diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 17995bf..db6cea5 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -7,6 +7,7 @@
 import java.security.NoSuchAlgorithmException;
 import java.util.Collection;
 import java.util.Map;
+import java.util.Arrays;
 
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MultivaluedMap;
@@ -197,6 +198,7 @@
 	// 172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
 	// 192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
 	// b. set corpusAccess depending on location:
+	// c. DemoUser only gets corpusAccess=FREE.
 	// 16.05.17/FB
 
 	@Override
@@ -206,8 +208,14 @@
 		Location location = Location.EXTERN;
 		CorpusAccess corpusAccess = CorpusAccess.FREE;
 		
-		// EM: There is no check for a demo user in intranet?
-		// EM: LDAP user without IP gets CorpusAccess.FREE ?
+	    if( user instanceof DemoUser )
+	    {
+	    	// to be absolutely sure:
+	    	user.setCorpusAccess(User.CorpusAccess.FREE);
+	    	if( DEBUG_LOG == true )
+	    		System.out.println("setAccessAndLocation: DemoUser.");
+	     	return;
+	    }
 		
 		if (headerMap != null && headerMap.containsKey(org.eclipse.jetty.http.HttpHeaders.X_FORWARDED_FOR)) {
 
@@ -217,8 +225,6 @@
 			try {
 				InetAddress ip = InetAddress.getByName(clientAddress);
 				if (ip.isSiteLocalAddress()){
-//				if (clientAddress.startsWith("10.0.") || clientAddress.startsWith("172.16.")
-//						|| clientAddress.startsWith("192.168."))
 					location = Location.INTERN;
 					corpusAccess = CorpusAccess.ALL;
 				}
@@ -227,7 +233,8 @@
 				}
 				
 				if (DEBUG_LOG == true) {
-					System.out.printf("Debug: X-Forwarded-For : '%s' (%d values) -> %s\n", vals, vals.length, vals[0]);
+					System.out.printf("Debug: X-Forwarded-For : '%s' (%d values) -> %s\n", 
+							Arrays.toString(vals), vals.length, vals[0]);
 					System.out.printf("Debug: X-Forwarded-For : location = %s corpusAccess = %s\n",
 							location == Location.INTERN ? "INTERN" : "EXTERN", corpusAccess == CorpusAccess.ALL ? "ALL"
 									: corpusAccess == CorpusAccess.PUB ? "PUB" : "FREE");
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java b/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
index fe8e055..0f44a67 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
@@ -288,10 +288,10 @@
 				System.out.printf(" att: '%s'='%s'.\n", attr.getName(), attr.getValue());
 
 			// checking pertinent attribut/value pairs:
-			// "idsStatus": values 0=OK, 1-3 = locked account.
+			// "idsStatus": values 0=OK, 1=inaktiv=OK, 2-3 = locked account.
 			if( attr.getName().equals(attStatus) )
 				{
-				if( (val = attr.getValueAsInteger()) == null || val != 0 )
+				if( (val = attr.getValueAsInteger()) == null || (val != 0 && val != 1) )
 					{
 					if( DEBUGLOG ) System.out.printf("idsStatus = '%s' -> User locked!\n", attr.getValue());
 					return ldapTerminate(lc, LDAP_AUTH_RLOCKED);
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java
index c2fa34d..76d49ae 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java
@@ -45,7 +45,7 @@
 @Produces(MediaType.TEXT_HTML + ";charset=utf-8")
 public class AuthService {
 
-	private static Boolean DEBUG_LOG = true;
+	private static Boolean DEBUG_LOG = false;
 	
     //todo: bootstrap function to transmit certain default configuration settings and examples (example user queries,
     // default usersettings, etc.)
@@ -122,7 +122,8 @@
 	        System.out.printf("Debug: auth.size=%d\n",  auth.size());
 	        System.out.printf("auth.get(0)='%s'\n", auth.get(0));
 	        System.out.printf("Debug: values.length=%d\n",  values.length);
-	        if( auth.size() > 0 )
+	        /* hide password etc. - FB
+	         if( auth.size() > 0 )
 	        	{
 	        	Iterator it = auth.iterator();
 	        	while( it.hasNext() )
@@ -135,7 +136,7 @@
 	        		System.out.printf(" values[%d]='%s'\n",  i, values[i]);
 	        		}
 	        	}
-
+	         */
 	        MultivaluedMap<String,String> headerMap = headers.getRequestHeaders();
 	        if( headerMap != null && headerMap.size() > 0 )
 	        {