diff --git a/README.md b/README.md
index d28b9ff..51b8f76 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,9 @@ Compared to lldap, llldap:
 
 We may explore in the future:
 
+- i18n domains (punycode)
+- i18n user identifiers (TODO: check compatibility with other tools)
+- RTL languages
 - hierarchical groups
 - fine-grained permissions (RBAC)
 - running with different async runtimes
diff --git a/src/http/logout.rs b/src/http/logout.rs
index 844633d..e276744 100644
--- a/src/http/logout.rs
+++ b/src/http/logout.rs
@@ -20,6 +20,8 @@ pub async fn logout(
         login_page(
             State(state),
             Some(LoginError::SessionInvalidated),
+            // TODO: this is wrong because we produce an empty redirect query which is
+            // then converted to b64URL (and panics).
             InternalRedirect::new(),
         )
         .await,