diff --git a/esdoc.json b/esdoc.json
index 1548ee992..bbb5a28ab 100644
--- a/esdoc.json
+++ b/esdoc.json
@@ -2,7 +2,7 @@
   "source": "./src",
   "destination": "./docs/build",
   "includes": ["\\.js$"],
-  "excludes": ["external"],
+  "excludes": ["external", "internal"],
   "package": "./package.json",
   "title": "Neo4j Bolt  Driver for Javascript",
   "unexportIdentifier": true,
diff --git a/examples/neo4j.html b/examples/neo4j.html
index e0b824402..fe4aa23e6 100644
--- a/examples/neo4j.html
+++ b/examples/neo4j.html
@@ -93,7 +93,7 @@
         padding: 0 2px;
     }
     </style>
-    <script src="../lib/browser/neo4j-web.min.js"></script>
+    <script src="../lib/browser/neo4j-web.js"></script>
   </head>
   <body>
 
@@ -131,7 +131,11 @@ <h1>Cypher Runner for New Remoting</h1>
     </div>
 
     <script>
-    var driver = neo4j.driver("bolt+ws://localhost");
+    var authToken = neo4j.v1.auth.basic("neo4j", "neo4j");
+    console.log(authToken);
+    var driver = neo4j.v1.driver("bolt://localhost", authToken, {
+        encrypted:true
+    });
     var session = driver.session();
 
     function run() {
@@ -143,13 +147,14 @@ <h1>Cypher Runner for New Remoting</h1>
             onNext: function(record) {
                 // On receipt of RECORD
                 var tr = document.createElement("tr");
-                for(var i in record) {
+                record.forEach( function( value ) {
                     var td = document.createElement("td");
-                    td.appendChild(document.createTextNode(record[i]));
+                    td.appendChild(document.createTextNode(value));
                     tr.appendChild(td);
-                }
+                });
                 table.appendChild(tr);
-            }, onCompleted: function(metadata) {
+            },
+            onCompleted: function(metadata) {
                 
             }
         });
diff --git a/gulpfile.js b/gulpfile.js
index 3ea17082f..570c9cc99 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -204,7 +204,7 @@ gulp.task('download-tck', function() {
 gulp.task('run-tck', ['download-tck', 'nodejs'], function() {
     return gulp.src(featureHome + "/*").pipe(cucumber({
         'steps': 'test/v1/tck/steps/*.js',
-        'format': 'pretty',
+        'format': 'summary',
         'tags' : ['~@in_dev', '~@db']
     }));
 });
diff --git a/package.json b/package.json
index 62f211f8a..a6113ce38 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
     "babelify": "^6.3.0",
     "browserify": "^11.0.0",
     "esdoc": "^0.4.0",
+    "esdoc-importpath-plugin": "0.0.1",
     "glob": "^5.0.14",
     "gulp": "^3.9.0",
     "gulp-babel": "^5.2.1",
diff --git a/src/v1/driver.js b/src/v1/driver.js
index c6da19b77..ee02261f3 100644
--- a/src/v1/driver.js
+++ b/src/v1/driver.js
@@ -21,24 +21,35 @@ import Session from './session';
 import {Pool} from './internal/pool';
 import {connect} from "./internal/connector";
 import StreamObserver from './internal/stream-observer';
+import {VERSION} from '../version';
 
 /**
-  * A Driver instance is used for mananging {@link Session}s.
-  * @access public
-  */
+ * A driver maintains one or more {@link Session sessions} with a remote
+ * Neo4j instance. Through the {@link Session sessions} you can send statements
+ * and retrieve results from the database.
+ *
+ * Drivers are reasonably expensive to create - you should strive to keep one
+ * driver instance around per Neo4j Instance you connect to.
+ *
+ * @access public
+ */
 class Driver {
   /**
+   * You should not be calling this directly, instead use {@link driver}.
    * @constructor
    * @param {string} url
    * @param {string} userAgent
    * @param {Object} token
+   * @param {Object} config
+   * @access private
    */
-  constructor(url, userAgent, token) {
+  constructor(url, userAgent = 'neo4j-javascript/0.0', token = {}, config = {}) {
     this._url = url;
-    this._userAgent = userAgent || 'neo4j-javascript/0.0';
+    this._userAgent = userAgent;
     this._openSessions = {};
     this._sessionIdGenerator = 0;
-    this._token = token || {};
+    this._token = token;
+    this._config = config;
     this._pool = new Pool(
       this._createConnection.bind(this),
       this._destroyConnection.bind(this),
@@ -54,7 +65,7 @@ class Driver {
   _createConnection( release ) {
     let sessionId = this._sessionIdGenerator++;
     let streamObserver = new _ConnectionStreamObserver(this);
-    let conn = connect(this._url);
+    let conn = connect(this._url, this._config);
     conn.initialize(this._userAgent, this._token, streamObserver);
     conn._id = sessionId;
     conn._release = () => release(conn);
@@ -83,7 +94,16 @@ class Driver {
   }
 
   /**
-   * Create and return new session
+   * Acquire a session to communicate with the database. The driver maintains
+   * a pool of sessions, so calling this method is normally cheap because you
+   * will be pulling a session out of the common pool.
+   *
+   * This comes with some responsibility - make sure you always call
+   * {@link Session#close()} when you are done using a session, and likewise,
+   * make sure you don't close your session before you are done using it. Once
+   * it is returned to the pool, the session will be reset to a clean state and
+   * made available for others to use.
+   *
    * @return {Session} new session.
    */
   session() {
@@ -111,8 +131,9 @@ class Driver {
   }
 
   /**
-   * Close sessions connections
-   * @return
+   * Close all open sessions and other associated resources. You should
+   * make sure to use this when you are done with this driver instance.
+   * @return undefined
    */
   close() {
     for (let sessionId in this._openSessions) {
@@ -141,4 +162,63 @@ class _ConnectionStreamObserver extends StreamObserver {
   }
 }
 
-export default Driver
+let USER_AGENT = "neo4j-javascript/" + VERSION;
+
+/**
+ * Construct a new Neo4j Driver. This is your main entry point for this
+ * library.
+ *
+ * ## Configuration
+ *
+ * This function optionally takes a configuration argument. Available configuration
+ * options are as follows:
+ *
+ *     {
+ *       // Enable TLS encryption. This is on by default in modern NodeJS installs,
+ *       // but off by default in the Web Bundle and old (<=1.0.0) NodeJS installs
+ *       // due to technical limitations on those platforms.
+ *       encrypted: true|false,
+ *
+ *       // Trust strategy to use if encryption is enabled. There is no mode to disable
+ *       // trust other than disabling encryption altogether. The reason for
+ *       // this is that if you don't know who you are talking to, it is easy for an
+ *       // attacker to hijack your encrypted connection, rendering encryption pointless.
+ *       //
+ *       // TRUST_ON_FIRST_USE is the default for modern NodeJS deployments, and works
+ *       // similarly to how `ssl` works - the first time we connect to a new host,
+ *       // we remember the certificate they use. If the certificate ever changes, we
+ *       // assume it is an attempt to hijack the connection and require manual intervention.
+ *       // This means that by default, connections "just work" while still giving you
+ *       // good encrypted protection.
+ *       //
+ *       // TRUST_SIGNED_CERTIFICATES is the classic approach to trust verification -
+ *       // whenever we establish an encrypted connection, we ensure the host is using
+ *       // an encryption certificate that is in, or is signed by, a certificate listed
+ *       // as trusted. In the web bundle, this list of trusted certificates is maintained
+ *       // by the web browser. In NodeJS, you configure the list with the next config option.
+ *       trust: "TRUST_ON_FIRST_USE" | "TRUST_SIGNED_CERTIFICATES",
+ *
+ *       // List of one or more paths to trusted encryption certificates. This only
+ *       // works in the NodeJS bundle, and only matters if you use "TRUST_SIGNED_CERTIFICATES".
+ *       // The certificate files should be in regular X.509 PEM format.
+ *       // For instance, ['./trusted.pem']
+ *       trustedCertificates: [],
+ *
+ *       // Path to a file where the driver saves hosts it has seen in the past, this is
+ *       // very similar to the ssl tool's known_hosts file. Each time we connect to a
+ *       // new host, a hash of their certificate is stored along with the domain name and
+ *       // port, and this is then used to verify the host certificate does not change.
+ *       // This setting has no effect unless TRUST_ON_FIRST_USE is enabled.
+ *       knownHosts:"~/.neo4j/known_hosts",
+ *     }
+ *
+ * @param {string} url The URL for the Neo4j database, for instance "bolt://localhost"
+ * @param {Map<String,String>} authToken Authentication credentials. See {@link auth} for helpers.
+ * @param {Object} config Configuration object. See the configuration section above for details.
+ * @returns {Driver}
+ */
+function driver(url, authToken, config={}) {
+  return new Driver(url, USER_AGENT, authToken, config);
+}
+
+export {Driver, driver}
diff --git a/src/v1/graph-types.js b/src/v1/graph-types.js
index 3b36b9101..3c7523a23 100644
--- a/src/v1/graph-types.js
+++ b/src/v1/graph-types.js
@@ -73,7 +73,7 @@ class Relationship {
   }
 
   toString() {
-    let s = "(" + this.start.split('/')[1] + ")-[:" + this.type;
+    let s = "(" + this.start + ")-[:" + this.type;
     let keys = Object.keys(this.properties);
     if (keys.length > 0) {
       s += " {";
@@ -83,7 +83,7 @@ class Relationship {
       }
       s += "}";
     }
-    s += "]->(" + this.end.split('/')[1] + ")";
+    s += "]->(" + this.end + ")";
     return s;
   }
 }
diff --git a/src/v1/index.js b/src/v1/index.js
index 9940d1adc..bc2f31d13 100644
--- a/src/v1/index.js
+++ b/src/v1/index.js
@@ -18,14 +18,11 @@
  */
 
 import {int, isInt} from './integer';
-import Driver from './driver';
-import {VERSION} from '../version';
+import {driver} from './driver';
 import {Node, Relationship, UnboundRelationship, PathSegment, Path} from './graph-types'
 
-let USER_AGENT = "neo4j-javascript/" + VERSION;
-
 export default {
-  driver: (url, token) => new Driver(url, USER_AGENT, token),
+  driver,
   int,
   isInt,
   auth: {
diff --git a/src/v1/internal/buf.js b/src/v1/internal/buf.js
index efaba7204..1961027ac 100644
--- a/src/v1/internal/buf.js
+++ b/src/v1/internal/buf.js
@@ -399,7 +399,7 @@ class HeapBuffer extends BaseBuffer {
       let copy = new HeapBuffer(length);
       for (var i = 0; i < length; i++) {
         copy.putUInt8( i, this.getUInt8( i + start ) );
-      };
+      }
       return copy;
     }
   }
@@ -414,7 +414,7 @@ class HeapBuffer extends BaseBuffer {
 }
 
 /**
- * Represents a view of slice of another buffer.
+ * Represents a view as slice of another buffer.
  * @access private
  */
 class SliceBuffer extends BaseBuffer {
@@ -486,7 +486,7 @@ class CombinedBuffer extends BaseBuffer {
       } else {
         return buffer.getInt8(position);
       }
-    };
+    }
   }
 
   getFloat64 ( position ) {
@@ -561,12 +561,12 @@ try {
 } catch(e) {}
 
 /**
-* Allocate a new buffer using whatever mechanism is most sensible for the
-* current platform
-* @access private
-* @param {Integer} size
-* @return new buffer
-*/
+ * Allocate a new buffer using whatever mechanism is most sensible for the
+ * current platform
+ * @access private
+ * @param {Integer} size
+ * @return new buffer
+ */
 function alloc (size) {
   return new _DefaultBuffer(size);
 }
diff --git a/src/v1/internal/ch-node.js b/src/v1/internal/ch-node.js
index ad822d63e..9d0d61792 100644
--- a/src/v1/internal/ch-node.js
+++ b/src/v1/internal/ch-node.js
@@ -18,16 +18,152 @@
  */
  
 import net from 'net';
+import tls from 'tls';
+import fs from 'fs';
+import path from 'path';
+import {EOL} from 'os';
 import {NodeBuffer} from './buf';
+import {newError} from './error';
 
 let _CONNECTION_IDGEN = 0;
 
-/**
-  * In a Node.js environment the 'net' module is used
-  * as transport.
-  * @access private
-  */
+function userHome() {
+  // For some reason, Browserify chokes on shimming `process`. This code
+  // will never get executed on the browser anyway, to just hack around it
+  let getOutOfHereBrowserifyYoureDrunk = require;
+  let process = getOutOfHereBrowserifyYoureDrunk('process');
+
+  return process.env[(process.platform == 'win32') ? 'USERPROFILE' : 'HOME'];
+}
+
+function loadFingerprint( serverId, knownHostsPath, cb ) {
+  if( !fs.existsSync( knownHostsPath )) {
+    cb(null);
+    return;
+  }
+  let found = false;
+  require('readline').createInterface({
+    input: fs.createReadStream(knownHostsPath)
+  }).on('line', (line)  => {
+    if( line.startsWith( serverId )) {
+      found = true;
+      cb( line.split(" ")[1] );
+    }
+  }).on('close', () => {
+    if(!found) {
+      cb(null);
+    }
+  });
+}
+
+function storeFingerprint( serverId, knownHostsPath, fingerprint ) {
+  fs.appendFile(knownHostsPath, serverId + " " + fingerprint + EOL, "utf8" );
+}
+
+const TrustStrategy = {
+  TRUST_SIGNED_CERTIFICATES : function( opts, onSuccess, onFailure ) {
+    if( !opts.trustedCertificates || opts.trustedCertificates.length == 0 ) {
+      onFailure(newError("You are using TRUST_SIGNED_CERTIFICATES as the method " +
+        "to verify trust for encrypted  connections, but have not configured any " +
+        "trustedCertificates. You  must specify the path to at least one trusted " +
+        "X.509 certificate for this to work. Two other alternatives is to use " +
+        "TRUST_ON_FIRST_USE or to disable encryption by setting encrypted=false " +
+        "in your driver configuration."));
+      return;
+    }
+
+    let tlsOpts = {
+      ca: opts.trustedCertificates.map(fs.readFileSync),
+      // Because we manually check for this in the connect callback, to give
+      // a more helpful error to the user
+      rejectUnauthorized: false
+    };
+
+    let socket = tls.connect(opts.port, opts.host, tlsOpts, function () {
+      if (!socket.authorized) {
+        onFailure(newError("Server certificate is not trusted. If you trust the database you are connecting to, add" +
+          " the signing certificate, or the server certificate, to the list of certificates trusted by this driver" +
+          " using `neo4j.v1.driver(.., { trustedCertificates:['path/to/certificate.crt']}). This " +
+          " is a security measure to protect against man-in-the-middle attacks. If you are just trying " +
+          " Neo4j out and are not concerned about encryption, simply disable it using `encrypted=false` in the driver" +
+          " options."));
+      } else {
+        onSuccess();
+      }
+    });
+    return socket;
+  },
+  TRUST_ON_FIRST_USE : function( opts, onSuccess, onFailure ) {
+    let tlsOpts = {
+      // Because we manually verify the certificate against known_hosts
+      rejectUnauthorized: false
+    };
+
+    let socket = tls.connect(opts.port, opts.host, tlsOpts, function () {
+      var serverCert = socket.getPeerCertificate(raw=true);
+
+      if( !serverCert.raw ) {
+        // If `raw` is not available, we're on an old version of NodeJS, and
+        // the raw cert cannot be accessed (or, at least I couldn't find a way to)
+        // therefore, we can't generate a SHA512 fingerprint, meaning we can't
+        // do TOFU, and the safe approach is to fail.
+        onFailure(newError("You are using a version of NodeJS that does not " +
+          "support trust-on-first use encryption. You can either upgrade NodeJS to " +
+          "a newer version, use `trust:TRUST_SIGNED_CERTIFICATES` in your driver " +
+          "config instead, or disable encryption using `encrypted:false`."));
+        return;
+      }
+
+      var serverFingerprint = require('crypto').createHash('sha512').update(serverCert.raw).digest("hex");
+      let knownHostsPath = opts.knownHosts || path.join(userHome(), ".neo4j", "known_hosts");
+      let serverId = opts.host + ":" + opts.port;
+
+      loadFingerprint(serverId, knownHostsPath, (knownFingerprint) => {
+        if( knownFingerprint === serverFingerprint ) {
+          onSuccess();
+        } else if( knownFingerprint == null ) {
+          storeFingerprint( serverId, knownHostsPath, serverFingerprint );
+          onSuccess();
+        } else {
+          onFailure(newError("Database encryption certificate has changed, and no longer " +
+            "matches the certificate stored for " + serverId + " in `" + knownHostsPath +
+            "`. As a security precaution, this driver will not automatically trust the new " +
+            "certificate, because doing so would allow an attacker to pretend to be the Neo4j " +
+            "instance we want to connect to. The certificate provided by the server looks like: " +
+            serverCert + ". If you trust that this certificate is valid, simply remove the line " +
+            "starting with " + serverId + " in `" + knownHostsPath + "`, and the driver will " +
+            "update the file with the new certificate. You can configure which file the driver " +
+            "should use to store this information by setting `knownHosts` to another path in " +
+            "your driver configuration - and you can disable encryption there as well using " +
+            "`encrypted:false`."))
+        }
+      });
+    });
+    return socket;
+  }
+};
+
+function connect( opts, onSuccess, onFailure=(()=>null) ) {
+  if( opts.encrypted === false ) {
+    return net.connect(opts.port, opts.host, onSuccess);
+  } else if( TrustStrategy[opts.trust]) {
+    return TrustStrategy[opts.trust](opts, onSuccess, onFailure);
+  } else {
+    onFailure(newError("Unknown trust strategy: " + opts.trust + ". Please use either " +
+      "trust:'TRUST_SIGNED_CERTIFICATES' or trust:'TRUST_ON_FIRST_USE' in your driver " +
+      "configuration. Alternatively, you can disable encryption by setting " +
+      "`encrypted:false`. There is no mechanism to use encryption without trust verification, " +
+      "because this incurs the overhead of encryption without improving security. If " +
+      "the driver does not verify that the peer it is connected to is really Neo4j, it " +
+      "is very easy for an attacker to bypass the encryption by pretending to be Neo4j."));
+  }
+}
 
+/**
+ * In a Node.js environment the 'net' module is used
+ * as transport.
+ * @access private
+ */
 class NodeChannel {
 
   /**
@@ -37,35 +173,42 @@ class NodeChannel {
    * @param {Integer} opts.port - The port to use.
    */
   constructor (opts) {
-    let _self = this;
+    let self = this;
 
     this.id = _CONNECTION_IDGEN++;
     this.available = true;
     this._pending = [];
     this._open = true;
-    this._conn = net.connect((opts.port || 7687), opts.host, () => {
-      if(!_self._open) {
+    this._error = null;
+    this._handleConnectionError = this._handleConnectionError.bind(this);
+
+    this._conn = connect(opts, () => {
+      if(!self._open) {
         return;
       }
+
+      self._conn.on('data', ( buffer ) => {
+        if( self.onmessage ) {
+          self.onmessage( new NodeBuffer( buffer ) );
+        }
+      });
+
+      self._conn.on('error', self._handleConnectionError);
+
       // Drain all pending messages
-      let pending = _self._pending;
-      _self._pending = null;
+      let pending = self._pending;
+      self._pending = null;
       for (let i = 0; i < pending.length; i++) {
-        _self.write( pending[i] );
+        self.write( pending[i] );
       }
-    });
-
-    this._conn.on('data', ( buffer ) => {
-      if( _self.onmessage ) {
-        _self.onmessage( new NodeBuffer( buffer ) );
-      }
-    });
+    }, this._handleConnectionError);
+  }
 
-    this._conn.on('error', function(err){
-      if( _self.onerror ) {
-        _self.onerror(err);
-      }
-    });
+  _handleConnectionError( err ) {
+    this._error = err;
+    if( this.onerror ) {
+      this.onerror(err);
+    }
   }
   
   /**
@@ -89,12 +232,14 @@ class NodeChannel {
    * Close the connection
    * @param {function} cb - Function to call on close.
    */
-  close(cb) {
-    if(cb) {
+  close(cb = (() => null)) {
+    this._open = false;
+    if( this._conn ) {
+      this._conn.end();
       this._conn.on('end', cb);
+    } else {
+      cb();
     }
-    this._open = false;
-    this._conn.end();
   }
 }
 let _nodeChannelModule = {channel: NodeChannel, available: true};
diff --git a/src/v1/internal/ch-websocket.js b/src/v1/internal/ch-websocket.js
index ea437c658..f2f6ab1ab 100644
--- a/src/v1/internal/ch-websocket.js
+++ b/src/v1/internal/ch-websocket.js
@@ -19,6 +19,7 @@
  
 import {debug} from "./log";
 import {HeapBuffer} from "./buf";
+import {newError} from './error';
 
 /**
  * Create a new WebSocketChannel to be used in web browsers.
@@ -33,11 +34,27 @@ class WebSocketChannel {
    * @param {Integer} opts.port - The port to use.
    */
   constructor (opts) {
-    this._url = "ws:" + opts.host + ":" + (opts.port || 7687);
-    this._ws = new WebSocket(this._url);
-    this._ws.binaryType = "arraybuffer";
+
     this._open = true;
     this._pending = [];
+    this._error = null;
+    this._handleConnectionError = this._handleConnectionError.bind(this);
+
+    let scheme = "ws";
+    if( opts.encrypted ) {
+      if( (!opts.trust) || opts.trust === "TRUST_SIGNED_CERTIFICATES" ) {
+        scheme = "wss";
+      } else {
+        this._error = newError("The browser version of this driver only supports one trust " +
+          "strategy, 'TRUST_SIGNED_CERTIFICATES'. "+opts.trust+" is not supported. Please " +
+          "either use TRUST_SIGNED_CERTIFICATES or disable encryption by setting " +
+          "`encrypted:false` in the driver configuration.");
+        return;
+      }
+    }
+    this._url = scheme + ":" + opts.host + ":" + opts.port;
+    this._ws = new WebSocket(this._url);
+    this._ws.binaryType = "arraybuffer";
 
     let self = this;
     this._ws.onopen = function() {
@@ -55,9 +72,22 @@ class WebSocketChannel {
       } 
     };
 
-    this._ws.onerror = (err) => {
-      if( self.onerror ) {
-        self.onerror(err);
+    this._ws.onerror = this._handleConnectionError;
+  }
+
+  _handleConnectionError() {
+    // onerror triggers on websocket close as well.. don't get me started.
+    if( this._open ) {
+      // http://stackoverflow.com/questions/25779831/how-to-catch-websocket-connection-to-ws-xxxnn-failed-connection-closed-be
+      this._error = newError( "WebSocket connection failure. Due to security " +
+        "constraints in your web browser, the reason for the failure is not available " +
+        "to this Neo4j Driver. Please use your browsers development console to determine " +
+        "the root cause of the failure. Common reasons include the database being " +
+        "unavailable, using the wrong connection URL or temporary network problems. " +
+        "If you have enabled encryption, ensure your browser is configured to trust the " +
+        "certificate Neo4j is configured to use. WebSocket `readyState` is: " + this._ws.readyState );
+      if (this.onerror) {
+        this.onerror(this._error);
       }
     }
   }
@@ -82,12 +112,10 @@ class WebSocketChannel {
    * Close the connection
    * @param {function} cb - Function to call on close.
    */
-  close ( cb ) {
-    if(cb) {
-      this._ws.onclose(cb);
-    }
+  close ( cb = ( () => null )) {
     this._open = false;
     this._ws.close();
+    this._ws.onclose = cb;
   }
 }
 
diff --git a/src/v1/internal/connector.js b/src/v1/internal/connector.js
index 4397869df..9fed9d3f7 100644
--- a/src/v1/internal/connector.js
+++ b/src/v1/internal/connector.js
@@ -20,10 +20,12 @@
 import WebSocketChannel from "./ch-websocket";
 import NodeChannel from "./ch-node";
 import chunking from "./chunking";
+import hasFeature from "./features";
 import packstream from "./packstream";
 import {alloc, CombinedBuffer} from "./buf";
 import GraphType from '../graph-types';
 import {int, isInt} from '../integer';
+import {newError} from './error';
 
 let Channel;
 if( WebSocketChannel.available ) {
@@ -72,17 +74,13 @@ function port( url ) {
   return url.match( URLREGEX )[3];
 }
 
-function NO_OP(){};
-
-function LOG(err) {
-  console.log(err);
-};
+function NO_OP(){}
 
 let NO_OP_OBSERVER = {
   onNext : NO_OP,
   onCompleted : NO_OP,
   onError : NO_OP
-}
+};
 
 /** Maps from packstream structures to Neo4j domain objects */
 let _mappers = {
@@ -188,6 +186,9 @@ class Connection {
     this._unpacker.structMappers[PATH] = _mappers.path;
 
     let self = this;
+    // TODO: Using `onmessage` and `onerror` came from the WebSocket API,
+    // it reads poorly and has several annoying drawbacks. Swap to having
+    // Channel extend EventEmitter instead, then we can use `on('data',..)`
     this._ch.onmessage = (buf) => {
       let proposed = buf.readInt32();
       if( proposed == 1 ) {
@@ -202,16 +203,20 @@ class Connection {
         }
 
       } else {
-        this._isBroken = true;
-        console.log("FATAL, unknown protocol version:", proposed)
+        self._handleFatalError(newError("Unknown Bolt protocol version: " + proposed));
       }
     };
 
-    this._ch.onerror = (error) => {
-      self._isBroken = true;
-      if(this._currentObserver.onError) {
-        this._currentObserver.onError(error);
-      }
+    // Listen to connection errors. Important note though;
+    // In some cases we will get a channel that is already broken (for instance,
+    // if the user passes invalid configuration options). In this case, onerror
+    // will have "already triggered" before we add out listener here. So the line
+    // below also checks that the channel is not already failed. This could be nicely
+    // encapsulated into Channel if we used `on('error', ..)` rather than `onerror=..`
+    // as outlined in the comment about `onmessage` further up in this file.
+    this._ch.onerror = this._handleFatalError.bind(this);
+    if( this._ch._error ) {
+      this._handleFatalError(this._ch._error);
     }
 
     this._dechunker.onmessage = (buf) => {
@@ -230,6 +235,28 @@ class Connection {
     this._ch.write( handshake );
   }
 
+  /**
+   * "Fatal" means the connection is dead. Only call this if something
+   * happens that cannot be recovered from. This will lead to all subscribers
+   * failing, and the connection getting ejected from the session pool.
+   *
+   * @param err an error object, forwarded to all current and future subscribers
+   * @private
+   */
+  _handleFatalError( err ) {
+    this._isBroken = true;
+    this._error = err;
+    if( this._currentObserver && this._currentObserver.onError ) {
+      this._currentObserver.onError(err);
+    }
+    while( this._pendingObservers.length > 0 ) {
+      let observer = this._pendingObservers.shift();
+      if( observer && observer.onError ) {
+        observer.onError(err);
+      }
+    }
+  }
+
   _handleMessage( msg ) {
     switch( msg.signature ) {
       case RECORD:
@@ -280,8 +307,7 @@ class Connection {
         }
         break;
       default:
-        this._isBroken = true;
-        console.log("UNKNOWN MESSAGE: ", msg);
+        this._handleFatalError(newError("Unknown Bolt protocol message: " + msg));
     }
   }
 
@@ -328,7 +354,16 @@ class Connection {
   }
 
   _queueObserver(observer) {
+    if( this._isBroken ) {
+      if( observer && observer.onError ) {
+        observer.onError(this._error);
+      }
+      return;
+    }
     observer = observer || NO_OP_OBSERVER;
+    observer.onCompleted = observer.onCompleted || NO_OP;
+    observer.onError = observer.onError || NO_OP;
+    observer.onNext = observer.onNext || NO_OP;
     if( this._currentObserver === undefined ) {
       this._currentObserver = observer;
     } else {
@@ -362,14 +397,20 @@ class Connection {
  * Crete new connection to the provided url.
  * @access private
  * @param {string} url - 'neo4j'-prefixed URL to Neo4j Bolt endpoint
- * @param {Channel} channel - Optionally inject Channel to be used.
+ * @param {object} config
  * @return {Connection} - New connection
  */
-function connect( url, channel = null) {
-  channel = channel || Channel;
-  return new Connection( new channel({
+function connect( url, config = {}) {
+  let Ch = config.channel || Channel;
+  return new Connection( new Ch({
     host: host(url),
-    port: port(url)
+    port: port(url) || 7687,
+    // Default to using encryption if trust-on-first-use is available
+    encrypted : config.encrypted || hasFeature("trust_on_first_use"),
+    // Default to using trust-on-first-use if it is available
+    trust : config.trust || (hasFeature("trust_on_first_use") ? "TRUST_ON_FIRST_USE" : "TRUST_SIGNED_CERTIFICATES"),
+    trustedCertificates : config.trustedCertificates || [],
+    knownHosts : config.knownHosts
   }));
 }
 
diff --git a/src/v1/internal/error.js b/src/v1/internal/error.js
new file mode 100644
index 000000000..6a7d4f14b
--- /dev/null
+++ b/src/v1/internal/error.js
@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// A common place for constructing error objects, to keep them
+// uniform across the driver surface.
+
+function newError(message, code="N/A") {
+  // TODO: Idea is that we can check the cod here and throw sub-classes
+  // of Neo4jError as appropriate
+  return new Neo4jError(message, code);
+}
+
+// TODO: This should be moved into public API
+class Neo4jError extends Error {
+  constructor( message, code="N/A" ) {
+    super( message );
+    this.message = message;
+    this.code = code;
+  }
+}
+
+export {
+  newError,
+  Neo4jError
+}
diff --git a/src/v1/internal/features.js b/src/v1/internal/features.js
new file mode 100644
index 000000000..f442ab80c
--- /dev/null
+++ b/src/v1/internal/features.js
@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Central place to detect feature support for the current platform,
+// expand as needed.
+
+const FEATURES = {
+  trust_on_first_use : () => {
+    try {
+      // This is insane. We are verifying that we have a version of getPeerCertificate
+      // that supports reading the whole certificate, eg this commit:
+      // https://github.com/nodejs/node/commit/345c40b6
+      let desc = require('tls').TLSSocket.prototype.getPeerCertificate.toString();
+      return desc.startsWith("function getPeerCertificate(detailed)");
+    } catch( e ) {
+      return false;
+    }
+  }
+};
+
+function hasFeature( name ) {
+  return FEATURES[name] && FEATURES[name]();
+}
+
+export default hasFeature;
diff --git a/src/v1/internal/stream-observer.js b/src/v1/internal/stream-observer.js
index aabf7fa41..c087d0696 100644
--- a/src/v1/internal/stream-observer.js
+++ b/src/v1/internal/stream-observer.js
@@ -17,6 +17,8 @@
  * limitations under the License.
  */
 
+import {Record} from "../record";
+
 /**
  * Handles a RUN/PULL_ALL, or RUN/DISCARD_ALL requests, maps the responses
  * in a way that a user-provided observer can see these as a clean Stream
@@ -32,7 +34,8 @@ class StreamObserver {
    * @constructor
    */
   constructor() {
-    this._head = null;
+    this._fieldKeys = null;
+    this._fieldLookup = null;
     this._queuedRecords = [];
     this._tail = null;
     this._error = null;
@@ -45,10 +48,7 @@ class StreamObserver {
    * @param {Array} rawRecord - An array with the raw record
    */
   onNext(rawRecord) {
-    let record = {};
-    for (var i = 0; i < this._head.length; i++) {
-      record[this._head[i]] = rawRecord[i];
-    }
+    let record = new Record(this._fieldKeys, rawRecord, this._fieldLookup);
     if( this._observer ) {
       this._observer.onNext( record );
     } else {
@@ -56,13 +56,20 @@ class StreamObserver {
     }
   }
 
-  /**
-   * TODO
-   */
   onCompleted(meta) {
-    if( this._head === null ) {
-      // Stream header
-      this._head = meta.fields;
+    if( this._fieldKeys === null ) {
+      // Stream header, build a name->index field lookup table
+      // to be used by records. This is an optimization to make it
+      // faster to look up fields in a record by name, rather than by index.
+      // Since the records we get back via Bolt are just arrays of values.
+      this._fieldKeys = [];
+      this._fieldLookup = {};
+      if( meta.fields && meta.fields.length > 0 ) {
+        this._fieldKeys = meta.fields;
+        for (var i = 0; i < meta.fields.length; i++) {
+          this._fieldLookup[meta.fields[i]] = i;
+        }
+      }
     } else {
       // End of stream
       if( this._observer ) {
diff --git a/src/v1/record.js b/src/v1/record.js
new file mode 100644
index 000000000..7a7bbc40b
--- /dev/null
+++ b/src/v1/record.js
@@ -0,0 +1,105 @@
+/**
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {newError} from "./internal/error";
+
+function generateFieldLookup( keys ) {
+  let lookup = {};
+  keys.forEach( (name, idx) => { lookup[name] = idx; });
+  return lookup;
+}
+
+/**
+ * Records make up the contents of the {@link Result}, and is how you access
+ * the output of a statement. A simple statement might yield a result stream
+ * with a single record, for instance:
+ *
+ *     MATCH (u:User) RETURN u.name, u.age
+ *
+ * This returns a stream of records with two fields, named `u.name` and `u.age`,
+ * each record represents one user found by the statement above. You can access
+ * the values of each field either by name:
+ *
+ *     record.get("n.name")
+ *
+ * Or by it's position:
+ *
+ *     record.get(0)
+ *
+ * @access public
+ */
+class Record {
+  /**
+   * Create a new record object.
+   * @constructor
+   * @access private
+   * @param {Object} keys An array of field keys, in the order the fields appear
+   *                      in the record
+   * @param {Object} fields An array of field values
+   * @param {Object} fieldLookup An object of fieldName -> value index, used to map
+   *                            field names to values. If this is null, one will be
+   *                            generated.
+   */
+  constructor(keys, fields, fieldLookup=null ) {
+    this.keys = keys;
+    this.length = keys.length;
+    this._fields = fields;
+    this._fieldLookup = fieldLookup || generateFieldLookup( keys );
+  }
+
+  /**
+   * Run the given function for each field in this record. The function
+   * will get three arguments - the value, the key and this record, in that
+   * order.
+   *
+   * @param visitor
+   */
+  forEach( visitor ) {
+    for(let i=0;i<this.keys.length;i++) {
+      visitor( this._fields[i], this.keys[i], this );
+    }
+  }
+
+  /**
+   * Get a value from this record, either by index or by field key.
+   *
+   * @param {string|Number} key Field key, or the index of the field.
+   * @returns {*}
+   */
+  get( key ) {
+    let index;
+    if( !(typeof key === "number") ) {
+      index = this._fieldLookup[key];
+      if( index === undefined ) {
+        throw newError("This record has no field with key '"+key+"', available key are: [" + this.keys + "].");
+      }
+    } else {
+      index = key;
+    }
+
+    if( index > this._fields.length - 1 || index < 0 ) {
+      throw newError("This record has no field with index '"+index+"'. Remember that indexes start at `0`, " +
+        "and make sure your statement returns records in the shape you meant it to.");
+    }
+
+    return this._fields[index];
+  }
+}
+
+export {Record}
diff --git a/src/v1/result.js b/src/v1/result.js
index 309c862f9..46da0ede3 100644
--- a/src/v1/result.js
+++ b/src/v1/result.js
@@ -24,13 +24,14 @@ import {polyfill as polyfillPromise} from '../external/es6-promise';
 polyfillPromise();
 
 /**
-  * A Result instance is used for retrieving request response.
+  * A stream of {@link Record} representing the result of a statement.
   * @access public
   */
 class Result {
   /**
    * Inject the observer to be used.
    * @constructor
+   * @access private
    * @param {StreamObserver} streamObserver
    * @param {mixed} statement - Cypher statement to execute
    * @param {Object} parameters - Map with parameters to use in statement
@@ -45,6 +46,7 @@ class Result {
   /**
    * Create and return new Promise
    * @return {Promise} new Promise.
+   * @access private
    */
   _createPromise() {
     if(this._p) {
@@ -65,37 +67,37 @@ class Result {
   }
 
   /**
-   * Waits for all results and calls the passed in function
-   * with the results.
-   * Cannot be used with the subscribe function.
-   * @param {function(error: Object)} onFulfilled - Function to be called when finished.
-   * @param {function(error: Object)} onRejected - Function to be called upon errors.
+   * Waits for all results and calls the passed in function with the results.
+   * Cannot be combined with the {@link #subscribe} function.
+   *
+   * @param {function(result: {records:Array<Record>})} onFulfilled - Function to be called when finished.
+   * @param {function(error: {message:string, code:string})} onRejected - Function to be called upon errors.
    * @return {Promise} promise.
    */
   then(onFulfilled, onRejected) {
     this._createPromise();
-    this._p.then(onFulfilled, onRejected);
-    return this._p;
+    return this._p.then(onFulfilled, onRejected);
   }
 
   /**
    * Catch errors when using promises.
    * Cannot be used with the subscribe function.
-   * @param {function(error: Object)} onRejected - Function to be called upon errors.
+   * @param {function(error: {message:string, code:string})} onRejected - Function to be called upon errors.
    * @return {Promise} promise.
    */
   catch(onRejected) {
     this._createPromise();
-    this._p.catch(onRejected);
-    return this._p;
+    return this._p.catch(onRejected);
   }
 
   /**
-   * Stream results to observer as they come in.
+   * Stream records to observer as they come in, this is a more efficient method
+   * of handling the results, and allows you to handle arbitrarily large results.
+   *
    * @param {Object} observer - Observer object
-   * @param {function(record: Object)} observer.onNext - Handle records, one by one.
-   * @param {function(metadata: Object)} observer.onComplete - Handle stream tail, the metadata.
-   * @param {function(error: Object)} observer.onError - Handle errors.
+   * @param {function(record: Record)} observer.onNext - Handle records, one by one.
+   * @param {function(metadata: Object)} observer.onCompleted - Handle stream tail, the metadata.
+   * @param {function(error: {message:string, code:string})} observer.onError - Handle errors.
    * @return
    */
   subscribe(observer) {
@@ -105,6 +107,9 @@ class Result {
       onCompletedOriginal.call(observer, sum);
     };
     observer.onCompleted = onCompletedWrapper;
+    observer.onError = observer.onError || ((err) => {
+      console.log("Uncaught error when processing result: " + err);
+    });
     this._streamObserver.subscribe(observer);
   }
 }
diff --git a/src/v1/session.js b/src/v1/session.js
index dfd1456d9..09101a406 100644
--- a/src/v1/session.js
+++ b/src/v1/session.js
@@ -82,7 +82,7 @@ class Session {
   }
 
   /**
-   * Close this session
+   * Close this session.
    * @param {function()} cb - Function to be called after the session has been closed
    * @return
    */
diff --git a/test/internal/connector.test.js b/test/internal/connector.test.js
index 989df48e2..f10be873c 100644
--- a/test/internal/connector.test.js
+++ b/test/internal/connector.test.js
@@ -63,7 +63,7 @@ describe('connector', function() {
   it('should use DummyChannel to read what gets written', function(done) {
     // Given
     var observer = DummyChannel.observer;
-    var conn = connect("bolt://localhost", DummyChannel.channel)
+    var conn = connect("bolt://localhost", {channel:DummyChannel.channel});
 
     // When
     var records = [];
diff --git a/test/internal/tls.test.js b/test/internal/tls.test.js
new file mode 100644
index 000000000..b78a94565
--- /dev/null
+++ b/test/internal/tls.test.js
@@ -0,0 +1,135 @@
+/**
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var NodeChannel = require('../../lib/v1/internal/ch-node.js');
+var neo4j = require("../../lib/v1");
+var fs = require("fs");
+
+describe('trust-signed-certificates', function() {
+
+  var driver;
+
+  it('should reject unknown certificates', function(done) {
+    // Assuming we only run this test on NodeJS
+    if( !NodeChannel.available ) {
+      done();
+      return;
+    }
+
+    // Given
+    driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      encrypted: true,
+      trust: "TRUST_SIGNED_CERTIFICATES",
+      trustedCertificates: ["test/resources/random.certificate"]
+    });
+
+    // When
+    driver.session().run( "RETURN 1").catch( function(err) {
+        expect( err.message ).toContain( "Server certificate is not trusted" );
+        done();
+    });
+  });
+
+  it('should accept known certificates', function(done) {
+    // Assuming we only run this test on NodeJS
+    if( !NodeChannel.available ) {
+      done();
+      return;
+    }
+
+    // Given
+    driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      encrypted: true,
+      trust: "TRUST_SIGNED_CERTIFICATES",
+      trustedCertificates: ["build/neo4j-enterprise-3.0.0/conf/ssl/snakeoil.cert"]
+    });
+
+    // When
+    driver.session().run( "RETURN 1").then( done );
+  });
+
+  afterEach(function(){
+    if( driver ) {
+      driver.close();
+    }
+  });
+});
+
+
+describe('trust-on-first-use', function() {
+
+  var driver;
+
+  it('should accept previously un-seen hosts', function(done) {
+    // Assuming we only run this test on NodeJS
+    if( !NodeChannel.available ) {
+      done();
+      return;
+    }
+
+    // Given
+    var knownHostsPath = "build/known_hosts";
+    if( fs.existsSync(knownHostsPath) ) {
+      fs.unlinkSync(knownHostsPath);
+    }
+
+    driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      encrypted: true,
+      trust: "TRUST_ON_FIRST_USE",
+      knownHosts: knownHostsPath
+    });
+
+    // When
+    driver.session().run( "RETURN 1").then( function() {
+      // Then we get to here.
+      // And then the known_hosts file should have correct contents
+      expect( fs.readFileSync(knownHostsPath, 'utf8') ).toContain( "localhost:7687" );
+      done();
+    });
+  });
+
+  it('should should give helpful error if database cert does not match stored certificate', function(done) {
+    // Assuming we only run this test on NodeJS
+    if( !NodeChannel.available ) {
+      done();
+      return;
+    }
+
+    // Given
+    var knownHostsPath = "test/resources/random_known_hosts";
+
+    driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      encrypted: true,
+      trust: "TRUST_ON_FIRST_USE",
+      knownHosts: knownHostsPath
+    });
+
+    // When
+    driver.session().run( "RETURN 1").catch( function(error) {
+      expect(error.message).toContain("Database encryption certificate has changed, " +
+        "and no longer matches the certificate stored for localhost:7687");
+      done();
+    });
+  });
+
+  afterEach(function(){
+    if( driver ) {
+      driver.close();
+    }
+  });
+});
\ No newline at end of file
diff --git a/test/resources/random.certificate b/test/resources/random.certificate
new file mode 100644
index 000000000..875ded223
--- /dev/null
+++ b/test/resources/random.certificate
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBpTCCAQ6gAwIBAgIILUs34gik1BQwDQYJKoZIhvcNAQENBQAwFDESMBAGA1UE
+AwwJbG9jYWxob3N0MCAXDTE1MDMxNjE3MTkzMFoYDzk5OTkxMjMxMjM1OTU5WjAU
+MRIwEAYDVQQDDAlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
+AIL/o9nJFxqq19qB3bW4Ww40e0FIApVqXR3sMQUutaCbA26iVtOA9LjVeCANMh+g
+TbNBXhc5zj4yDAh5yCEjq1e6W/mzaVLlrNKf9MUI5qlzje/r9F9hMB82pfUi1XfK
+ilXSueAgnzOTUZfR4kQL588YP9y6E0NCLgmIm1UijINzAgMBAAEwDQYJKoZIhvcN
+AQENBQADgYEAV6C5vcNBdV73esO6sFZbITgw4umg3TYttB/148xeTxORQjqkohRh
+qFML+Xb2YZCXqK5POKLxcN4IJsw+JJI29erNHEhDOURuoQo5p4dvmjP+1fbCDaIY
+P4RVWf7oaNiZBNoCeTF4vLMRfVVwSo4PmSFMgczWJVb51okq3ecLBCo=
+-----END CERTIFICATE-----
diff --git a/test/resources/random_known_hosts b/test/resources/random_known_hosts
new file mode 100644
index 000000000..4264c7851
--- /dev/null
+++ b/test/resources/random_known_hosts
@@ -0,0 +1,3 @@
+# Used by tests to ensure we get proper error if we already have
+# a known certificate for a given url.
+localhost:7687 f6468f97639f16b148141d613bf991fcb96bf4b31c55c4607901b53943a6b53da58eb21bdbb1e85de7c9aeb8ef6e6f53a023a8c4ffd02cad81a18d179fc869ea
diff --git a/test/v1/examples.test.js b/test/v1/examples.test.js
index 143044f25..f53bcc7d1 100644
--- a/test/v1/examples.test.js
+++ b/test/v1/examples.test.js
@@ -50,7 +50,7 @@ describe('examples', function() {
     session
       .run( "MATCH (p:Person) WHERE p.name = 'Neo' RETURN p.age" )
       .then( function( result ) {
-        console.log( "Neo is " + result.records[0]["p.age"].toInt() + " years old." );
+        console.log( "Neo is " + result.records[0].get("p.age").toInt() + " years old." );
 
         session.close();
         driver.close();
@@ -114,20 +114,39 @@ describe('examples', function() {
 
   it('should document how to require encryption', function() {
     // tag::tls-require-encryption[]
-    // Unfortunately, this feature is not yet implemented for JavaScript
+    var driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      // In NodeJS, encryption is on by default. In the web bundle, it is off.
+      encrypted:true
+    });
     // end::tls-require-encryption[]
+    driver.close();
   });
 
-  it('should document how to configure trust-on-first-use', function() {  
+  it('should document how to configure trust-on-first-use', function() {
     // tag::tls-trust-on-first-use[]
-    // Unfortunately, this feature is not yet implemented for JavaScript
+    var driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      // Note that trust-on-first-use is not available in the browser bundle,
+      // in NodeJS, trust-on-first-use is the default trust mode. In the browser
+      // it is TRUST_SIGNED_CERTIFICATES.
+      trust: "TRUST_ON_FIRST_USE",
+      encrypted:true
+    });
     // end::tls-trust-on-first-use[]
+    driver.close();
   }); 
 
-  it('should document how to configure a trusted signing certificate', function() {  
+  it('should document how to configure a trusted signing certificate', function() {
     // tag::tls-signed[]
-    // Unfortunately, this feature is not yet implemented for JavaScript
+    var driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"), {
+      trust: "TRUST_SIGNED_CERTIFICATES",
+      // Configuring which certificates to trust here is only available
+      // in NodeJS. In the browser bundle the browsers list of trusted
+      // certificates is used, due to technical limitations in some browsers.
+      trustedCertificates : ["path/to/ca.crt"],
+      encrypted:true
+    });
     // end::tls-signed[]
+    driver.close();
   });
 
 });
diff --git a/test/v1/record.test.js b/test/v1/record.test.js
new file mode 100644
index 000000000..7d19f4412
--- /dev/null
+++ b/test/v1/record.test.js
@@ -0,0 +1,80 @@
+/**
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var Record = require("../../lib/v1/record").Record;
+var Neo4jError = require("../../lib/v1/internal/error").Neo4jError;
+
+
+describe('Record', function() {
+  it('should allow getting fields by name', function() {
+    // Given
+    var record = new Record( ["name"], ["Bob"] );
+
+    // When & Then
+    expect(record.get("name")).toEqual("Bob");
+  });
+
+  it('should give helpful error on no such key', function() {
+    // Given
+    var record = new Record( ["name"], ["Bob"] );
+
+    // When & Then
+    expect( function() { record.get("age") }).toThrow(new Neo4jError(
+      "This record has no field with key 'age', available key are: [name]."));
+  });
+
+  it('should allow getting fields by index', function() {
+    // Given
+    var record = new Record( ["name"], ["Bob"] );
+
+    // When & Then
+    expect(record.get(0)).toEqual("Bob");
+  });
+
+  it('should give helpful error on no such index', function() {
+    // Given
+    var record = new Record( ["name"], ["Bob"] );
+
+    // When & Then
+    expect( function() { record.get(1) }).toThrow(new Neo4jError(
+      "This record has no field with index '1'. Remember that indexes start at `0`, " +
+      "and make sure your statement returns records in the shape you meant it to."));
+  });
+
+  it('should have length', function() {
+    // When & Then
+    expect( new Record( [], []).length ).toBe(0);
+    expect( new Record( ["name"], ["Bob"]).length ).toBe(1);
+    expect( new Record( ["name", "age"], ["Bob", 45]).length ).toBe(2);
+  });
+
+  it('should allow forEach through the record', function() {
+    // Given
+    var record = new Record( ["name", "age"], ["Bob", 45] );
+    var result = [];
+
+    // When
+    record.forEach( function( value, key, record ) {
+      result.push( [value, key, record] );
+    });
+
+    // Then
+    expect(result).toEqual([["Bob", "name", record], [45, "age", record]]);
+  });
+});
diff --git a/test/v1/result.test.js b/test/v1/result.test.js
new file mode 100644
index 000000000..69079488e
--- /dev/null
+++ b/test/v1/result.test.js
@@ -0,0 +1,64 @@
+/**
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var neo4j = require("../../lib/v1");
+
+describe('result stream', function() {
+
+  var driver, session;
+
+  beforeEach(function(done) {
+    driver = neo4j.driver("bolt://localhost", neo4j.auth.basic("neo4j", "neo4j"));
+    session = driver.session();
+
+    session.run("MATCH (n) DETACH DELETE n").then(done);
+  });
+
+  afterEach(function() {
+    driver.close();
+  });
+
+  it('should allow chaining `then`, returning a new thing in each', function(done) {
+    // When & Then
+    session.run( "RETURN 1")
+      .then( function() {
+        return "first";
+      })
+      .then( function(arg) {
+        expect(arg).toBe( "first" );
+        return "second";
+      })
+      .then( function(arg) {
+        expect(arg).toBe( "second" );
+      })
+      .then(done);
+  });
+
+  it('should allow catching exception thrown in `then`', function(done) {
+    // When & Then
+    session.run( "RETURN 1")
+      .then( function() {
+        throw new Error("Away with you!");
+      })
+      .catch( function(err) {
+        expect(err.message).toBe( "Away with you!" );
+        done()
+      });
+  });
+});
diff --git a/test/v1/session.test.js b/test/v1/session.test.js
index 6137c3ebe..7881693bb 100644
--- a/test/v1/session.test.js
+++ b/test/v1/session.test.js
@@ -46,7 +46,7 @@ describe('session', function() {
       },
       onCompleted : function( ) {
         expect( records.length ).toBe( 1 );
-        expect( records[0]['a'] ).toBe( 1 );
+        expect( records[0].get('a') ).toBe( 1 );
         done();
       }
     });
@@ -95,26 +95,27 @@ describe('session', function() {
       },
       onCompleted : function( ) {
         expect( records.length ).toBe( 1 );
-        expect( records[0]['a'] ).toBe( true );
+        expect( records[0].get('a') ).toBe( true );
         done();
       }
     });
   });
 
-  it('should expose basic run/then/then/then ', function(done) {
+  it('should expose run/then/then/then ', function(done) {
     // When & Then
     session.run( "RETURN 1.0 AS a")
     .then(
       function(result) {
         expect(result.records.length).toBe( 1 );
-        expect(result.records[0]['a']).toBe( 1 );
+        expect(result.records[0].get('a')).toBe( 1 );
+        return result
       }
     ).then(
       function(result) {
         expect(result.records.length).toBe( 1 );
-        expect(result.records[0]['a']).toBe( 1 );
+        expect(result.records[0].get('a')).toBe( 1 );
       }
-    ).then( function() { done(); })
+    ).then( done );
   });
 
   it('should expose basic run/catch ', function(done) {
diff --git a/test/v1/tck/steps/matchacceptencesteps.js b/test/v1/tck/steps/matchacceptencesteps.js
index 9174bd3c4..bb9be3643 100644
--- a/test/v1/tck/steps/matchacceptencesteps.js
+++ b/test/v1/tck/steps/matchacceptencesteps.js
@@ -25,12 +25,12 @@ module.exports = function () {
       var givenResults = [];
       var expectedPrint = printable(self.expectedResults);
       for (var i = 0 ; i < res.records.length; i++)  {
-          givenResults.push(getTestObject(res.records[i]));
+        givenResults.push(getTestObject(res.records[i]));
       }
       if ( givenResults.length != self.expectedResults.length) {
         callback(new Error("Given and expected length of result array does not match. Give: " + givenResults.length + " Expected " + self.expectedResults.length));
       }
-      if (!comapareResults(givenResults, self.expectedResults) ) {
+      if (!compareResults(givenResults, self.expectedResults) ) {
         callback(new Error("Given and expected results does not match: " + printable(givenResults) + " Expected " + expectedPrint));
       }
       callback();
@@ -39,7 +39,7 @@ module.exports = function () {
   });
 
 
-  function comapareResults(given, expected) {
+  function compareResults(given, expected) {
     if (! (typeof given === "object" && given instanceof Array) ) {
       throw new Error("Should be type Array")
     }
@@ -79,22 +79,20 @@ module.exports = function () {
 
   }
 
-  function getTestObject(rels, func) {
-    result = {}
-    for (var key in rels)
-    {
-      var rel = rels[key];
+  function getTestObject(rels) {
+    result = {};
+    rels.forEach(function( rel, key ) {
       if (typeof rel === "object" && rel instanceof Array) {
         var relArray = [];
         for (var i in rel) {
-            relArray.push(getTestValue(rel[i]));
+          relArray.push(getTestValue(rel[i]));
         }
         result[key] = relArray;
       }
       else {
         result[key] = getTestValue(rel);
       }
-    }
+    });
     return result;
   }
 
@@ -102,7 +100,7 @@ module.exports = function () {
     if ( val === null) {
       return val;
     }
-    var con = val.constructor.name.toLowerCase()
+    var con = val.constructor.name.toLowerCase();
     if (con === NODE) {
       return stripNode(val);
     }
diff --git a/test/v1/tck/steps/tyepesystemsteps.js b/test/v1/tck/steps/tyepesystemsteps.js
index f19e9846e..a6701de74 100644
--- a/test/v1/tck/steps/tyepesystemsteps.js
+++ b/test/v1/tck/steps/tyepesystemsteps.js
@@ -113,15 +113,15 @@ module.exports = function () {
     var self = this;
     var errorCallback = function(err) {callback(new Error("Rejected Promise: " + err))}
     var successCallback = function(res) {
-      if(Object.keys(res.records[0]).length != 1 || Object.keys(res.records[0])[0].length != 1) {
-        callback(new Error("Expected the statement to return a single row, single field record. Got: " + Object.keys(res.records[0]).length + " records and: " + Object.keys(res.records[0])[0].length + " values"));
+      if(res.records.length != 1 || res.records[0].length != 1) {
+        callback(new Error("Expected the statement to return a single record, single field record. Got: " + res.records.length + " records and: " + res.records[0].length + " values"));
       }
 
-      if (!util.compareValues(res.records[0]['x'], self.expectedValue)) {
-          callback(new Error("Expected the statement to return same as what was sent. Got: " + res.records[0]['x'] + " Expected: " + self.expectedValue));
+      if (!util.compareValues(res.records[0].get('x'), self.expectedValue)) {
+          callback(new Error("Expected the statement to return same as what was sent. Got: " + res.records[0].get('x') + " Expected: " + self.expectedValue));
       }
       callback();
-    }
+    };
     this.withParamPromise.then(successCallback).catch(errorCallback);
     this.withLiteralPromise.then(successCallback).catch(errorCallback);
   });
@@ -132,7 +132,7 @@ module.exports = function () {
 
   function stringOfSize(size) {
     var chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-    return Array(size).join().split(',').map(function() { return chars.charAt(Math.floor(Math.random() * chars.length)); }).join('');
+    return new Array(size).join().split(',').map(function() { return chars.charAt(Math.floor(Math.random() * chars.length)); }).join('');
   }
 
   function randomBool()
diff --git a/test/v1/transaction.test.js b/test/v1/transaction.test.js
index fcd7904b6..9a9b9ba73 100644
--- a/test/v1/transaction.test.js
+++ b/test/v1/transaction.test.js
@@ -34,7 +34,7 @@ describe('transaction', function() {
     driver.close();
   });
 
-  it('should handle simple transaction', function(done) {
+  it('should commit simple case', function(done) {
     // When
     var tx = session.beginTransaction();
     tx.run("CREATE (:TXNode1)");
@@ -44,9 +44,9 @@ describe('transaction', function() {
         session.run("MATCH (t1:TXNode1), (t2:TXNode2) RETURN count(t1), count(t2)")
           .then(function (result) {
             expect(result.records.length).toBe(1);
-            expect(result.records[0]['count(t1)'].toInt())
+            expect(result.records[0].get('count(t1)').toInt())
               .toBe(1);
-            expect(result.records[0]['count(t2)'].toInt())
+            expect(result.records[0].get('count(t2)').toInt())
               .toBe(1);
             done();
           });
@@ -57,13 +57,13 @@ describe('transaction', function() {
     // When
     var tx = session.beginTransaction();
     tx.run("RETURN 'foo' AS res").then(function (result) {
-      tx.run("CREATE ({name: {param}})", {param: result.records[0]['res']});
+      tx.run("CREATE ({name: {param}})", {param: result.records[0].get('res')});
       tx.commit()
         .then(function () {
           session.run("MATCH (a {name:'foo'}) RETURN count(a)")
             .then(function (result) {
               expect(result.records.length).toBe(1);
-              expect(result.records[0]['count(a)'].toInt()).toBe(1);
+              expect(result.records[0].get('count(a)').toInt()).toBe(1);
               done();
             });
         });
@@ -149,9 +149,9 @@ describe('transaction', function() {
         session.run("MATCH (t1:TXNode1), (t2:TXNode2) RETURN count(t1), count(t2)")
           .then(function (result) {
             expect(result.records.length).toBe(1);
-            expect(result.records[0]['count(t1)'].toInt())
+            expect(result.records[0].get('count(t1)').toInt())
               .toBe(0);
-            expect(result.records[0]['count(t2)'].toInt())
+            expect(result.records[0].get('count(t2)').toInt())
               .toBe(0);
             done();
         });
diff --git a/test/v1/types.test.js b/test/v1/types.test.js
index 064ae4cb3..e8876334c 100644
--- a/test/v1/types.test.js
+++ b/test/v1/types.test.js
@@ -69,7 +69,7 @@ describe('node values', function() {
 
     // When
     session.run("CREATE (n:User {name:'Lisa'}) RETURN n, id(n)").then(function(result) {
-        var node = result.records[0]['n'];
+        var node = result.records[0].get('n');
 
         expect( node.properties ).toEqual( { name:"Lisa" } );
         expect( node.labels ).toEqual( ["User"] );
@@ -89,7 +89,7 @@ describe('relationship values', function() {
 
     // When
     session.run("CREATE ()-[r:User {name:'Lisa'}]->() RETURN r, id(r)").then(function(result) {
-        var rel = result.records[0]['r'];
+        var rel = result.records[0].get('r');
 
         expect( rel.properties ).toEqual( { name:"Lisa" } );
         expect( rel.type ).toEqual( "User" );
@@ -110,7 +110,7 @@ describe('path values', function() {
     // When
     session.run("CREATE p=(:User { name:'Lisa' })<-[r:KNOWS {since:1234.0}]-() RETURN p")
       .then(function(result) {
-        var path = result.records[0]['p'];
+        var path = result.records[0].get('p');
 
         expect( path.start.properties ).toEqual( { name:"Lisa" } );
         expect( path.end.properties ).toEqual( { } );
@@ -124,10 +124,10 @@ describe('path values', function() {
           expect( segment.end.properties ).toEqual( { } );
           // Which is the inverse of the relationship itself!
           expect( segment.relationship.properties ).toEqual( { since: 1234 } );
-        };
+        }
         driver.close();
         done();
-      });
+      }).catch(function(err) { console.log(err); });
   });
 });
 
@@ -138,9 +138,9 @@ function testVal( val ) {
 
     session.run("RETURN {val} as v", {val: val})
       .then( function( result ) {
-        expect( result.records[0]['v'] ).toEqual( val );
+        expect( result.records[0].get('v') ).toEqual( val );
         driver.close();
         done();
-      });
+      }).catch(function(err) { console.log(err); });
   }
 }
