diff --git a/docs/changelog.rst b/docs/changelog.rst
index 65f6759e9..25683aeaf 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -3,6 +3,11 @@ Changelog
 
 * 0.2.0
 
+  * `#150`_: The media root is now a variable you can set in
+    ``paperless.conf``.
+  * `#148`_: The database location (sqlite) is now a variable you can set in
+    ``paperless.conf``.
+  * `#146`_: Fixed a bug that allowed unauthorised access to the `/fetch` URL.
   * `#131`_: Document files are now automatically removed from disk when
     they're deleted in Paperless.
   * `#121`_: Fixed a bug where Paperless wasn't setting document creation time
@@ -130,3 +135,6 @@ Changelog
 .. _#98: https://github.com/danielquinn/paperless/issues/98
 .. _#121: https://github.com/danielquinn/paperless/issues/121
 .. _#131: https://github.com/danielquinn/paperless/issues/131
+.. _#146: https://github.com/danielquinn/paperless/issues/146
+.. _#148: https://github.com/danielquinn/paperless/pull/148
+.. _#150: https://github.com/danielquinn/paperless/pull/150
diff --git a/docs/setup.rst b/docs/setup.rst
index 2361357fb..c2db11095 100644
--- a/docs/setup.rst
+++ b/docs/setup.rst
@@ -550,8 +550,7 @@ your gunicorn instance.  This should do the trick:
 Vagrant
 .......
 
-You're currently on your own, but the Ubuntu explanation above may be enough.
-
+You may use the Ubuntu explanation above. Replace ``(local-filesystems and net-device-up IFACE=eth0)`` with ``vagrant-mounted``.
 
 .. _setup-permanent-docker:
 
diff --git a/paperless.conf.example b/paperless.conf.example
index 85709698f..abb93eefe 100644
--- a/paperless.conf.example
+++ b/paperless.conf.example
@@ -80,3 +80,10 @@ PAPERLESS_SHARED_SECRET=""
 # For more information on how to use this value, you should probably search
 # the web for "MAGICK_TMPDIR".
 #PAPERLESS_CONVERT_TMPDIR=/var/tmp/paperless
+
+# You can specify where you want the SQLite database to be stored instead of 
+# the default location
+#PAPERLESS_DBDIR=/path/to/database/file
+
+# Override the default MEDIA_ROOT here.  This is where all files are stored.
+#PAPERLESS_MEDIADIR=/path/to/media
diff --git a/src/documents/signals/handlers.py b/src/documents/signals/handlers.py
index 666bcbeb3..a4096154b 100644
--- a/src/documents/signals/handlers.py
+++ b/src/documents/signals/handlers.py
@@ -5,7 +5,7 @@ from subprocess import Popen
 
 from django.conf import settings
 
-from ..models import Correspondent, Tag
+from ..models import Correspondent, Document, Tag
 
 
 def logger(message, group):
@@ -85,6 +85,10 @@ def run_post_consume_script(sender, document, **kwargs):
 
 
 def cleanup_document_deletion(sender, instance, using, **kwargs):
+
+    if not isinstance(instance, Document):
+        return
+
     for f in (instance.source_path, instance.thumbnail_path):
         try:
             os.unlink(f)
diff --git a/src/documents/views.py b/src/documents/views.py
index 71d350e02..d47ab8654 100644
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -31,7 +31,7 @@ class IndexView(TemplateView):
         return TemplateView.get_context_data(self, **kwargs)
 
 
-class FetchView(DetailView):
+class FetchView(LoginRequiredMixin, DetailView):
 
     model = Document
 
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
index faf532d52..b343b3a17 100644
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -27,8 +27,15 @@ SECRET_KEY = 'e11fl1oa-*ytql8p)(06fbj4ukrlo+n7k&q5+$1md7i+mge=ee'
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
 
+LOGIN_URL = '/admin/login'
+
 ALLOWED_HOSTS = []
 
+# Tap paperless.conf if it's available
+if os.path.exists("/etc/paperless.conf"):
+    load_dotenv("/etc/paperless.conf")
+
+
 
 # Application definition
 
@@ -88,9 +95,16 @@ WSGI_APPLICATION = 'paperless.wsgi.application'
 DATABASES = {
     "default": {
         "ENGINE": "django.db.backends.sqlite3",
-        "NAME": os.path.join(BASE_DIR, "..", "data", "db.sqlite3"),
+        "NAME": os.path.join(
+                    os.getenv(
+                        "PAPERLESS_DBDIR",
+                        os.path.join(BASE_DIR, "..", "data")
+                    ),
+                    "db.sqlite3"
+                )
     }
 }
+
 if os.getenv("PAPERLESS_DBUSER") and os.getenv("PAPERLESS_DBPASS"):
     DATABASES["default"] = {
         "ENGINE": "django.db.backends.postgresql_psycopg2",
@@ -137,7 +151,10 @@ USE_TZ = True
 # https://docs.djangoproject.com/en/1.9/howto/static-files/
 
 STATIC_ROOT = os.path.join(BASE_DIR, "..", "static")
-MEDIA_ROOT = os.path.join(BASE_DIR, "..", "media")
+MEDIA_ROOT = os.getenv(
+                "PAPERLESS_MEDIADIR",
+                os.path.join(BASE_DIR, "..", "media")
+             )
 
 STATIC_URL = '/static/'
 MEDIA_URL = "/media/"
@@ -148,11 +165,6 @@ MEDIA_URL = "/media/"
 # values in /etc/paperless.conf instead.
 # ----------------------------------------------------------------------------
 
-# Tap paperless.conf if it's available
-if os.path.exists("/etc/paperless.conf"):
-    load_dotenv("/etc/paperless.conf")
-
-
 # Logging
 
 LOGGING = {