj
zACg`4*7$n#ACC^cjfxxfI-eB6fcJO=SQuXe{frkmzh?h#affRKIZqz$=X$~1lQw%1
zF6YY3A~}4%FBQ@0zh@wNu+I*kGh6r*?&pW{!(d4AwLj=H8SDQOnI)2eIkb->jln21
z=|}bOKz^N3<#PJTNrChQJ<kL7k(N6-BK|Vx@q%1-x{+RTPd+KU(tb2s;VW`9m=xHp
zamt^6jCrD)r;{4+a_^$87CUEL6ktj0f_qY4zhpY+xA>Tt`vBiOKXwuTzTbuZ|KEfE
zK2D6A@^#OJhz1bgTNwB^e~_5)SM!P>%6&^N$@7=qEjNEdm$RrlA0-uRK`9<cVViOK
zhl>8F#HiwYDwt0d<|o`9V)g0zs-;-Y!{#Ph+wmfRE+3_8q;@E4J4NSHv`AsQaN0@X
z5^Ul@Mlnpipr$$8O$H_N0@Pg!TSGll0Hz;NHwvipC-o!(Opj1|N!>K%wNmFz>Tyx`
z6!oORR7^cHVOm996=w4kbvIS_m_27@v<a?|^ya~5zlB|EDEl?HLrHH5BnqT<4@~z^
z*OL$&!E_WdUgLq@`8<DiuNWJFB^G#K!?b`TkPh{HNd$xhWp@BnlH{RE&K=WAk(|$z
z=UagktIoG1jRPe~0w71Qb%d}%*k<9^D64+G%ZCq3#$+PpLxuSUu1l5s{siPd)C@_@
zX1N__i&B1I8UB#kh14~f<03+4NcFL-9BD00?f`UmL-iBI3gbN=Y?GeXB+sEdO2AfL
ziksNu-WR<jVFpwbbV%K#DP|o2Ft3)5;doBx35$YZiy-K|>-%74K&6^BG@~Ny4T3qq
zydc4t(2GjU*w!Afv6P+yMpkxvGnYXMPvS^aw0PP5P34!BzgPSkB8&ZwR_ewu{&PG-
zm6PGLmI5h7_q!7OGY{~DO5sWKg^Iw!V=rTUm<Y36sbW`ZrHOz5STl$^L(UM)7W^Fv
zg4Kle008(Eg*Bn3f=MF@yq=Ba#094IhiK&9P>@Qg8;78TRnk2(J$BP!<9i8-)>}aP
zUhs5ql^Zg5U*PEaDm^mMXF}X1S_GS|jFnO%6OLYr<UEux7+J%U*%l}-sb?C<YAHB3
z(L@2c#0JSa#flOwUo7BCz=#HHrdEuoB>@1>x=1@mN%5&Ox^i;o7#ux2Pm#~P^HhmU
zQf#P_E~QKzz_r@<-L?p0Asjo*uT4M;%?!gQ0)irira!+r1X?mMosbqS0-A;47}TiK
zA;_x@6&?{0RkBY79|Z*y87;PgGpLe^EAe4m(;Bfj!*fT#b;ETPAR}%P1x${0O*hD;
zHj)~`*e^~9bqKB>8fw;MKGoC-+$1{qrd+>}CWJ$&_S4a!S@mzyT%z<zmy32kyY-Rf
z{3e$GX;ch|$&{$6-x%$GAMp|-N|J1v6w}R+DowhXW|=KRrYzZV<jRw8jsk^>6hkS2
zR;o<73K&>8cmzZwWE501bd?yGSlBqYc=!Z_M8qVdWaJ<UN-8il4J{o#10xeN3o9Et
z2ZWQ0n@1IIV!>{&S?Gj~?i;q!GTV&VlQ^){bwk#9>X{XZ2aA2=wkNhb=!NHA+T{&j
z_{=yTztyUJrN-yJbjH`d@vUFfy5OvHCe(Rsjms{&q~32HSfW8dqb5Pkb_i+JqD@$b
zcAdKXs@pts&DX2Pq@Bj?*Jq%?e(zyNB^b+g-2Uqo-|K%82u1q7L@JXjlq$8RKl@9o
zBgU+WshPQjrB#1-MTL#6oxOvjQ)kZmp&wCQx^nHttvmM~JbLono4rLqNJLCRN=6Q%
z=x+BYsle1Uv~=_gj7-cdtZeKY5KgX+ar3C+?Wca`Yo8?jsZLF5Q<wS#(%`D^-Eh+_
z*W5{Cf@w-~LTO2B+7eE?x4q*%@B7#h@A||7iyU&&DaX^1&UB^Qa*uNMuXB*QU2A&j
zmYgH%l=|ePuU`|KQV#=@?Axh#octf6>cTk<WB325Fb3y1PIR;H0Ov)9u4z+0t4q>f
z3A69rU4WVAJk9$1#EA7}rxx>PWt4NmiZ*|idCbN9T}hn4oCqu0QXUG@_u@1$r(X!H
zYl?jYI?lz~fTV^1#i#qOyGb&oT#SD4!OroxMu?9a1thgAVXRT?cXq>0{5OF^LpaS}
zO>IjUqBIvrQ^?o|FgUl*@zu72qHk~#J6xMtHi1iza0#{Tsk?y630!4L#p5;w#-{{s
zPjL06lYUBO37)Ey#4mJZNommK-C9%HR(L9;+a|5m?O#c^`KNzZ_0Q|@BlMfVa}@el
zv}Y_<`qzE)EvDYc<ot8UgqA+f0{f2{I)(7Lbaq$ze5u+#;UBs&RX=wVc)XSUajJB=
aKRZmL(fNt8=^K{^m;vhbL~?>j0RRByC+@%i

literal 0
HcmV?d00001