diff --git a/ipn/ipnlocal/peerapi.go b/ipn/ipnlocal/peerapi.go
index e6152ba01..7a63b07a7 100644
--- a/ipn/ipnlocal/peerapi.go
+++ b/ipn/ipnlocal/peerapi.go
@@ -574,6 +574,7 @@ func (pln *peerAPIListener) ServeConn(src netip.AddrPort, c net.Conn) {
 		c.Close()
 		return
 	}
+	logf("remoteAddr=%v", src)
 	h := &peerAPIHandler{
 		ps:         pln.ps,
 		isSelf:     nm.SelfNode.User == peerNode.User,
@@ -1022,6 +1023,8 @@ func (h *peerAPIHandler) canIngress() bool {
 }
 
 func (h *peerAPIHandler) peerHasCap(wantCap string) bool {
+	h.logf("h.remoteAddr.Addr()=%v", h.remoteAddr.Addr())
+	h.logf("h.ps.b.PeerCaps(h.remoteAddr.Addr())=%v", h.ps.b.PeerCaps(h.remoteAddr.Addr()))
 	for _, hasCap := range h.ps.b.PeerCaps(h.remoteAddr.Addr()) {
 		if hasCap == wantCap {
 			return true
diff --git a/tsnet/tsnet.go b/tsnet/tsnet.go
index 27ad69e6d..e19d4483f 100644
--- a/tsnet/tsnet.go
+++ b/tsnet/tsnet.go
@@ -765,13 +765,12 @@ func (s *Server) ExposeHTTPS() (net.Listener, error) {
 	srvConfig := &ipn.ServeConfig{
 		TCP: map[uint16]*ipn.TCPPortHandler{
 			443: &ipn.TCPPortHandler{
-				TCPForward:   ln.Addr().String(),
 				HTTPS: true,
 			},
 		},
 		Web: map[ipn.HostPort]*ipn.WebServerConfig{
 			hp: &ipn.WebServerConfig{
-				Handlers: map[string]*ipn.HTTPHandler {
+				Handlers: map[string]*ipn.HTTPHandler{
 					"/": &ipn.HTTPHandler{Proxy: ln.Addr().String()},
 				},
 			},
@@ -793,11 +792,11 @@ type funnelListenerWrapper struct {
 	s *Server
 }
 
-func (flw *funnelListenerWrapper) Accept() (net.Conn, error) {	
+func (flw *funnelListenerWrapper) Accept() (net.Conn, error) {
 	conn, err := flw.Listener.Accept()
 
 	flw.s.logf("got connection from %s", conn.RemoteAddr())
-	
+
 	return conn, err
 }