diff --git a/hbd/server/http.py b/hbd/server/http.py
index 59bd916..aeae835 100644
--- a/hbd/server/http.py
+++ b/hbd/server/http.py
@@ -1195,6 +1195,8 @@ async def start(
         password_change = body.get("password")
 
         if password_change:
+            if not isinstance(password_change, dict):
+                return web.json_response({"error": "Invalid JSON"}, status=400)
             current_pw = password_change.get("current", "")
             new_pw = password_change.get("new", "")
             if not new_pw:
@@ -1213,7 +1215,7 @@ async def start(
             if "avatar" in body:
                 user_entry["avatar"] = str(body["avatar"])
             if "notification_channels" in body:
-                user_entry["notification_channels"] = list(body["notification_channels"])
+                user_entry["notification_channels"] = [str(ch) for ch in body["notification_channels"]]
             if password_change:
                 user_entry["password"] = users_mod.hash_password(password_change["new"])