diff --git a/Pods b/Pods
index e7975283f..89f829c06 160000
--- a/Pods
+++ b/Pods
@@ -1 +1 @@
-Subproject commit e7975283fc4cca612967198d5c749e1700d0c78b
+Subproject commit 89f829c06ce4605393867fa5660ccdbb3ce7cf53
diff --git a/Signal.xcodeproj/project.pbxproj b/Signal.xcodeproj/project.pbxproj
index 7c66a38e7..3c1c1dc5a 100644
--- a/Signal.xcodeproj/project.pbxproj
+++ b/Signal.xcodeproj/project.pbxproj
@@ -308,7 +308,7 @@
 		B62EFBEC1A91352F0072ADD3 /* TSInvalidIdentityKeyErrorMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = B62EFBE71A91352F0072ADD3 /* TSInvalidIdentityKeyErrorMessage.m */; };
 		B62EFBED1A91352F0072ADD3 /* TSInvalidIdentityKeyReceivingErrorMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = B62EFBE91A91352F0072ADD3 /* TSInvalidIdentityKeyReceivingErrorMessage.m */; };
 		B62EFBEE1A91352F0072ADD3 /* TSInvalidIdentityKeySendingErrorMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = B62EFBEB1A91352F0072ADD3 /* TSInvalidIdentityKeySendingErrorMessage.m */; };
-		B63006431B9631EC00F2FEB5 /* AFSecurityOWSPolicy.m in Sources */ = {isa = PBXBuildFile; fileRef = B63006421B9631EC00F2FEB5 /* AFSecurityOWSPolicy.m */; settings = {ASSET_TAGS = (); }; };
+		B63006431B9631EC00F2FEB5 /* AFSecurityOWSPolicy.m in Sources */ = {isa = PBXBuildFile; fileRef = B63006421B9631EC00F2FEB5 /* AFSecurityOWSPolicy.m */; };
 		B633C5861A1D190B0059AC12 /* call@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = B633C5041A1D190B0059AC12 /* call@2x.png */; };
 		B633C58D1A1D190B0059AC12 /* contact_default_feed.png in Resources */ = {isa = PBXBuildFile; fileRef = B633C50B1A1D190B0059AC12 /* contact_default_feed.png */; };
 		B633C59D1A1D190B0059AC12 /* endcall@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = B633C51B1A1D190B0059AC12 /* endcall@2x.png */; };
diff --git a/Signal/src/environment/Release.h b/Signal/src/environment/Release.h
index 1e0cdbcd2..2cf43c47a 100644
--- a/Signal/src/environment/Release.h
+++ b/Signal/src/environment/Release.h
@@ -8,6 +8,8 @@
 /// Connects to actual production infrastructure
 +(Environment*) releaseEnvironmentWithLogging:(id<Logging>)logging;
 
++(Environment*) stagingEnvironmentWithLogging:(id<Logging>)logging;
+
 /// Fake environment with no logging
 +(Environment*) unitTestEnvironment:(NSArray*)testingAndLegacyOptions;
 
diff --git a/Signal/src/environment/Release.m b/Signal/src/environment/Release.m
index eef765ba4..551f3797b 100644
--- a/Signal/src/environment/Release.m
+++ b/Signal/src/environment/Release.m
@@ -79,6 +79,41 @@ static unsigned char DH3K_PRIME[]={
                       andPhoneDirectoryManager:[PhoneNumberDirectoryFilterManager new]];
 }
 
++(Environment*) stagingEnvironmentWithLogging:(id<Logging>)logging {
+    ErrorHandlerBlock errorNoter = ^(id error, id relatedInfo, bool causedTermination) {DDLogError(@"%@: %@, %d", error, relatedInfo, causedTermination); };
+    
+    NSString *defaultRegion;
+#if TARGET_OS_IPHONE
+    defaultRegion = [[PhoneNumberUtil sharedInstance].nbPhoneNumberUtil countryCodeByCarrier];
+    
+    if ([defaultRegion isEqualToString:@"ZZ"]) {
+        defaultRegion = [[NSLocale currentLocale] objectForKey:NSLocaleCountryCode];
+    }
+#else
+    defaultRegion = [[NSLocale currentLocale] objectForKey:NSLocaleCountryCode];
+#endif
+    
+    
+    NSAssert([defaultRegion isKindOfClass:[NSString class]], @"");
+    
+    return [Environment environmentWithLogging:logging
+                                 andErrorNoter:errorNoter
+                                 andServerPort:31337
+                       andMasterServerHostName:@"redphone-staging.whispersystems.org"
+                           andDefaultRelayName:@"redphone-staging-relay"
+                  andRelayServerHostNameSuffix:@"whispersystems.org"
+                                andCertificate:[Certificate certificateFromResourcePath:@"redphone" ofType:@"cer"]
+           andCurrentRegionCodeForPhoneNumbers:defaultRegion
+             andSupportedKeyAgreementProtocols:[self supportedKeyAgreementProtocols]
+                               andPhoneManager:[PhoneManager phoneManagerWithErrorHandler:errorNoter]
+                          andRecentCallManager:[RecentCallManager new]
+                    andTestingAndLegacyOptions:@[ENVIRONMENT_LEGACY_OPTION_RTP_PADDING_BIT_IMPLIES_EXTENSION_BIT_AND_TWELVE_EXTRA_ZERO_BYTES_IN_HEADER]
+                               andZrtpClientId:RELEASE_ZRTP_CLIENT_ID
+                              andZrtpVersionId:RELEASE_ZRTP_VERSION_ID
+                            andContactsManager:[ContactsManager new]
+                      andPhoneDirectoryManager:[PhoneNumberDirectoryFilterManager new]];
+}
+
 +(Environment*) unitTestEnvironment:(NSArray*)testingAndLegacyOptions {
     NSArray* keyAgreementProtocols = self.supportedKeyAgreementProtocols;
     if ([testingAndLegacyOptions containsObject:TESTING_OPTION_USE_DH_FOR_HANDSHAKE]) {
diff --git a/Signal/src/view controllers/CodeVerificationViewController.m b/Signal/src/view controllers/CodeVerificationViewController.m
index f80fef01d..35756fc63 100644
--- a/Signal/src/view controllers/CodeVerificationViewController.m	
+++ b/Signal/src/view controllers/CodeVerificationViewController.m	
@@ -158,7 +158,7 @@
     NSString *failureReason = nil;
     TSRegistrationFailure failureType;
     
-    if (badResponse.statusCode == 401) {
+    if (badResponse.statusCode == 401 || badResponse.statusCode == 403) {
         failureReason = REGISTER_CHALLENGE_ALERT_VIEW_BODY;
         failureType = kTSRegistrationFailureAuthentication;
     } else if (badResponse.statusCode == 413) {