diff --git a/dependency-reduced-pom.xml b/dependency-reduced-pom.xml
index d3e5963..c2fa6df 100644
--- a/dependency-reduced-pom.xml
+++ b/dependency-reduced-pom.xml
@@ -4,7 +4,7 @@
   <groupId>de.ids_mannheim.korap</groupId>
   <artifactId>Kustvakt-core</artifactId>
   <name>Kustvakt core</name>
-  <version>0.5</version>
+  <version>0.56</version>
   <description>Kustvakt core, basic rest api for testing purposes and default
         interfaces</description>
   <build>
diff --git a/pom.xml b/pom.xml
index 7be5f83..b8534ce 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>de.ids_mannheim.korap</groupId>
     <artifactId>Kustvakt-core</artifactId>
-    <version>0.5</version>
+    <version>0.56</version>
     <packaging>jar</packaging>
     <name>Kustvakt core</name>
     <description>Kustvakt core, basic rest api for testing purposes and default
@@ -96,6 +96,7 @@
                 <directory>src/test/resources</directory>
                 <filtering>true</filtering>
                 <includes>
+
                     <include>**/*.prop</include>
                     <include>**/*.xml</include>
                     <include>**/*.conf</include>
@@ -305,6 +306,12 @@
         </dependency>
 
         <dependency>
+            <groupId>mysql</groupId>
+            <artifactId>mysql-connector-java</artifactId>
+            <version>5.1.6</version>
+        </dependency>
+
+        <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-dbcp2</artifactId>
             <version>2.1.1</version>
@@ -331,7 +338,7 @@
         <dependency>
             <groupId>de.ids_mannheim.korap</groupId>
             <artifactId>Krill</artifactId>
-            <version>0.53</version>
+            <version>0.54</version>
             <exclusions>
                 <exclusion>
                     <groupId>org.xerial</groupId>
@@ -346,10 +353,10 @@
         </dependency>
         <!-- deprecated? -->
         <!--<dependency>-->
-            <!--<groupId>com.restfuse</groupId>-->
-            <!--<artifactId>com.eclipsesource.restfuse</artifactId>-->
-            <!--<version>1.0.0</version>-->
-            <!--<scope>provided</scope>-->
+        <!--<groupId>com.restfuse</groupId>-->
+        <!--<artifactId>com.eclipsesource.restfuse</artifactId>-->
+        <!--<version>1.0.0</version>-->
+        <!--<scope>provided</scope>-->
         <!--</dependency>-->
         <!-- deprecated -->
         <!--<dependency>-->
@@ -359,9 +366,9 @@
         <!--<scope>provided</scope>-->
         <!--</dependency>-->
         <!--<dependency>-->
-            <!--<groupId>org.springframework</groupId>-->
-            <!--<artifactId>spring-core</artifactId>-->
-            <!--<version>4.0.5.RELEASE</version>-->
+        <!--<groupId>org.springframework</groupId>-->
+        <!--<artifactId>spring-core</artifactId>-->
+        <!--<version>4.0.5.RELEASE</version>-->
         <!--</dependency>-->
         <dependency>
             <groupId>org.springframework</groupId>
@@ -433,6 +440,11 @@
             <artifactId>jetty-servlet</artifactId>
             <version>8.1.8.v20121106</version>
         </dependency>
+        <dependency>
+            <groupId>asm</groupId>
+            <artifactId>asm</artifactId>
+            <version>3.3.1</version>
+        </dependency>
 
         <!--
         not part of public release
diff --git a/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java b/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java
index ae5aeac..4f27617 100644
--- a/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java
+++ b/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java
@@ -35,6 +35,7 @@
     private static BeanHolderHelper beans;
 
     //todo: allow this for external plugin systems that are not kustvakt specific
+    @Deprecated
     public static void setCustomBeansHolder(BeanHolderHelper holder) {
         ApplicationContext context = beans.context;
         holder.context = context;
@@ -69,16 +70,18 @@
     }
 
     public static void loadClasspathContext(String... files) {
-        if (!hasContext()) {
-            ApplicationContext context;
-            if (files.length == 0)
-                context = new ClassPathXmlApplicationContext(CONFIG_FILE);
-            else
-                context = new ClassPathXmlApplicationContext(files);
+        if (hasContext())
+            closeApplication();
 
-            BeanConfiguration.beans = new BeanHolderHelper(context);
-            setManualBeans();
-        }
+        ApplicationContext context;
+        if (files.length == 0)
+            context = new ClassPathXmlApplicationContext(CONFIG_FILE);
+        else
+            context = new ClassPathXmlApplicationContext(files);
+
+        BeanConfiguration.beans = new BeanHolderHelper(context);
+        setManualBeans();
+
     }
 
     private static void setManualBeans() {
diff --git a/src/main/java/de/ids_mannheim/korap/config/ClientInfo.java b/src/main/java/de/ids_mannheim/korap/config/ClientInfo.java
index 5eab5b9..fc856b4 100644
--- a/src/main/java/de/ids_mannheim/korap/config/ClientInfo.java
+++ b/src/main/java/de/ids_mannheim/korap/config/ClientInfo.java
@@ -1,5 +1,7 @@
 package de.ids_mannheim.korap.config;
 
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import de.ids_mannheim.korap.utils.JsonUtils;
 import lombok.Data;
 
 /**
@@ -25,6 +27,16 @@
     }
 
     public String toJSON() {
+        ObjectNode node = JsonUtils.createObjectNode();
+        node.put("client_id", client_id);
+        node.put("client_secret", client_secret);
+        node.put("application_name", application_name);
+        node.put("url", url);
+        node.put("redirect_uri", redirect_uri);
+        return JsonUtils.toJSON(node);
+    }
+
+    public String toString() {
         return "client_id: " + client_id + "\n" +
                 "application_name: " + application_name + "\n" +
                 "url: " + url + "\n" +
diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java
index ed3b832..5377998 100644
--- a/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java
@@ -1,8 +1,13 @@
 package de.ids_mannheim.korap.config;
 
+import de.ids_mannheim.korap.interfaces.db.PersistenceClient;
+import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
 import org.reflections.Reflections;
 
 import java.lang.annotation.Annotation;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
+import java.util.HashSet;
 import java.util.Set;
 
 /**
@@ -14,10 +19,9 @@
     private static final Reflections reflections = new Reflections(
             "de.ids_mannheim.korap");
 
-
     private KustvaktClassLoader() {
-
     }
+
     /**
      * loads interface implementations in current classpath
      *
@@ -33,4 +37,35 @@
             Class<? extends Annotation> annotation) {
         return reflections.getTypesAnnotatedWith(annotation);
     }
+
+    public static void registerResourceClasses() {
+        PersistenceClient cl = BeanConfiguration.getBeans()
+                .getPersistenceClient();
+        Set<ResourceOperationIface> set = new HashSet<>();
+        Set<Class<? extends ResourceOperationIface>> resource_prov = loadSubTypes(
+                ResourceOperationIface.class);
+        for (Class<? extends ResourceOperationIface> op : resource_prov) {
+            Constructor c;
+            try {
+                c = op.getConstructor(PersistenceClient.class);
+                set.add((ResourceOperationIface) c.newInstance(cl));
+            }catch (NoSuchMethodException | InvocationTargetException | InstantiationException | IllegalAccessException e) {
+                // do nothing;
+            }
+        }
+
+        if (BeanConfiguration.hasContext()) {
+            BeanConfiguration.BeanHolderHelper helper = BeanConfiguration
+                    .getBeans();
+            if (helper.getPolicyDbProvider() != null
+                    && helper.getEncryption() != null
+                    && helper.getResourceProvider() != null) {
+
+                de.ids_mannheim.korap.security.ac.SecurityManager
+                        .setProviders(helper.getPolicyDbProvider(),
+                                helper.getEncryption(), set);
+
+            }
+        }
+    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
index 33b2398..406d319 100644
--- a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
@@ -1,6 +1,7 @@
 package de.ids_mannheim.korap.config;
 
 import de.ids_mannheim.korap.interfaces.EncryptionIface;
+import de.ids_mannheim.korap.user.Attributes;
 import de.ids_mannheim.korap.utils.KustvaktLogger;
 import de.ids_mannheim.korap.utils.TimeUtils;
 import lombok.Getter;
@@ -11,10 +12,9 @@
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.MalformedURLException;
 import java.net.URL;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
+import java.util.*;
 
 /**
  * if configuration class is extended, loadSubTypes method should be overriden
@@ -26,6 +26,19 @@
 @Getter
 public class KustvaktConfiguration {
 
+    public static final Map<String, Object> KUSTVAKT_USER = new HashMap<>();
+
+    static {
+        KUSTVAKT_USER.put(Attributes.ID, 1);
+        KUSTVAKT_USER.put(Attributes.USERNAME, "kustvakt");
+        KUSTVAKT_USER.put(Attributes.PASSWORD, "kustvakt2015");
+        KUSTVAKT_USER.put(Attributes.EMAIL, "kustvakt@ids-mannheim.de");
+        KUSTVAKT_USER.put(Attributes.COUNTRY, "Germany");
+        KUSTVAKT_USER.put(Attributes.FIRSTNAME, "Kustvakt");
+        KUSTVAKT_USER.put(Attributes.LASTNAME, "KorAP");
+        KUSTVAKT_USER.put(Attributes.INSTITUTION, "IDS Mannheim");
+    }
+
     private static final Logger jlog = KustvaktLogger
             .getLogger(KustvaktConfiguration.class);
     private String indexDir;
@@ -77,11 +90,23 @@
      * @param properties
      * @return
      */
-    protected Properties load(Properties properties) {
-        loadLog4jLogger();
+    protected Properties load(Properties properties)
+            throws MalformedURLException {
         maxhits = new Integer(properties.getProperty("maxhits", "50000"));
         returnhits = new Integer(properties.getProperty("returnhits", "50000"));
         indexDir = properties.getProperty("lucene.indexDir", "");
+        //        URL url = KustvaktConfiguration.class.getClassLoader()
+        //                .getResource(idir);
+        //        System.out.println("LOADING FILE FROM CLASSPATH? " + url);
+        //        if (!new File(idir).exists() && url != null) {
+        //            indexDir = url.getFile();
+        //        }else
+        //            indexDir = idir;
+        //
+        //        System.out.println(
+        //                "---------------------------------------------------------------");
+        //        System.out.println("INDEX DIR IS: " + indexDir);
+        //        System.out.println("FILE EXISTS? " + new File(indexDir).exists());
         port = new Integer(properties.getProperty("server.port", "8095"));
         // server options
         serverHost = String
@@ -91,7 +116,11 @@
         queryLanguages = new ArrayList<>();
         for (String querylang : qls)
             queryLanguages.add(querylang.trim().toUpperCase());
-        //        issuer = new URL(korap.getProperty("korap.issuer", ""));
+        String is = properties.getProperty("kustvakt.security.jwt.issuer", "");
+
+        if (!is.startsWith("http"))
+            is = "http://" + is;
+        issuer = new URL(is);
 
         default_const = properties
                 .getProperty("kustvakt.default.const", "mate");
@@ -144,7 +173,7 @@
      *
      * @param props
      */
-    public void setProperties(Properties props) {
+    public void setProperties(Properties props) throws MalformedURLException {
         this.load(props);
     }
 
@@ -172,11 +201,12 @@
             return Enum.valueOf(BACKENDS.class, value.toUpperCase());
     }
 
-    private void loadLog4jLogger() {
+    public static void loadLog4jLogger() {
         /** loadSubTypes log4j configuration file programmatically */
         Properties log4j = new Properties();
         try {
-            File f = new File("./log4j.properties");
+            File f = new File(System.getProperty("user.dir"),
+                    "log4j.properties");
             if (f.exists()) {
                 log4j.load(new FileInputStream(f));
                 PropertyConfigurator.configure(log4j);
@@ -191,7 +221,7 @@
         loadClassLogger();
     }
 
-    private void loadClassLogger() {
+    private static void loadClassLogger() {
         Properties log4j = new Properties();
         jlog.info(
                 "using class path logging properties file to configure logging system");
diff --git a/src/main/java/de/ids_mannheim/korap/config/ParamFields.java b/src/main/java/de/ids_mannheim/korap/config/ParamFields.java
index f796ca7..0dfa15b 100644
--- a/src/main/java/de/ids_mannheim/korap/config/ParamFields.java
+++ b/src/main/java/de/ids_mannheim/korap/config/ParamFields.java
@@ -13,7 +13,7 @@
 public class ParamFields extends HashMap<String, ParamFields.Param> {
 
     public void add(Param param) {
-        this.put(Param.class.getName(), param);
+        this.put(param.getClass().getName(), param);
     }
 
     public <T extends Param> T get(Class<T> cl) {
@@ -32,7 +32,7 @@
     @Getter
     public abstract static class Param {
 
-        public boolean hasValues(){
+        public boolean hasValues() {
             return false;
         }
 
diff --git a/src/main/java/de/ids_mannheim/korap/config/Scopes.java b/src/main/java/de/ids_mannheim/korap/config/Scopes.java
index 9c4ef7a..22567ac 100644
--- a/src/main/java/de/ids_mannheim/korap/config/Scopes.java
+++ b/src/main/java/de/ids_mannheim/korap/config/Scopes.java
@@ -67,4 +67,6 @@
         return m;
     }
 
+
+
 }
diff --git a/src/main/java/de/ids_mannheim/korap/handlers/CollectionDao.java b/src/main/java/de/ids_mannheim/korap/handlers/CollectionDao.java
index 56f79fa..69255f9 100644
--- a/src/main/java/de/ids_mannheim/korap/handlers/CollectionDao.java
+++ b/src/main/java/de/ids_mannheim/korap/handlers/CollectionDao.java
@@ -14,6 +14,7 @@
 import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
 
 import java.util.Collection;
+import java.util.HashMap;
 import java.util.List;
 
 /**
@@ -47,7 +48,7 @@
         MapSqlParameterSource source = new MapSqlParameterSource();
         source.addValue("id", id);
         source.addValue("user", user.getId());
-        final String sql = "select * from coll_store where persistentID=:id and userID=:user;";
+        final String sql = "select * from coll_store where persistent_id=:id and user_id=:user;";
         try {
             return (T) this.jdbcTemplate.queryForObject(sql, source,
                     new RowMapperFactory.CollectionMapper());
@@ -78,12 +79,12 @@
         np.addValue("qy", resource.getQuery());
         np.addValue("name", resource.getName());
         np.addValue("desc", resource.getDescription());
-        final String sql = "UPDATE coll_store SET query=:qy, name=:name, description=:desc WHERE persistentID=:id;";
+        final String sql = "UPDATE coll_store SET query=:qy, name=:name, description=:desc WHERE persistent_id=:id;";
         try {
             return this.jdbcTemplate.update(sql, np);
         }catch (DataAccessException e) {
             log.error("Exception during database update for id '" + resource
-                    .getId() + "'", e);
+                    .getPersistentID() + "'", e);
             throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
         }
     }
@@ -92,7 +93,7 @@
             throws KustvaktException {
         MapSqlParameterSource[] sources = new MapSqlParameterSource[resources
                 .size()];
-        final String sql = "UPDATE coll_store SET query=:qy, name=:name, description=:desc WHERE persistentID=:id;";
+        final String sql = "UPDATE coll_store SET query=:qy, name=:name, description=:desc WHERE persistent_id=:id;";
         int i = 0;
         for (VirtualCollection c : resources) {
             MapSqlParameterSource np = new MapSqlParameterSource();
@@ -120,15 +121,16 @@
             np.addValue("name", resource.getName());
             np.addValue("desc", resource.getDescription());
             np.addValue("us", user.getId());
+            np.addValue("cr", System.currentTimeMillis());
 
             final String sql =
-                    "INSERT INTO coll_store (persistentID, name, description, userID, query) "
-                            + "VALUES (:pid, :name, :desc, :us, :query);";
+                    "INSERT INTO coll_store (persistent_id, name, description, user_id, query, created) "
+                            + "VALUES (:pid, :name, :desc, :us, :query, :cr);";
             try {
                 return this.jdbcTemplate.update(sql, np);
             }catch (DataAccessException e) {
                 log.error("Exception during database store for id '" + resource
-                        .getId() + "'", e);
+                        .getPersistentID() + "'", e);
                 throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
             }
         }else
@@ -137,12 +139,12 @@
     }
 
     public int deleteResource(String id, User user) throws KustvaktException {
-        //todo: foreign key and on delete cascade does not work currently!
+        //todo: foreign key and on delete cascade does not work properly!
         MapSqlParameterSource np = new MapSqlParameterSource();
         np.addValue("id", id);
         np.addValue("user", user.getId());
-        //        final String sql = "DELETE FROM coll_store cs inner join r_store rs on rs.id=cs.id WHERE rs.persistentID=:id;";
-        final String sql = "DELETE FROM coll_store where persistentID=:id and user=:user;";
+        //        final String sql = "DELETE FROM coll_store cs inner join r_store rs on rs.id=cs.id WHERE rs.persistent_id=:id;";
+        final String sql = "DELETE FROM coll_store where persistent_id=:id and user_id=:user;";
         try {
             return this.jdbcTemplate.update(sql, np);
         }catch (DataAccessException e) {
@@ -152,6 +154,16 @@
         }
     }
 
+    @Override
+    public int deleteAll() throws KustvaktException {
+        final String sql = "DELETE FROM coll_store;";
+        try {
+            return this.jdbcTemplate.update(sql, new HashMap<String, Object>());
+        }catch (DataAccessException e) {
+            throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
     //todo: adjust to resource id input (batch operation!)
     // fixme: test
     public List<VirtualCollection> getResources(Collection<Object> resources,
diff --git a/src/main/java/de/ids_mannheim/korap/handlers/DocumentDao.java b/src/main/java/de/ids_mannheim/korap/handlers/DocumentDao.java
index 99edf0e..57b0014 100644
--- a/src/main/java/de/ids_mannheim/korap/handlers/DocumentDao.java
+++ b/src/main/java/de/ids_mannheim/korap/handlers/DocumentDao.java
@@ -7,8 +7,9 @@
 import de.ids_mannheim.korap.resources.Document;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.BooleanUtils;
+import edu.emory.mathcs.backport.java.util.Collections;
 import org.springframework.dao.DataAccessException;
-import org.springframework.jdbc.core.ResultSetExtractor;
+import org.springframework.dao.EmptyResultDataAccessException;
 import org.springframework.jdbc.core.RowMapper;
 import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
 import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
@@ -16,6 +17,7 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.Collection;
+import java.util.HashMap;
 import java.util.List;
 
 /**
@@ -44,19 +46,23 @@
         String sql = "select id, persistent_id, disabled, strftime('%s', created) as created from doc_store where id=:id";
         try {
             return this.jdbcTemplate
-                    .query(sql, s, new ResultSetExtractor<Document>() {
+                    .queryForObject(sql, s, new RowMapper<Document>() {
                         @Override
-                        public Document extractData(ResultSet rs)
-                                throws SQLException, DataAccessException {
-                            if (rs.isFirst()) {
-                                Document doc = new Document(
+                        public Document mapRow(ResultSet rs, int rowNum)
+                                throws SQLException {
+                            Document doc = null;
+                            if (!rs.isClosed()) {
+                                String s = rs.getString("persistent_id");
+                                System.out.println("VALUE IS " + s);
+                                doc = new Document(
                                         rs.getString("persistent_id"));
                                 doc.setId(rs.getInt("id"));
-                                doc.setCreated(rs.getLong("created"));
+                                doc.setCreated(
+                                        rs.getTimestamp("created").getTime());
                                 doc.setDisabled(rs.getBoolean("disabled"));
-                                return doc;
                             }
-                            return null;
+
+                            return doc;
                         }
                     });
         }catch (DataAccessException e) {
@@ -69,30 +75,35 @@
     public Document findbyId(String id, User user) throws KustvaktException {
         MapSqlParameterSource s = new MapSqlParameterSource();
         s.addValue("id", id);
-        String sql = "select id, persistent_id, disabled, strftime('%s', created) as created from doc_store where persistent_id=:id";
-
+        //        strftime('%s', created) as created
+        String sql = "select id, persistent_id, disabled, created from doc_store where persistent_id=:id;";
         try {
             return this.jdbcTemplate
-                    .query(sql, s, new ResultSetExtractor<Document>() {
+                    .queryForObject(sql, s, new RowMapper<Document>() {
                         @Override
-                        public Document extractData(ResultSet rs)
-                                throws SQLException, DataAccessException {
+                        public Document mapRow(ResultSet rs, int rowNum)
+                                throws SQLException {
+                            Document doc = null;
                             if (!rs.isClosed()) {
-                                Document doc = new Document(
+                                doc = new Document(
                                         rs.getString("persistent_id"));
                                 doc.setId(rs.getInt("id"));
-                                doc.setCreated(rs.getLong("created"));
+                                doc.setCreated(
+                                        rs.getTimestamp("created").getTime());
                                 doc.setDisabled(rs.getBoolean("disabled"));
-                                return doc;
                             }
-                            return null;
+
+                            return doc;
                         }
                     });
+        }catch (EmptyResultDataAccessException em) {
+            return null;
         }catch (DataAccessException e) {
             throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
         }
     }
 
+    //todo:
     @Override
     public List<Document> getResources(Collection<Object> ids, User user)
             throws KustvaktException {
@@ -106,7 +117,11 @@
         source.addValue("pid", document.getPersistentID());
         source.addValue("dis", BooleanUtils.getBoolean(document.isDisabled()));
         final String sql = "UPDATE doc_store set disabled=:dis where persistent_id=:pid;";
-        return this.jdbcTemplate.update(sql, source);
+        try {
+            return this.jdbcTemplate.update(sql, source);
+        }catch (DataAccessException e) {
+            throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
+        }
     }
 
     @Override
@@ -121,7 +136,8 @@
         source.addValue("corpus", corpus + "%");
         source.addValue("offset", (offset * index));
         source.addValue("limit", offset);
-        final String sql = "select id, persistent_id, disabled, strftime('%s', created) as created from doc_store where (persistent_id like :corpus) limit :offset, :limit";
+        //strftime('%s', created) as
+        final String sql = "select id, persistent_id, disabled, created from doc_store where (persistent_id like :corpus) limit :offset, :limit";
         try {
             return this.jdbcTemplate
                     .query(sql, source, new RowMapper<Document>() {
@@ -133,13 +149,17 @@
                                 Document doc = new Document(
                                         rs.getString("persistent_id"));
                                 doc.setId(rs.getInt("id"));
-                                doc.setCreated(rs.getLong("created"));
+                                doc.setCreated(
+                                        rs.getTimestamp("created").getTime());
                                 doc.setDisabled(rs.getBoolean("disabled"));
                                 return doc;
                             }
                             return null;
                         }
                     });
+        }catch (EmptyResultDataAccessException em) {
+            em.printStackTrace();
+            return Collections.emptyList();
         }catch (DataAccessException e) {
             throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
         }
@@ -153,6 +173,9 @@
         String sql = "SELECT persistent_id FROM doc_store WHERE (persistent_id like :corpus) AND disabled=:dis;";
         try {
             return this.jdbcTemplate.queryForList(sql, s, String.class);
+        }catch (EmptyResultDataAccessException em) {
+            em.printStackTrace();
+            return Collections.emptyList();
         }catch (DataAccessException e) {
             throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
         }
@@ -171,6 +194,7 @@
         try {
             return this.jdbcTemplate.update(sql, s);
         }catch (DataAccessException e) {
+            e.printStackTrace();
             throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT,
                     "illegal argument given", resource.getPersistentID());
         }
@@ -188,4 +212,14 @@
         }
 
     }
+
+    @Override
+    public int deleteAll() throws KustvaktException {
+        String sql = "delete from doc_store;";
+        try {
+            return this.jdbcTemplate.update(sql, new HashMap<String, Object>());
+        }catch (DataAccessException e) {
+            throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
+        }
+    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/handlers/EntityDao.java b/src/main/java/de/ids_mannheim/korap/handlers/EntityDao.java
index bf3ab79..10082b2 100644
--- a/src/main/java/de/ids_mannheim/korap/handlers/EntityDao.java
+++ b/src/main/java/de/ids_mannheim/korap/handlers/EntityDao.java
@@ -26,6 +26,7 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -45,8 +46,8 @@
     @Override
     public UserSettings getUserSettings(Integer userid)
             throws KustvaktException {
-//        TransactionDefinition def = new DefaultTransactionDefinition();
-//        TransactionStatus status = transactionManager.getTransaction(def);
+        //        TransactionDefinition def = new DefaultTransactionDefinition();
+        //        TransactionStatus status = transactionManager.getTransaction(def);
 
         MapSqlParameterSource np = new MapSqlParameterSource();
         np.addValue("us", userid);
@@ -242,8 +243,6 @@
             throw new dbException(username, "korap_users",
                     StatusCodes.DB_GET_FAILED, username);
         }
-        // todo: set null!?!
-        //todo: test this
         return user;
     }
 
@@ -267,8 +266,8 @@
             }
             np.addValue("id", k.getId());
 
-            query = "UPDATE korap_users SET accountLock=:alo," +
-                    "accountLink=:ali, password=:ps," +
+            query = "UPDATE korap_users SET account_lock=:alo," +
+                    "account_link=:ali, password=:ps," +
                     "uri_fragment=:frag," +
                     "uri_expiration=:exp WHERE id=:id";
         }else if (user instanceof ShibUser) {
@@ -281,7 +280,7 @@
             np.addValue("cn", s.getCn());
             np.addValue("mail", s.getMail());
 
-            query = "UPDATE shibusers SET AccountLink=:ali" +
+            query = "UPDATE shibusers SET account_link=:ali" +
                     " eduPersonScopedAffiliation=:edu" +
                     "mail=:mail, cn=:cn WHERE id=:id";
         }else
@@ -313,35 +312,38 @@
             np.addValue("ps", k.getPassword());
             if (param != null) {
                 np.addValue("uri", param.getUriFragment());
-                np.addValue("urie", new Date(param.getUriExpiration()));
+                np.addValue("urie", param.getUriExpiration());
             }else {
                 np.addValue("uri", null);
                 np.addValue("urie", null);
             }
 
-            np.addValue("acr", k.getAccountCreation());
+            np.addValue("acr", System.currentTimeMillis());
             np.addValue("id", k.getId());
 
             if (user.getId() != -1)
-                query = "INSERT INTO korap_users (id, username, accountLock, " +
-                        "accountLink, password, uri_fragment, " +
-                        "accountCreation, " +
+                query = "INSERT INTO korap_users (id, username, account_lock, "
+                        +
+                        "account_link, password, uri_fragment, " +
+                        "account_creation, " +
                         "uri_expiration) VALUES (:id, :us, :alo, :ali, " +
                         ":ps, :uri, :acr, :urie);";
             else
-                query = "INSERT INTO korap_users (username, accountLock, " +
-                        "accountLink, password, uri_fragment, " +
-                        "accountCreation, " +
+                query = "INSERT INTO korap_users (username, account_lock, " +
+                        "account_link, password, uri_fragment, " +
+                        "account_creation, " +
                         "uri_expiration) VALUES (:us, :alo, :ali, " +
                         ":ps, :uri, :acr, :urie);";
 
             //fixme: still applicable?
         }else if (user instanceof ShibUser) {
             ShibUser s = (ShibUser) user;
-            query = "INSERT INTO shibusers (username, type, accountLink " +
-                    "eduPersonScopedAffiliation, accountCreation, cn, mail) " +
+
+            query = "INSERT INTO shibusers (username, type, account_link, account_creation "
+                    +
+                    "eduPersonScopedAffiliation, cn, mail) " +
                     "VALUES (:us, :type, :ali, " +
-                    ":edu, :acr, :cn, :mail, :logs, :logft);";
+                    ":edu, :cn, :mail, :logs, :logft);";
             np.addValue("us", s.getUsername());
             //            np.addValue("ali", s.getAccountLink());
             np.addValue("ali", null);
@@ -349,15 +351,15 @@
             np.addValue("mail", s.getMail());
             np.addValue("type", user.getType());
             np.addValue("cn", s.getCn());
-            np.addValue("acr", new Date(TimeUtils.getNow().getMillis()));
+            np.addValue("acr", System.currentTimeMillis());
 
             //todo: disable after first intro
         }else if (user instanceof DemoUser) {
-            query = "INSERT INTO korap_users (username, type, accountLock, " +
-                    "password, uri_fragment, " +
-                    "accountCreation, uri_expiration) VALUES (:us, :type, :alo, "
+            query = "INSERT INTO korap_users (username, type, account_lock, account_creation "
                     +
-                    ":ps, :uri, :acr, :urie);";
+                    "password, uri_fragment, " +
+                    "uri_expiration) VALUES (:us, :type, :alo, " +
+                    ":ps, :uri, :urie);";
 
             np.addValue("us", user.getUsername());
             np.addValue("type", user.getType());
@@ -367,7 +369,7 @@
             np.addValue("urie", new Date(0));
             np.addValue("ps", DemoUser.PASSPHRASE);
             np.addValue("uri", "");
-            np.addValue("acr", new Date(TimeUtils.getNow().getMillis()));
+            np.addValue("acr", System.currentTimeMillis());
         }else
             return -1;
 
@@ -389,6 +391,7 @@
         }catch (DataAccessException e) {
             jlog.error("Could not create user account with username: {}",
                     user.getUsername());
+            e.printStackTrace();
             throw new dbException(user.getUsername(), "korap_users",
                     StatusCodes.NAME_EXISTS, user.getUsername());
         }
@@ -448,12 +451,12 @@
     public int activateAccount(String username, String uriToken)
             throws KustvaktException {
         MapSqlParameterSource np = new MapSqlParameterSource();
-        final String query = "UPDATE korap_users SET uriFragment='', " +
-                "uri_expiration=0, accountLock=:lock WHERE uri_fragment=:uri AND username=:us AND "
+        final String query = "UPDATE korap_users SET uri_fragment='', " +
+                "uri_expiration=0, account_lock=:lock WHERE uri_fragment=:uri AND username=:us AND "
                 +
                 "uri_expiration > :now;";
         np.addValue("uri", uriToken);
-        np.addValue("now", new Date(TimeUtils.getNow().getMillis()));
+        np.addValue("now", TimeUtils.getNow().getMillis());
         np.addValue("us", username);
         np.addValue("lock", BooleanUtils.getBoolean(false));
         try {
@@ -466,6 +469,14 @@
         }
     }
 
+    public int size() {
+        final String query = "SELECT COUNT(*) FROM korap_users;";
+        return this.jdbcTemplate
+                .queryForObject(query, new HashMap<String, Object>(),
+                        Integer.class);
+
+    }
+
     //todo:
     public List getAccountLinks(User user) {
 
diff --git a/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java b/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java
index 1473782..b593bce 100644
--- a/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java
+++ b/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java
@@ -26,8 +26,6 @@
 import java.util.List;
 
 /**
- *
- *
  * Created by hanl on 7/14/14.
  */
 public class OAuthDb {
@@ -64,7 +62,8 @@
                         }
                     });
         }catch (EmptyResultDataAccessException ex) {
-            errorLogger.error("no client found", ex.fillInStackTrace());
+            errorLogger.error("'{}' client found", clientid,
+                    ex.fillInStackTrace());
             return null;
         }
     }
diff --git a/src/main/java/de/ids_mannheim/korap/handlers/ResourceDao.java b/src/main/java/de/ids_mannheim/korap/handlers/ResourceDao.java
index 62c5839..53c89fc 100644
--- a/src/main/java/de/ids_mannheim/korap/handlers/ResourceDao.java
+++ b/src/main/java/de/ids_mannheim/korap/handlers/ResourceDao.java
@@ -7,9 +7,10 @@
 import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
 import de.ids_mannheim.korap.resources.KustvaktResource;
 import de.ids_mannheim.korap.resources.ResourceFactory;
+import de.ids_mannheim.korap.user.Attributes;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.KustvaktLogger;
-import de.ids_mannheim.korap.utils.TimeUtils;
+import de.ids_mannheim.korap.utils.SqlBuilder;
 import org.slf4j.Logger;
 import org.springframework.dao.DataAccessException;
 import org.springframework.dao.IncorrectResultSizeDataAccessException;
@@ -18,8 +19,8 @@
 import org.springframework.jdbc.support.GeneratedKeyHolder;
 import org.springframework.jdbc.support.KeyHolder;
 
-import java.sql.Timestamp;
 import java.util.Collection;
+import java.util.HashMap;
 import java.util.List;
 
 /**
@@ -124,11 +125,18 @@
         KeyHolder holder = new GeneratedKeyHolder();
         // parent_id necessary so trigger can be used for tree insert!
         final String sql, parid;
+        SqlBuilder b = new SqlBuilder("resource_store");
+        b.insert(Attributes.NAME, Attributes.PARENT_ID,
+                Attributes.PERSISTENT_ID, Attributes.DESCRIPTION,
+                Attributes.CREATOR, Attributes.TYPE, Attributes.CREATED);
+        b.params(":name, :parent, :pid, :desc, :ow, :type, :created");
+
         if (resource.getParentID() == null) {
             sql = "INSERT INTO resource_store (name, parent_id, persistent_id, description, creator, type, created) "
                     + "VALUES (:name, :parent, :pid, :desc, :ow, :type, :created);";
             parid = null;
         }else {
+            // fixme: use trigger for consistency check!
             sql = "INSERT INTO resource_store (name, parent_id, persistent_id, description, creator, type, created) "
                     + "select :name, id, :pid, :desc, :ow, :type, :created from resource_store where persistent_id=:parent;";
             parid = resource.getParentID();
@@ -141,8 +149,7 @@
         source.addValue("desc", resource.getDescription());
         source.addValue("type",
                 ResourceFactory.getResourceMapping(resource.getClass()));
-        source.addValue("created",
-                new Timestamp(TimeUtils.getNow().getMillis()));
+        source.addValue("created", System.currentTimeMillis());
         try {
             this.jdbcTemplate
                     .update(sql, source, holder, new String[] { "id" });
@@ -164,9 +171,18 @@
         try {
             return this.jdbcTemplate.update(sql, source);
         }catch (DataAccessException e) {
-            e.printStackTrace();
             throw new dbException(user.getId(), "resource_store",
                     StatusCodes.DB_DELETE_FAILED, id);
         }
     }
+
+    @Override
+    public int deleteAll() throws KustvaktException {
+        final String sql = "DELETE FROM resource_store;";
+        try {
+            return this.jdbcTemplate.update(sql, new HashMap<String, Object>());
+        }catch (DataAccessException e) {
+            throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
+        }
+    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/handlers/RowMapperFactory.java b/src/main/java/de/ids_mannheim/korap/handlers/RowMapperFactory.java
index 9ace5a5..b30d1bf 100644
--- a/src/main/java/de/ids_mannheim/korap/handlers/RowMapperFactory.java
+++ b/src/main/java/de/ids_mannheim/korap/handlers/RowMapperFactory.java
@@ -60,13 +60,12 @@
             user.setPassword(rs.getString(Attributes.PASSWORD));
             user.setId(rs.getInt(Attributes.ID));
             user.setAccountLocked(rs.getBoolean(Attributes.ACCOUNTLOCK));
-            user.setAccountCreation(
-                    rs.getTimestamp(Attributes.ACCOUNT_CREATION).getTime());
+            user.setAccountCreation(rs.getLong(Attributes.ACCOUNT_CREATION));
             user.setAccountLink(rs.getString(Attributes.ACCOUNTLINK));
+            long l = rs.getLong(Attributes.URI_EXPIRATION);
 
-            Timestamp exp = rs.getTimestamp(Attributes.URI_EXPIRATION);
             URIParam param = new URIParam(rs.getString(Attributes.URI_FRAGMENT),
-                    exp == null ? -1 : exp.getTime());
+                    l == 0 ? -1 : new Timestamp(l).getTime());
             user.addField(param);
             return user;
         }
@@ -127,11 +126,11 @@
                 throws SQLException {
             VirtualCollection c = ResourceFactory
                     .getCollection(rs.getInt("id"), false);
-            c.setPersistentID(rs.getString("persistentId"));
+            c.setPersistentID(rs.getString("persistent_id"));
             c.setCreated(rs.getTimestamp("created").getTime());
             c.setName(rs.getString("name"));
             c.setDescription(rs.getString("description"));
-            c.setOwner(rs.getInt("userId"));
+            c.setOwner(rs.getInt("user_id"));
             c.setQuery(rs.getString("query"));
             c.checkNull();
             return c;
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java
index c6d1bee..f0df181 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java
@@ -1,7 +1,10 @@
 package de.ids_mannheim.korap.interfaces;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.user.*;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.user.UserDetails;
+import de.ids_mannheim.korap.user.UserSettings;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -21,15 +24,16 @@
 
     public void setProviders(Set<AuthenticationIface> providers) {
         for (AuthenticationIface i : providers)
-            this.providers.put(i.getIdentifier(), i);
+            this.providers.put(i.getIdentifier().toUpperCase(), i);
     }
 
-    protected AuthenticationIface getProvider(String key) {
-        AuthenticationIface iface;
-        if (key == null)
-            iface = this.providers.get(Attributes.API_AUTHENTICATION);
-        else
-            iface = this.providers.get(key.toUpperCase());
+    protected AuthenticationIface getProvider(String key,
+            String default_iface) {
+        AuthenticationIface iface = this.providers
+                .get(key != null ? key.toUpperCase() : "NONE");
+        // todo: configurable authentication schema
+        if (iface == null)
+            iface = this.providers.get(default_iface);
         return iface;
     }
 
@@ -50,15 +54,15 @@
 
     public abstract void lockAccount(User user) throws KustvaktException;
 
-    public abstract User createUserAccount(Map<String, Object> attributes)
-            throws KustvaktException;
+    public abstract User createUserAccount(Map<String, Object> attributes,
+            boolean conf_required) throws KustvaktException;
 
     public abstract boolean updateAccount(User user) throws KustvaktException;
 
     public abstract boolean deleteAccount(User user) throws KustvaktException;
 
-    public abstract UserDetails getUserDetails(User user) throws
-            KustvaktException;
+    public abstract UserDetails getUserDetails(User user)
+            throws KustvaktException;
 
     public abstract UserSettings getUserSettings(User user)
             throws KustvaktException;
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java
index 15e4296..e563f58 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java
@@ -55,6 +55,7 @@
      * @param perm
      * @return
      */
+    // todo: refactor
     List<SecurityPolicy>[] findPolicies(String path, User user, Byte perm);
 
     /**
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java
index 260e928..e509b61 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java
@@ -39,4 +39,6 @@
     //    public void deleteResource(Integer id, User user) throws KorAPException;
     int deleteResource(String id, User user) throws KustvaktException;
 
+    int deleteAll() throws KustvaktException;
+
 }
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java b/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java
index d4b8a31..f341afe 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java
@@ -367,17 +367,18 @@
     @Override
     public String validatePassphrase(String pw) throws KustvaktException {
         String safe_string = validateString(pw);
-        String pw_conf;
-        try {
-            pw_conf = validator
-                    .getValidInput("User Password", safe_string, "Password", 20,
-                            false);
-        }catch (ValidationException e) {
-            jlog.error("password value did not validate", e.getMessage());
-            throw new KustvaktException(StatusCodes.PARAMETER_VALIDATION_ERROR,
-                    "password did not validate", "password");
-        }
-        return pw_conf;
+        return safe_string;
+//        String pw_conf;
+//        try {
+//            pw_conf = validator
+//                    .getValidInput("User Password", safe_string, "Password", 20,
+//                            false);
+//        }catch (ValidationException e) {
+//            jlog.error("password value did not validate", e.getMessage());
+//            throw new KustvaktException(StatusCodes.PARAMETER_VALIDATION_ERROR,
+//                    "password did not validate", "password");
+//        }
+//        return pw_conf;
     }
 
     //FIXME: currently all sets are skipped during validation (since users should not be allowed to edit those sets anyway,
diff --git a/src/main/java/de/ids_mannheim/korap/resource/CollectionProcessor.java b/src/main/java/de/ids_mannheim/korap/resource/CollectionProcessor.java
deleted file mode 100644
index b1e13d4..0000000
--- a/src/main/java/de/ids_mannheim/korap/resource/CollectionProcessor.java
+++ /dev/null
@@ -1,9 +0,0 @@
-package de.ids_mannheim.korap.resource;
-
-/**
- * @author hanl
- * @date 19/06/2015
- */
-@Deprecated
-public class CollectionProcessor {
-}
diff --git a/src/main/java/de/ids_mannheim/korap/resource/LayerProcessor.java b/src/main/java/de/ids_mannheim/korap/resource/LayerProcessor.java
deleted file mode 100644
index dab1914..0000000
--- a/src/main/java/de/ids_mannheim/korap/resource/LayerProcessor.java
+++ /dev/null
@@ -1,54 +0,0 @@
-package de.ids_mannheim.korap.resource;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import de.ids_mannheim.korap.config.KustvaktConfiguration;
-
-import java.util.Iterator;
-
-/**
- * @author hanl
- * @date 19/06/2015
- */
-@Deprecated
-public class LayerProcessor extends NodeProcessor {
-
-    private LayerMapper mapper;
-
-    public LayerProcessor(KustvaktConfiguration config) {
-        this.mapper = new LayerMapper(config);
-    }
-
-    @Override
-    public JsonNode process(JsonNode node) {
-        if (node.at("/query/wrap/@type").asText().equals("koral:term")) {
-            JsonNode n = node.at("/query/wrap");
-            if (n.path("foundry").isMissingNode()) {
-                String layer = n.path("layer").asText();
-                ObjectNode obj = (ObjectNode) n;
-                obj.put("foundry", mapper.findFoundry(layer));
-            }
-        }else if (node.at("/query/wrap/@type").asText()
-                .equals("koral:termGroup")) {
-            processTermGroup(node.at("/query/wrap/operands"));
-        }
-        return node;
-    }
-
-    private JsonNode processTermGroup(JsonNode node) {
-        Iterator<JsonNode> nodes = node.elements();
-        while (nodes.hasNext()) {
-            JsonNode n = nodes.next();
-            if (n.path("@type").asText().equals("koral:termGroup"))
-                n = processTermGroup(n.path("operands"));
-
-            if (n.path("@type").asText().equals("koral:term") && n
-                    .path("foundry").isMissingNode()) {
-                String layer = n.path("layer").asText();
-                ObjectNode obj = (ObjectNode) n;
-                obj.put("foundry", mapper.findFoundry(layer));
-            }
-        }
-        return node;
-    }
-}
diff --git a/src/main/java/de/ids_mannheim/korap/resource/NodeProcessor.java b/src/main/java/de/ids_mannheim/korap/resource/NodeProcessor.java
deleted file mode 100644
index c2ed5b1..0000000
--- a/src/main/java/de/ids_mannheim/korap/resource/NodeProcessor.java
+++ /dev/null
@@ -1,14 +0,0 @@
-package de.ids_mannheim.korap.resource;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-/**
- * @author hanl
- * @date 19/06/2015
- */
-@Deprecated
-public abstract class NodeProcessor {
-
-    public abstract JsonNode process(JsonNode node);
-
-}
diff --git a/src/main/java/de/ids_mannheim/korap/resource/RewriteProcessor.java b/src/main/java/de/ids_mannheim/korap/resource/RewriteProcessor.java
deleted file mode 100644
index af44cb8..0000000
--- a/src/main/java/de/ids_mannheim/korap/resource/RewriteProcessor.java
+++ /dev/null
@@ -1,41 +0,0 @@
-package de.ids_mannheim.korap.resource;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import de.ids_mannheim.korap.config.KustvaktConfiguration;
-import de.ids_mannheim.korap.utils.JsonUtils;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * @author hanl
- * @date 19/06/2015
- */
-@Deprecated
-public class RewriteProcessor {
-
-    private KustvaktConfiguration config;
-    private List<NodeProcessor> processors;
-
-    public RewriteProcessor(KustvaktConfiguration config) {
-        this.config = config;
-        this.processors = new ArrayList<>();
-        addProcessor(new LayerProcessor(config));
-    }
-
-    public JsonNode process(JsonNode node) {
-        for (NodeProcessor p : this.processors)
-            node = p.process(node);
-        return node;
-    }
-
-    public String process(String json) {
-        JsonNode node = JsonUtils.readTree(json);
-        return JsonUtils.toJSON(process(node));
-    }
-
-    public void addProcessor(NodeProcessor processor) {
-        this.processors.add(processor);
-    }
-
-}
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
index d1630dd..7c9daae 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
@@ -33,7 +33,7 @@
      * @return boolean if true access granted
      */
     private boolean check(KoralNode node, User user) {
-        // todo: can be used to circumvent access control!
+        // todo: can be used to circumvent access control if public filter not applied
         if (user == null)
             return true;
 
@@ -44,10 +44,8 @@
                     .findbyId(id, user, Corpus.class);
             corpus = m.getResource();
         }catch (RuntimeException | KustvaktException e) {
-            e.printStackTrace();
             return false;
         }
-
         return corpus != null;
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
index 03b77ec..4cdd1a6 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
@@ -14,14 +14,13 @@
  * @author hanl
  * @date 04/07/2015
  */
-// todo: 11.11.15
 public class PublicCollection implements RewriteTask.RewriteNodeAt {
 
     public PublicCollection() {
         super();
     }
 
-    // todo: where to inject the array node into? --> super group with and relation plus subgroup with ids and or operation
+    // todo: where to inject the array node into? --> super group with and relation plus subgroup with ids and or operator
     @Override
     public JsonNode preProcess(KoralNode node, KustvaktConfiguration config,
             User user) {
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
index b16d65c..7123ef6 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
@@ -24,9 +24,6 @@
     private Collection<RewriteTask.RewriteKoralToken> token_node_processors;
     private Collection<RewriteTask> query_processors;
 
-    //    private Collection<RewriteTask.RewriteNode2> fixed_nodes;
-    //    private Collection<RewriteTask.IterableRewrite> iterable_nodes;
-
     private Set<Class> failed_task_registration;
 
     private KustvaktConfiguration config;
@@ -55,21 +52,6 @@
         return false;
     }
 
-    public boolean addProcessor2(RewriteTask rewriteTask) {
-        //        if (rewriteTask instanceof RewriteTask.RewriteNode2)
-        //            return this.fixed_nodes.add((RewriteTask.RewriteNode2) rewriteTask);
-        //        else if (rewriteTask instanceof RewriteTask.IterableRewrite)
-        //            return this.iterable_nodes
-        //                    .add((RewriteTask.IterableRewrite) rewriteTask);
-        //        else if (rewriteTask instanceof RewriteTask.RewriteBefore)
-        // gets the entire pre processed query injected.
-        return false;
-    }
-
-    public final Collection<Class> getFailedHandlers() {
-        return this.failed_task_registration;
-    }
-
     @Override
     public String toString() {
         StringBuilder b = new StringBuilder();
diff --git a/src/main/java/de/ids_mannheim/korap/resources/Corpus.java b/src/main/java/de/ids_mannheim/korap/resources/Corpus.java
index 6c8dd75..7266646 100755
--- a/src/main/java/de/ids_mannheim/korap/resources/Corpus.java
+++ b/src/main/java/de/ids_mannheim/korap/resources/Corpus.java
@@ -30,14 +30,13 @@
 
     public Corpus(String pers_id, int creator) {
         super(pers_id, creator);
-        // deprecated
-        this.setName(pers_id);
     }
 
     @Override
     public Map toMap() {
         Map res = super.toMap();
-        res.put("statistics", stats);
+        if (stats != null && !stats.isEmpty())
+            res.put("statistics", stats);
         return res;
     }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/resources/KustvaktResource.java b/src/main/java/de/ids_mannheim/korap/resources/KustvaktResource.java
index ba76ad2..0c99e36 100644
--- a/src/main/java/de/ids_mannheim/korap/resources/KustvaktResource.java
+++ b/src/main/java/de/ids_mannheim/korap/resources/KustvaktResource.java
@@ -54,6 +54,7 @@
         this.parentID = null;
     }
 
+    // todo: move creator to builder instance for policies
     public KustvaktResource(String persistentID, int creator) {
         this();
         this.owner = creator;
@@ -135,11 +136,13 @@
         Map m = new HashMap();
         m.put("id", persistentID);
         m.put("name", name);
-        m.put("path", path);
+        //todo: fix!
+//        m.put("path", path);
         m.put("description", description);
         m.put("created", TimeUtils.format(new DateTime(created)));
-        m.put("managed", managed);
-        m.put("shared", shared);
+        // deprecated
+//        m.put("managed", managed);
+//        m.put("shared", shared);
         return m;
     }
 
@@ -155,6 +158,7 @@
                 '}';
     }
 
+    //fixme: make private in respective areas
     @Getter
     public static class Container {
         private final Class type;
diff --git a/src/main/java/de/ids_mannheim/korap/resources/Permissions.java b/src/main/java/de/ids_mannheim/korap/resources/Permissions.java
index f039c61..8602c0f 100644
--- a/src/main/java/de/ids_mannheim/korap/resources/Permissions.java
+++ b/src/main/java/de/ids_mannheim/korap/resources/Permissions.java
@@ -6,9 +6,9 @@
  */
 public class Permissions {
 
-   public static enum PERMISSIONS {
+    public enum PERMISSIONS {
         //fixme: add read_policy permission to allow read policy permissions
-        READ, WRITE, DELETE, READ_POLICY, CREATE_POLICY, MODIFY_POLICY, DELETE_POLICY
+        READ, WRITE, DELETE, READ_POLICY, CREATE_POLICY, MODIFY_POLICY, DELETE_POLICY, ALL
     }
 
     public static final byte READ = 1;
@@ -18,7 +18,7 @@
     public static final byte CREATE_POLICY = 16;
     public static final byte MODIFY_POLICY = 32;
     public static final byte DELETE_POLICY = 64;
-
+    public static final byte ALL = 127;
 
     public static Byte getByte(PERMISSIONS perm) {
         switch (perm) {
@@ -36,10 +36,11 @@
                 return MODIFY_POLICY;
             case CREATE_POLICY:
                 return CREATE_POLICY;
+            case ALL:
+                return ALL;
             default:
                 return 0;
         }
     }
 
-
 }
diff --git a/src/main/java/de/ids_mannheim/korap/resources/ResourceFactory.java b/src/main/java/de/ids_mannheim/korap/resources/ResourceFactory.java
index 1148ac0..ac9f9d2 100755
--- a/src/main/java/de/ids_mannheim/korap/resources/ResourceFactory.java
+++ b/src/main/java/de/ids_mannheim/korap/resources/ResourceFactory.java
@@ -65,7 +65,7 @@
 //            else if (value == UserQuery.class && type.equalsIgnoreCase("query"))
 //                return (Class<T>) UserQuery.class;
             else if (value.getSimpleName().equalsIgnoreCase(type.trim())) {
-                return value; // do nothing
+                return value;
             }
         }
         return null;
@@ -95,9 +95,8 @@
 
     public static VirtualCollection createCollection(String name, String query,
             Integer owner) {
-        VirtualCollection v = new VirtualCollection();
+        VirtualCollection v = new VirtualCollection(query);
         v.setName(name);
-        v.setQuery(query);
         v.setOwner(owner);
         return v;
     }
diff --git a/src/main/java/de/ids_mannheim/korap/resources/VirtualCollection.java b/src/main/java/de/ids_mannheim/korap/resources/VirtualCollection.java
index c4d74e2..e48ee50 100755
--- a/src/main/java/de/ids_mannheim/korap/resources/VirtualCollection.java
+++ b/src/main/java/de/ids_mannheim/korap/resources/VirtualCollection.java
@@ -88,7 +88,8 @@
     public Map toMap() {
         Map res = super.toMap();
         res.put("query", JsonUtils.readTree(query));
-        res.put("statistics", stats);
+        if (stats != null && !stats.isEmpty())
+            res.put("statistics", stats);
         return res;
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java
index 47faa2e..4fb533b 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java
@@ -30,6 +30,10 @@
 
     public PolicyBuilder(User user) {
         this.user = user;
+
+        // fixme: other exception!?
+        if (this.user.getId() == -1)
+            throw new RuntimeException("user id must be set");
     }
 
     public PolicyBuilder setResources(KustvaktResource... targets) {
@@ -108,7 +112,7 @@
     }
 
     // for and relations there is no way of setting parameters conjoined with the policy
-    private void doIt() throws KustvaktException, NotAuthorizedException {
+    private void doIt() throws NotAuthorizedException, KustvaktException {
         if (this.resources == null)
             throw new KustvaktException(user.getId(),
                     StatusCodes.ILLEGAL_ARGUMENT, "resource must be set",
@@ -125,7 +129,8 @@
             this.rel = Relation.AND;
 
         for (int idx = 0; idx < this.resources.length; idx++) {
-            resources[idx].setParentID(parents[idx].getPersistentID());
+            if (parents[idx] != null)
+                resources[idx].setParentID(parents[idx].getPersistentID());
             SecurityManager manager = SecurityManager
                     .register(resources[idx], user);
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
index 4524696..33dc18d 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
@@ -213,7 +213,7 @@
                         +
                         "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
                         +
-                        "(select sum(distinct res.depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users as g "
+                        "(select sum(distinct res.depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users as g "
                         +
                         "where g.user_id=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id);";
 
@@ -229,7 +229,7 @@
                     });
         }catch (DataAccessException e) {
             KustvaktLogger.SECURITY_LOGGER
-                    .error("Permission Denied for retrieval for '{}' for user '{}'",
+                    .error("Permission Denied for policy retrieval for '{}' for user '{}'",
                             target, user.getId());
             return new List[2];
         }
@@ -247,19 +247,20 @@
         // fixme: missing constraint of user group membership!
         String sql_new = "select pv.*, pv.perm & :perm as allowed, " +
                 "rh.depth, (select max(depth) from resource_tree " +
-                "where child_id=rh.child_id) as max_depth from p_view as pv " +
+                "where child_id=rh.child_id) as max_depth from policy_view as pv "
+                +
                 "inner join resource_tree as rh on rh.parent_id=pv.id " +
-                "where rh.child_id=(select id from resource_store where persistentID=:target) and "
+                "where rh.child_id=(select id from resource_store where persistent_id=:target) and "
                 +
                 "pv.enable <= :en and (pv.expire > :en or pv.expire is NULL) and "
                 +
-                "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.userid=:userid)) and "
+                "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid)) and "
                 +
                 "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
                 +
-                "(select sum(distinct res.depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
+                "(select sum(distinct res.depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
                 +
-                "as g where g.userid=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
+                "as g where g.user_id=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
 
         try {
             return this.jdbcTemplate.query(sql_new, param,
@@ -273,7 +274,7 @@
                     });
         }catch (DataAccessException e) {
             KustvaktLogger.SECURITY_LOGGER
-                    .error("Permission Denied for retrieval for '{}' for user '{}'",
+                    .error("Permission Denied for policy retrieval for '{}' for user '{}'",
                             target, user.getId());
             return new List[2];
         }
@@ -290,18 +291,19 @@
 
         String sql_new = "select pv.*, pv.perm & :perm as allowed, " +
                 "rh.depth, (select max(depth) from resource_tree " +
-                "where child_id=rh.child_id) as max_depth from p_view as pv " +
+                "where child_id=rh.child_id) as max_depth from policy_view as pv "
+                +
                 "inner join resource_tree as rh on rh.parent_id=pv.id " +
                 "where rt.name_path regexp :path and " +
                 "pv.enable <= :en and (pv.expire > :en or pv.expire is NULL) and "
                 +
-                "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.userid=:userid)) and "
+                "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid)) and "
                 +
                 "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
                 +
-                "(select sum(distinct res.depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
+                "(select sum(distinct res.depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
                 +
-                "as g where g.userid=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
+                "as g where g.user_id=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
 
         try {
             return this.jdbcTemplate.query(sql_new, param,
@@ -315,7 +317,7 @@
                     });
         }catch (DataAccessException e) {
             KustvaktLogger.SECURITY_LOGGER
-                    .error("Permission Denied for retrieval for '{}' for user '{}'",
+                    .error("Permission Denied for retrieval for resource id '{}' for user '{}'",
                             path, user.getId());
             return new List[2];
         }
@@ -331,7 +333,8 @@
     // todo: does not concern itsself with location matching, ever!
     @Override
     public List<KustvaktResource.Container> getDescending(String path,
-            final User user, Byte b, final Class<? extends KustvaktResource> clazz)
+            final User user, Byte b,
+            final Class<? extends KustvaktResource> clazz)
             throws KustvaktException {
         final MapSqlParameterSource param = new MapSqlParameterSource();
         param.addValue("userid", user.getId());
@@ -343,49 +346,49 @@
         if (path != null && !path.isEmpty()) {
             sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path, (select max(depth) from resource_tree \n"
                     +
-                    "where child_id=rh.child_id) as max_depth from p_view as pv "
+                    "where child_id=rh.child_id) as max_depth from policy_view as pv "
                     +
                     "inner join resource_tree as rh on rh.child_id=pv.id " +
                     "where pv.type=:type and (rh.name_path like :part) and ((pv.creator=:userid and pv.group_id='self') or "
                     +
-                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and "
+                    "(pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid) and "
                     +
                     "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
                     +
-                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id "
+                    "(select sum(distinct depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id "
                     +
-                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid) "
+                    "where pos.group_id in (select g.group_id from group_users as g where g.user_id=:userid) "
                     +
                     "and res.child_id=rh.child_id group by child_id))) " +
                     "group by pv.pid, pv.id having count(distinct pv.group_id) = "
                     +
-                    "((select count(co.group_id) from group_ref as co where co.policyid=pv.pid) or "
+                    "((select count(co.group_id) from group_ref as co where co.policy_id=pv.pid) or "
                     +
-                    "(select 1 from p_view as cp2 where cp2.group_id='self' and cp2.id=pv.id)) "
+                    "(select 1 from policy_view as cp2 where cp2.group_id='self' and cp2.id=pv.id)) "
                     +
                     "order by rh.depth asc, pv.id desc;";
         }else {
             sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path, (select max(depth) from resource_tree \n"
                     +
-                    "where child_id=rh.child_id) as max_depth from p_view as pv "
+                    "where child_id=rh.child_id) as max_depth from policy_view as pv "
                     +
                     "inner join resource_tree as rh on rh.child_id=pv.id " +
                     "where pv.type=:type and ((pv.creator=:userid and pv.group_id='self') or "
                     +
-                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and "
+                    "(pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid) and "
                     +
                     "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
                     +
-                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id "
+                    "(select sum(distinct depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id "
                     +
-                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid) "
+                    "where pos.group_id in (select g.group_id from group_users as g where g.user_id=:userid) "
                     +
                     "and res.child_id=rh.child_id group by child_id))) " +
                     "group by pv.pid, pv.id having count(distinct pv.group_id) = "
                     +
-                    "((select count(co.group_id) from group_ref as co where co.policyid=pv.pid) or "
+                    "((select count(co.group_id) from group_ref as co where co.policy_id=pv.pid) or "
                     +
-                    "(select 1 from p_view as cp2 where cp2.group_id='self' and cp2.id=pv.id)) "
+                    "(select 1 from policy_view as cp2 where cp2.group_id='self' and cp2.id=pv.id)) "
                     +
                     "order by rh.depth asc, pv.id desc;";
         }
@@ -416,52 +419,52 @@
             sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path,\n"
                     +
                     "(select max(depth) from resource_tree \n" +
-                    "where child_id=rh.child_id) as max_depth from p_view as pv\n"
+                    "where child_id=rh.child_id) as max_depth from policy_view as pv\n"
                     +
                     "inner join resource_tree as rh on rh.child_id=pv.id\n" +
                     "where pv.id in (select rt.parent_id from resource_tree as rt inner join resource_store rs on rs.id=rt.child_id\n"
                     +
                     "where rs.type=:type and rt.name_path like :part) and ((pv.creator=:userid and pv.group_id='self') or\n"
                     +
-                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and\n"
+                    "(pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid) and\n"
                     +
                     "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) =\n"
                     +
-                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id\n"
+                    "(select sum(distinct depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id\n"
                     +
-                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid)\n"
+                    "where pos.group_id in (select g.group_id from group_users as g where g.user_id=:userid)\n"
                     +
                     "and res.child_id=rh.child_id group by child_id)))\n" +
                     "group by pv.pid, pv.id having count(distinct pv.group_id) = \n"
                     +
                     "case when pv.creator=:userid then 1 else (select count(distinct co.group_id) "
                     +
-                    "from group_ref as co where co.policyid=pv.pid) end order by rh.depth desc, pv.id desc;";
+                    "from group_ref as co where co.policy_id=pv.pid) end order by rh.depth desc, pv.id desc;";
         }else {
             sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path,\n"
                     +
                     "(select max(depth) from resource_tree \n" +
-                    "where child_id=rh.child_id) as max_depth from p_view as pv\n"
+                    "where child_id=rh.child_id) as max_depth from policy_view as pv\n"
                     +
                     "inner join resource_tree as rh on rh.child_id=pv.id\n" +
                     "where pv.id in (select rt.parent_id from resource_tree as rt inner join resource_store rs on rs.id=rt.child_id\n"
                     +
                     "where rs.type=:type) and ((pv.creator=:userid and pv.group_id='self') or\n"
                     +
-                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and\n"
+                    "(pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid) and\n"
                     +
                     "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) =\n"
                     +
-                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.target_id\n"
+                    "(select sum(distinct depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.target_id\n"
                     +
-                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid)\n"
+                    "where pos.group_id in (select g.group_id from group_users as g where g.user_id=:userid)\n"
                     +
                     "and res.child_id=rh.child_id group by child_id)))\n" +
                     "group by pv.pid, pv.id having count(distinct pv.group_id) = \n"
                     +
                     "case when pv.creator=:userid then 1 else (select count(distinct co.group_id) "
                     +
-                    "from group_ref as co where co.policyid=pv.pid) end order by rh.depth desc, pv.id desc;";
+                    "from group_ref as co where co.policy_id=pv.pid) end order by rh.depth desc, pv.id desc;";
         }
         try {
             return this.jdbcTemplate.query(sql, param,
@@ -488,7 +491,7 @@
 
         try {
             this.jdbcTemplate
-                    .update("DELETE FROM group_ref WHERE policyid=:id", param);
+                    .update("DELETE FROM group_ref WHERE policy_id=:id", param);
             return this.jdbcTemplate
                     .update("DELETE FROM policy_store WHERE id=:id", param);
         }catch (DataAccessException e) {
@@ -580,14 +583,14 @@
         param.addValue("isadmin", BooleanUtils.getBoolean(owner));
         String sql;
         if (owner) {
-            sql = "SELECT COUNT(*) FROM group_users AS gu INNER JOIN groupolicy_store AS gs "
+            sql = "SELECT COUNT(*) FROM group_users AS gu INNER JOIN group_store AS gs "
                     +
-                    "ON gs.name=gu.group_id WHERE gu.userID=:userid " +
+                    "ON gs.name=gu.group_id WHERE gu.user_id=:userid " +
                     "AND gs.name=:group AND gu.admin=:isadmin;";
         }else {
-            sql = "SELECT COUNT(*) FROM group_users AS gu INNER JOIN groupolicy_store AS gs "
+            sql = "SELECT COUNT(*) FROM group_users AS gu INNER JOIN group_store AS gs "
                     +
-                    "ON gs.name=gu.group_id WHERE gu.userID=:userid " +
+                    "ON gs.name=gu.group_id WHERE gu.user_id=:userid " +
                     "AND gs.name=:group;";
         }
 
@@ -626,11 +629,12 @@
         }
     }
 
+    //
     @Override
     public int addToCondition(String username, PolicyCondition condition,
             boolean admin) throws KustvaktException {
         final String insert =
-                "INSERT INTO group_users (userID, group_id, admin) " +
+                "INSERT INTO group_users (user_id, group_id, admin) " +
                         "VALUES ((SELECT id FROM korap_users " +
                         "WHERE username=:username), :group, :status);";
         try {
@@ -654,7 +658,7 @@
      * @param admin
      * @return
      * @throws KustvaktException userID and group_id have a unique constraint,
-     *                        thus: if any of the supplied users is already a member of the group, the entire chain will be broken!
+     *                           thus: if any of the supplied users is already a member of the group, the entire chain will be broken!
      */
     //todo definitely needs rework
     //todo: test the unique index constraints!
@@ -715,7 +719,7 @@
         }
 
         final String del =
-                "DELETE FROM group_users WHERE group_id=:group AND userID=(SELECT id FROM "
+                "DELETE FROM group_users WHERE group_id=:group AND user_id=(SELECT id FROM "
                         + "korap_users WHERE username=:username);";
 
         try {
@@ -739,7 +743,7 @@
         if (!parameterExists(param.getName()))
             createParameter(param.getName(), "", param.getOwner());
         final String insert =
-                "INSERT INTO param_map (paramID, policy_id, value, flag) VALUES ((SELECT id FROM param_store "
+                "INSERT INTO param_map (param_id, policy_id, value, flag) VALUES ((SELECT id FROM param_store "
                         + "WHERE p_key=:key), (SELECT id FROM policy_store WHERE id=:policy), :value, :flag);";
         try {
             this.jdbcTemplate.update(insert, source);
@@ -762,7 +766,6 @@
         try {
             return this.jdbcTemplate.queryForList(sql1, source, String.class);
         }catch (DataAccessException e) {
-            e.printStackTrace();
             KustvaktLogger.SECURITY_LOGGER
                     .error("Operation (SELECT) not possible for '{}'",
                             condition.toString());
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyEvaluator.java b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyEvaluator.java
index 5a311da..745ef1f 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyEvaluator.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyEvaluator.java
@@ -30,6 +30,7 @@
     private PermissionsBuffer permissions;
     private boolean processed;
     private int relationError = -1;
+    @Deprecated
     private Map<String, Object> flags;
 
     public PolicyEvaluator(User user, List<SecurityPolicy>[] policies) {
@@ -59,6 +60,7 @@
             Permissions.PERMISSIONS perm) throws NotAuthorizedException {
         //fixme: what happens in case a parent relation does not allow changing a resource, but the owner of child per default
         //todo: receives all rights? --> test casing
+        jlog.error("IS USER RESOURCE OWNER? " + isOwner());
         if (isOwner()) {
             jlog.debug("Resource is owned by the user!");
             return policies[0];
@@ -86,6 +88,7 @@
                         idx++;
                     }
                 }
+                // fixme: what is that?
                 if (idx == 0) {
                     relationError = i;
                     throw new NotAuthorizedException(
@@ -119,8 +122,8 @@
 
     public boolean isAllowed(Permissions.PERMISSIONS perm) {
         try {
-            System.out.println("THESE POLICIES " + this.policies[0]);
-            return !evaluate(this.policies, perm).isEmpty();
+            List s = evaluate(this.policies, perm);
+            return s != null && !s.isEmpty();
         }catch (NotAuthorizedException e) {
             return false;
         }
@@ -140,6 +143,7 @@
     }
 
     // todo: what is this supposed to do?
+    @Deprecated
     public static PolicyEvaluator setFlags(User user,
             KustvaktResource resource) {
         PolicyEvaluator e = new PolicyEvaluator(user, resource);
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
index bd465b5..d2607cc 100755
--- a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
@@ -18,8 +18,8 @@
  */
 public class ResourceFinder {
 
-    private static final Logger log = KustvaktLogger.getLogger(
-            ResourceFinder.class);
+    private static final Logger log = KustvaktLogger
+            .getLogger(ResourceFinder.class);
     private static PolicyHandlerIface policydao;
 
     private List<KustvaktResource.Container> containers;
@@ -28,23 +28,28 @@
     private ResourceFinder(User user) {
         this.containers = new ArrayList<>();
         this.user = user;
+        checkProviders();
     }
 
-    public static final void setProviders(PolicyHandlerIface policyHandler, ResourceHandler handler) {
+    private static void checkProviders() {
+        if (policydao == null)
+            throw new RuntimeException("provider not set!");
+    }
+
+    public static void setProviders(PolicyHandlerIface policyHandler) {
         ResourceFinder.policydao = policyHandler;
-//        ResourceFinder.handler = handler;
     }
 
-    public static <T extends KustvaktResource> Set<T> search(String path, boolean asParent,
-                                                          User user, Class<T> clazz, Permissions.PERMISSIONS... perms)
-            throws KustvaktException {
+    public static <T extends KustvaktResource> Set<T> search(String path,
+            boolean asParent, User user, Class<T> clazz,
+            Permissions.PERMISSIONS... perms) throws KustvaktException {
         ResourceFinder cat = init(path, asParent, user, clazz, perms);
         return cat.getResources();
     }
 
-    private static <T extends KustvaktResource> ResourceFinder init(String path, boolean asParent,
-                                                                User user, Class<T> clazz, Permissions.PERMISSIONS... perms) throws
-            KustvaktException {
+    private static <T extends KustvaktResource> ResourceFinder init(String path,
+            boolean asParent, User user, Class<T> clazz,
+            Permissions.PERMISSIONS... perms) throws KustvaktException {
         ResourceFinder cat = new ResourceFinder(user);
         PermissionsBuffer buffer = new PermissionsBuffer();
         if (perms.length == 0)
@@ -55,25 +60,27 @@
     }
 
     //todo: needs to be much faster!
-    public static <T extends KustvaktResource> ResourceFinder init(User user, Class<T> clazz)
-            throws KustvaktException {
+    public static <T extends KustvaktResource> ResourceFinder init(User user,
+            Class<T> clazz) throws KustvaktException {
         return init(null, true, user, clazz, Permissions.PERMISSIONS.READ);
     }
 
-    public static <T extends KustvaktResource> Set<T> search(String name, boolean asParent, User user, String type)
-            throws KustvaktException {
-        return (Set<T>) search(name, asParent, user, ResourceFactory
-                .getResourceClass(type), Permissions.PERMISSIONS.READ);
+    public static <T extends KustvaktResource> Set<T> search(String name,
+            boolean asParent, User user, String type) throws KustvaktException {
+        return (Set<T>) search(name, asParent, user,
+                ResourceFactory.getResourceClass(type),
+                Permissions.PERMISSIONS.READ);
     }
 
     // todo: should this be working?
-    public static <T extends KustvaktResource> Set<T> search(User user, Class<T> clazz)
-            throws KustvaktException {
+    public static <T extends KustvaktResource> Set<T> search(User user,
+            Class<T> clazz) throws KustvaktException {
         return search(null, true, user, clazz, Permissions.PERMISSIONS.READ);
     }
 
-    private void retrievePolicies(String path, Byte b, Class type, boolean parent) throws
-            KustvaktException {
+    private void retrievePolicies(String path, Byte b, Class type,
+            boolean parent) throws KustvaktException {
+        //fixme: throw exception to avoid susequent exceptions due to unknown origin
         if (user == null | type == null)
             return;
         if (parent)
@@ -82,27 +89,33 @@
             this.containers = policydao.getAscending(path, user, b, type);
     }
 
-
     public <T extends KustvaktResource> Set<T> getResources() {
         return evaluateResources();
     }
 
+    // todo: redo with less memory usage/faster
     private <T extends KustvaktResource> Set<T> evaluateResources() {
         Set<T> resources = new HashSet<>();
         if (this.containers != null) {
             for (KustvaktResource.Container c : this.containers) {
-                ResourceOperationIface<T> iface = SecurityManager.getHandlers().get(c.getType());
+                ResourceOperationIface<T> iface = SecurityManager.getHandlers()
+                        .get(c.getType());
                 if (iface == null)
-                    iface = SecurityManager.getHandlers().get(KustvaktResource.class);
+                    iface = SecurityManager.getHandlers()
+                            .get(KustvaktResource.class);
 
                 try {
-                    T resource = (T) iface.findbyId(c.getPersistentID(), this.user);
-                    PolicyEvaluator e = PolicyEvaluator.setFlags(user, resource);
+                    T resource = (T) iface
+                            .findbyId(c.getPersistentID(), this.user);
+                    PolicyEvaluator e = PolicyEvaluator
+                            .setFlags(user, resource);
                     resource.setManaged(e.getFlag("managed", false));
                     resources.add(resource);
-                } catch (KustvaktException e) {
+                }catch (KustvaktException e) {
                     // don't handle connection error or no handler registered!
-                    KustvaktLogger.ERROR_LOGGER.error("Error while retrieving containers '{}' ", this.containers);
+                    KustvaktLogger.ERROR_LOGGER
+                            .error("Error while retrieving containers '{}' ",
+                                    this.containers);
                     return Collections.emptySet();
                 }
             }
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
index ee89118..09f48b5 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
@@ -47,6 +47,7 @@
     private PolicyEvaluator evaluator;
     private T resource;
 
+    //todo: use simple user id if possible! --> or if not check that user has valid integer id (or use username as fallback instead)
     private SecurityManager(User user) {
         this.policies = new List[1];
         this.policies[0] = new ArrayList<>();
@@ -61,7 +62,7 @@
     }
 
     public static final void setProviders(PolicyHandlerIface policyHandler,
-            EncryptionIface crypto, List<ResourceOperationIface> ifaces) {
+            EncryptionIface crypto, Collection<ResourceOperationIface> ifaces) {
         SecurityManager.policydao = policyHandler;
         SecurityManager.crypto = crypto;
         SecurityManager.handlers = new HashMap<>();
@@ -170,7 +171,7 @@
      * @throws NotAuthorizedException
      * @throws KustvaktException
      */
-    // todo: delete only works with find, not with init constructor!resource
+    // todo: delete only works with find, not with init constructor!
     public void deleteResource()
             throws NotAuthorizedException, KustvaktException {
         if (evaluator.isAllowed(Permissions.PERMISSIONS.DELETE)) {
@@ -182,7 +183,9 @@
                 handlers.get(KustvaktResource.class)
                         .deleteResource(this.evaluator.getResourceID(),
                                 this.user);
-            //            this.policydao.deleteResourcePolicies(this.evaluator.getResourceID(), this.user);
+            this.policydao
+                    .deleteResourcePolicies(this.evaluator.getResourceID(),
+                            this.user);
         }else
             throw new NotAuthorizedException(StatusCodes.PERMISSION_DENIED,
                     this.evaluator.getResourceID());
@@ -205,6 +208,9 @@
         if (id instanceof Integer)
             this.policies = policydao
                     .getPolicies((Integer) id, this.user, b.getPbyte());
+        //        System.out.println("-------------------------------");
+        //        System.out.println("LENGTH OF POLICY ARRAY " + this.policies.length);
+        //        System.out.println("POLICY AT 0 " + this.policies[0]);
         this.evaluator = new PolicyEvaluator(this.user, this.policies);
 
         if (this.policies == null) {
@@ -216,6 +222,7 @@
         return true;
     }
 
+    // todo:  security log shows id 'null' --> better way?
     private T findResource(Class type)
             throws NotAuthorizedException, KustvaktException {
         if (!evaluator.isAllowed()) {
@@ -231,6 +238,7 @@
             iface = handlers.get(KustvaktResource.class);
         T resource = (T) iface
                 .findbyId(this.evaluator.getResourceID(), this.user);
+        // todo: fix this
         resource.setManaged(this.evaluator.isManaged());
         resource.setShared(this.evaluator.isShared());
         return resource;
@@ -252,13 +260,7 @@
                     // this is mostly for convenvience and database consistency, since a request query would result in not authorized, based on missing parent relation dependencies
                     // --> in order not to have a resource owner that is denied access due to missing parent relation dependency
                     SecurityManager.findbyId(resource.getParentID(), user,
-                            Permissions.PERMISSIONS.CREATE_POLICY,
-                            Permissions.PERMISSIONS.MODIFY_POLICY,
-                            Permissions.PERMISSIONS.DELETE_POLICY,
-                            Permissions.PERMISSIONS.READ_POLICY,
-                            Permissions.PERMISSIONS.READ,
-                            Permissions.PERMISSIONS.WRITE,
-                            Permissions.PERMISSIONS.DELETE);
+                            Permissions.PERMISSIONS.ALL);
                 }catch (EmptyResultException e) {
                     KustvaktLogger.SECURITY_LOGGER
                             .error("No policies found for parent '{}' for user '{}'",
@@ -278,7 +280,7 @@
                 resource.setOwner(user.getId());
 
                 KustvaktLogger.SECURITY_LOGGER
-                        .trace("Creating Access Control structure for resource '"
+                        .info("Creating Access Control structure for resource '"
                                 + resource.getPersistentID() + "@" + resource
                                 .getId() + "'");
                 // storing resource is called twice. first when this is register and later in idsbootstrap to create cstorage entry. how to unify this?
@@ -293,13 +295,14 @@
             }
             p.resource = resource;
             try {
-                p.findPolicies(resource.getId(), false,
+                // todo: which is better? Integer id or String persistentID?
+                p.findPolicies(resource.getPersistentID(), false,
                         Permissions.PERMISSIONS.CREATE_POLICY,
                         Permissions.PERMISSIONS.READ_POLICY,
                         Permissions.PERMISSIONS.MODIFY_POLICY);
             }catch (EmptyResultException e) {
                 KustvaktLogger.SECURITY_LOGGER
-                        .error("No policies found for '{}' for user '{}'",
+                        .error("No policies found for '{}' for user '{}'. Resource could not be registered!",
                                 resource.getPersistentID(), user.getId());
                 throw new KustvaktException(user.getId(),
                         StatusCodes.POLICY_CREATE_ERROR,
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
index 372b7b3..0b33e68 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
@@ -95,7 +95,7 @@
             }
 
             Integer pid = rs.getInt("pid");
-            String grouping = rs.getString("group_ref");
+            String grouping = rs.getString("group_id");
             Integer index = idx[depth].indexOf(pid);
 
             SecurityPolicy policy;
@@ -121,7 +121,7 @@
             }else
                 policy = policyArray[depth].get(index);
 
-            PolicyCondition c = new PolicyCondition(rs.getString("group_ref"));
+            PolicyCondition c = new PolicyCondition(rs.getString("group_id"));
             if (!policy.contains(c))
                 policy.addCondition(c);
         }
@@ -208,7 +208,7 @@
                     SortedMap<String, KustvaktResource.Container[]> submatch;
                     if ((submatch = containerMap.getPrefixSubMap(namePath))
                             == null) {
-
+                        //create container for last child node
                         cursor = new KustvaktResource.Container[depth + 1];
                         cursor[depth] = new KustvaktResource.Container(
                                 persistentId,
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
index 01f1913..fda1e9f 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
@@ -1,12 +1,18 @@
 package de.ids_mannheim.korap.security.auth;
 
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.Scopes;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.AuthenticationIface;
+import de.ids_mannheim.korap.interfaces.EncryptionIface;
+import de.ids_mannheim.korap.interfaces.db.EntityHandlerIface;
 import de.ids_mannheim.korap.user.Attributes;
+import de.ids_mannheim.korap.user.KorAPUser;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.StringUtils;
 import org.apache.commons.codec.binary.Base64;
+import org.apache.oltu.oauth2.common.utils.OAuthUtils;
 
 import java.util.Map;
 
@@ -17,39 +23,52 @@
 public class BasicHttpAuth implements AuthenticationIface {
 
     public static String[] decode(String token) {
-        if (StringUtils.getTokenType(token)
-                .equals(Attributes.BASIC_AUTHENTICATION)) {
-            token = StringUtils.stripTokenType(token);
-            String[] sp = new String(Base64.decodeBase64(token)).split(":", 2);
-            sp[0].replaceAll(" ", "");
-            sp[1].replaceAll(" ", "");
-            return sp;
-        }
-        return null;
+        return OAuthUtils.decodeClientAuthenticationHeader(token);
+
+        //        String t = StringUtils.getTokenType(token);
+        //        if (t != null && t.toUpperCase()
+        //                .equals(Attributes.BASIC_AUTHENTICATION.toUpperCase())) {
+        //            token = StringUtils.stripTokenType(token);
+        //            String[] sp = new String(Base64.decodeBase64(token)).split(":", 2);
+        //            sp[0].replaceAll(" ", "");
+        //            sp[1].replaceAll(" ", "");
+        //            return sp;
+        //        }
+        //        return null;
     }
 
     public static String encode(String user, String pass) {
         String s = user + ":" + pass;
-        return new String(Base64.encodeBase64(s.getBytes()));
+        return Attributes.BASIC_AUTHENTICATION + " " + new String(
+                Base64.encodeBase64(s.getBytes()));
     }
 
     @Override
-    public TokenContext getUserStatus(String authToken) throws
-            KustvaktException {
-        authToken = StringUtils.stripTokenType(authToken);
+    public TokenContext getUserStatus(String authToken)
+            throws KustvaktException {
+        EncryptionIface crypto = BeanConfiguration.getBeans().getEncryption();
+        EntityHandlerIface dao = BeanConfiguration.getBeans()
+                .getUserDBHandler();
+        TokenContext c = new TokenContext();
         String[] values = decode(authToken);
         if (values != null) {
-            TokenContext c = new TokenContext();
+            User user = dao.getAccount(values[0]);
+            if (user instanceof KorAPUser) {
+                boolean check = crypto
+                        .checkHash(values[1], ((KorAPUser) user).getPassword());
+                if (!check)
+                    return c;
+            }
             c.setUsername(values[0]);
             c.setTokenType(Attributes.BASIC_AUTHENTICATION);
-            c.setSecureRequired(true);
-            c.setToken(authToken);
+            // todo: for production mode, set true
+            c.setSecureRequired(false);
+            c.setToken(StringUtils.stripTokenType(authToken));
             //            fixme: you can make queries, but user sensitive data is off limits?!
-            //            c.addContextParameter(Attributes.SCOPES,
-            //                    Scopes.Scope.search.toString());
-            return c;
+            c.addContextParameter(Attributes.SCOPES,
+                    Scopes.Scope.search.toString());
         }
-        return null;
+        return c;
     }
 
     // not supported!
@@ -68,7 +87,6 @@
         return null;
     }
 
-
     @Override
     public String getIdentifier() {
         return Attributes.BASIC_AUTHENTICATION;
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 444852d..9476fe7 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -5,7 +5,9 @@
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.URIParam;
 import de.ids_mannheim.korap.exceptions.*;
-import de.ids_mannheim.korap.interfaces.*;
+import de.ids_mannheim.korap.interfaces.AuthenticationIface;
+import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
+import de.ids_mannheim.korap.interfaces.EncryptionIface;
 import de.ids_mannheim.korap.interfaces.db.AuditingIface;
 import de.ids_mannheim.korap.interfaces.db.EntityHandlerIface;
 import de.ids_mannheim.korap.user.*;
@@ -64,7 +66,13 @@
             String useragent) throws KustvaktException {
         jlog.info("getting session status of token '{}'", token);
         AuthenticationIface provider = getProvider(
-                StringUtils.getTokenType(token));
+                StringUtils.getTokenType(token), null);
+
+        if (provider == null)
+            // throw exception for missing type paramter
+            throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT,
+                    "token type not defined or found", "token_type");
+
         TokenContext context = provider.getUserStatus(token);
         if (!matchStatus(host, useragent, context))
             provider.removeUserSession(token);
@@ -96,11 +104,16 @@
     }
 
     public TokenContext refresh(TokenContext context) throws KustvaktException {
-        AuthenticationIface provider = getProvider(context.getTokenType());
+        AuthenticationIface provider = getProvider(context.getTokenType(),
+                null);
+        if (provider == null) {
+
+        }
+
         try {
             provider.removeUserSession(context.getToken());
             User user = getUser(context.getUsername());
-            return provider.createUserSession(user, context.getParameters());
+            return provider.createUserSession(user, context.params());
         }catch (KustvaktException e) {
             throw new WrappedException(e, StatusCodes.LOGIN_FAILED);
         }
@@ -134,7 +147,8 @@
     @CachePut(value = "users", key = "#user.getUsername()")
     public TokenContext createTokenContext(User user, Map<String, Object> attr,
             String provider_key) throws KustvaktException {
-        AuthenticationIface provider = getProvider(provider_key);
+        AuthenticationIface provider = getProvider(provider_key,
+                Attributes.API_AUTHENTICATION);
 
         if (attr.get(Attributes.SCOPES) != null)
             this.getUserDetails(user);
@@ -180,7 +194,7 @@
     private User authenticate(String username, String password,
             Map<String, Object> attr) throws KustvaktException {
         Map<String, Object> attributes = crypto.validateMap(attr);
-        String uPassword, safeUS;
+        String safeUS;
         User unknown;
         // just to make sure that the plain password does not appear anywhere in the logs!
 
@@ -293,7 +307,12 @@
     public void logout(TokenContext context) throws KustvaktException {
         String key = cache_key(context.getUsername());
         try {
-            AuthenticationIface provider = getProvider(context.getTokenType());
+            AuthenticationIface provider = getProvider(context.getTokenType(),
+                    null);
+
+            if (provider == null) {
+
+            }
             provider.removeUserSession(context.getToken());
         }catch (KustvaktException e) {
             throw new WrappedException(e, StatusCodes.LOGOUT_FAILED,
@@ -438,8 +457,8 @@
      * @throws KustvaktException
      */
     //fixme: remove clientinfo object (not needed), use json representation to get stuff
-    public User createUserAccount(Map<String, Object> attributes)
-            throws KustvaktException {
+    public User createUserAccount(Map<String, Object> attributes,
+            boolean conf_required) throws KustvaktException {
         Map<String, Object> safeMap = crypto.validateMap(attributes);
         if (safeMap.get(Attributes.USERNAME) == null || ((String) safeMap
                 .get(Attributes.USERNAME)).isEmpty())
@@ -466,11 +485,13 @@
         UserDetails det = UserDetails.newDetailsIterator(safeMap);
         user.setDetails(det);
         user.setSettings(new UserSettings());
-        user.setAccountLocked(true);
-        URIParam param = new URIParam(crypto.createToken(), TimeUtils
-                .plusSeconds(BeanConfiguration.getBeans().getConfiguration()
-                        .getShortTokenTTL()).getMillis());
-        user.addField(param);
+        if (conf_required) {
+            user.setAccountLocked(true);
+            URIParam param = new URIParam(crypto.createToken(), TimeUtils
+                    .plusSeconds(BeanConfiguration.getBeans().getConfiguration()
+                            .getExpiration()).getMillis());
+            user.addField(param);
+        }
         user.setPassword(hash);
         try {
             entHandler.createAccount(user);
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java b/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java
index eb0bb32..3f0ebe4 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java
@@ -49,7 +49,7 @@
         String cl_secret = (String) attr.get(Attributes.CLIENT_SECRET);
         if (cl_secret == null)
             throw new KustvaktException(StatusCodes.REQUEST_INVALID);
-
+        attr.remove(cl_secret);
         JWTSigner signer = new JWTSigner(cl_secret.getBytes(),
                 config.getIssuer(), config.getTokenTTL());
         TokenContext c = new TokenContext();
diff --git a/src/main/java/de/ids_mannheim/korap/user/Attributes.java b/src/main/java/de/ids_mannheim/korap/user/Attributes.java
index 55110f8..cf10530 100644
--- a/src/main/java/de/ids_mannheim/korap/user/Attributes.java
+++ b/src/main/java/de/ids_mannheim/korap/user/Attributes.java
@@ -28,6 +28,8 @@
     public static final String TYPE = "type";
 
     public static final String ID = "ID";
+    @Deprecated
+    //refactor
     public static final String UID = "accountID";
     public static final String USERNAME = "username";
     public static final String PASSWORD = "password";
@@ -39,9 +41,10 @@
     public static final String EMAIL = "email";
     public static final String ADDRESS = "address";
     public static final String COUNTRY = "country";
-    public static final String ACCOUNT_CREATION = "accountCreation";
-    public static final String ACCOUNTLOCK = "accountLock";
-    public static final String ACCOUNTLINK = "accountLink";
+    // deprcated, use created
+    public static final String ACCOUNT_CREATION = "account_creation";
+    public static final String ACCOUNTLOCK = "account_lock";
+    public static final String ACCOUNTLINK = "account_link";
     public static final String URI = "uri";
     public static final String URI_FRAGMENT = "uri_fragment";
     public static final String URI_EXPIRATION = "uri_expiration";
@@ -140,5 +143,18 @@
     public static final String TIME_SPANS = "spans";
     public static final String RANGE = "range";
 
+    public static final String GROUP_ID = "group_id";
+    public static final String CREATED = "created";
+    public static final String CREATOR = "creator";
+    public static final String ENABLED = "enabled";
+    public static final String EXPIRE = "expired";
+    public static final String TARGET_ID = "target_id";
+    public static final String IP_RANG = "ip_range";
+    public static final String PERSISTENT_ID = "persistent_id";
+    public static final String DISABLED = "disabled";
+    public static final String USER_ID = "user_id";
+    public static final String PARENT_ID = "parent_id";
+//    public static final String
+
 }
 
diff --git a/src/main/java/de/ids_mannheim/korap/user/TokenContext.java b/src/main/java/de/ids_mannheim/korap/user/TokenContext.java
index e877846..e07cdda 100644
--- a/src/main/java/de/ids_mannheim/korap/user/TokenContext.java
+++ b/src/main/java/de/ids_mannheim/korap/user/TokenContext.java
@@ -3,7 +3,9 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import de.ids_mannheim.korap.utils.JsonUtils;
+import lombok.AccessLevel;
 import lombok.Data;
+import lombok.Getter;
 import org.joda.time.DateTime;
 
 import java.util.Date;
@@ -27,6 +29,7 @@
     private String token;
     private boolean secureRequired;
 
+    @Getter(AccessLevel.PRIVATE)
     private Map<String, Object> parameters;
     private String hostAddress;
     private String userAgent;
@@ -48,6 +51,10 @@
         return m;
     }
 
+    public Map<String, Object> params() {
+        return new HashMap<>(parameters);
+    }
+
     public boolean match(TokenContext other) {
         if (other.getToken().equals(this.token))
             if (this.getHostAddress().equals(this.hostAddress))
diff --git a/src/main/java/de/ids_mannheim/korap/user/User.java b/src/main/java/de/ids_mannheim/korap/user/User.java
index e33502a..3543570 100644
--- a/src/main/java/de/ids_mannheim/korap/user/User.java
+++ b/src/main/java/de/ids_mannheim/korap/user/User.java
@@ -105,7 +105,7 @@
 
     public Map toCache() {
         Map map = new HashMap();
-        map.put(Attributes.UID, this.id);
+        map.put(Attributes.ID, this.id);
         map.put(Attributes.USERNAME, this.username);
         map.put(Attributes.ACCOUNT_CREATION,
                 TimeUtils.format(new DateTime(this.accountCreation)));
@@ -185,21 +185,26 @@
                     0 :
                     (int) map.get(Attributes.TYPE);
             User user;
-            DateTime dateTime = DateTime
-                    .parse((String) map.get(Attributes.ACCOUNT_CREATION));
+            long created = -1;
+            if (map.get(Attributes.ACCOUNT_CREATION) != null)
+                created = DateTime
+                        .parse((String) map.get(Attributes.ACCOUNT_CREATION))
+                        .getMillis();
             switch (type) {
                 case 0:
                     user = UserFactory
                             .getUser((String) map.get(Attributes.USERNAME));
-                    user.setId((Integer) map.get(Attributes.UID));
+                    user.setId((Integer) map.get(Attributes.ID));
                     user.setAccountLocked(
-                            (Boolean) map.get(Attributes.ACCOUNTLOCK));
-                    user.setAccountCreation(dateTime.getMillis());
+                            map.get(Attributes.ACCOUNTLOCK) == null ?
+                                    false :
+                                    (Boolean) map.get(Attributes.ACCOUNTLOCK));
+                    user.setAccountCreation(created);
                     break;
                 default:
                     user = UserFactory
-                            .getDemoUser((Integer) map.get(Attributes.UID));
-                    user.setAccountCreation(dateTime.getMillis());
+                            .getDemoUser((Integer) map.get(Attributes.ID));
+                    user.setAccountCreation(created);
             }
             return user;
         }
diff --git a/src/main/java/de/ids_mannheim/korap/user/UserDetails.java b/src/main/java/de/ids_mannheim/korap/user/UserDetails.java
index 6b2ffdb..d76790e 100644
--- a/src/main/java/de/ids_mannheim/korap/user/UserDetails.java
+++ b/src/main/java/de/ids_mannheim/korap/user/UserDetails.java
@@ -19,6 +19,7 @@
     private Integer userID;
     private String firstName;
     private String lastName;
+    // todo :should be boolean or integer?!
     private String gender;
     private String phone;
     private String institution;
@@ -61,28 +62,34 @@
         return details;
     }
 
-    public void updateDetails(Map<String, String> d) {
-        Map<String, String> detailMap = new CaseInsensitiveMap(d);
+    public void updateDetails(Map<String, Object> d) {
+        Map<String, Object> detailMap = new CaseInsensitiveMap(d);
 
         if (!detailMap.isEmpty()) {
             if (detailMap.containsKey(Attributes.FIRSTNAME))
-                this.setFirstName(detailMap.get(Attributes.FIRSTNAME));
+                this.setFirstName(
+                        String.valueOf(detailMap.get(Attributes.FIRSTNAME)));
             if (detailMap.containsKey(Attributes.LASTNAME))
-                this.setLastName(detailMap.get(Attributes.LASTNAME));
+                this.setLastName(
+                        String.valueOf(detailMap.get(Attributes.LASTNAME)));
             if (detailMap.containsKey(Attributes.PHONE))
-                this.setPhone(detailMap.get(Attributes.PHONE));
+                this.setPhone(String.valueOf(detailMap.get(Attributes.PHONE)));
             if (detailMap.containsKey(Attributes.EMAIL))
-                this.setEmail(detailMap.get(Attributes.EMAIL));
+                this.setEmail(String.valueOf(detailMap.get(Attributes.EMAIL)));
             if (detailMap.containsKey(Attributes.GENDER))
-                this.setGender(detailMap.get(Attributes.GENDER));
+                this.setGender(
+                        String.valueOf(detailMap.get(Attributes.GENDER)));
             if (detailMap.containsKey(Attributes.ADDRESS))
-                this.setAddress(detailMap.get(Attributes.ADDRESS));
+                this.setAddress(
+                        String.valueOf(detailMap.get(Attributes.ADDRESS)));
             if (detailMap.containsKey(Attributes.COUNTRY))
-                this.setCountry(detailMap.get(Attributes.COUNTRY));
+                this.setCountry(
+                        String.valueOf(detailMap.get(Attributes.COUNTRY)));
             if (detailMap.containsKey(Attributes.INSTITUTION))
-                this.setInstitution(detailMap.get(Attributes.INSTITUTION));
-            this.setPrivateUsage(
-                    Boolean.valueOf(detailMap.get(Attributes.PRIVATE_USAGE)));
+                this.setInstitution(
+                        String.valueOf(detailMap.get(Attributes.INSTITUTION)));
+            this.setPrivateUsage(Boolean.valueOf(
+                    String.valueOf(detailMap.get(Attributes.PRIVATE_USAGE))));
         }
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/user/UserSettings.java b/src/main/java/de/ids_mannheim/korap/user/UserSettings.java
index ebb85ed..c16f617 100644
--- a/src/main/java/de/ids_mannheim/korap/user/UserSettings.java
+++ b/src/main/java/de/ids_mannheim/korap/user/UserSettings.java
@@ -293,7 +293,8 @@
         this.setRightContextSize(200);
         this.setRightContextSizeForExport(100);
         // persistent id for wikipedia!
-        this.setSelectedCollection(
+        // fixme: deprecation warning!
+         this.setSelectedCollection(
                 "ZGU0ZTllNTFkYzc3M2VhZmViYzdkYWE2ODI5NDc3NTk4NGQ1YThhOTMwOTNhOWYxNWMwN2M3Y2YyZmE3N2RlNQ==");
         this.setQueryLanguage("COSMAS2");
         this.setPageLength(25);
diff --git a/src/main/java/de/ids_mannheim/korap/utils/Benchmarker.java b/src/main/java/de/ids_mannheim/korap/utils/Benchmarker.java
deleted file mode 100644
index 309578d..0000000
--- a/src/main/java/de/ids_mannheim/korap/utils/Benchmarker.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package de.ids_mannheim.korap.utils;
-
-/**
- * @author hanl
- * @date 29/04/2014
- */
-
-@Deprecated
-public class Benchmarker {
-}
diff --git a/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder.java b/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder.java
deleted file mode 100644
index b68feac..0000000
--- a/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder.java
+++ /dev/null
@@ -1,319 +0,0 @@
-package de.ids_mannheim.korap.utils;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.collect.ArrayListMultimap;
-import com.google.common.collect.Multimap;
-import com.google.common.collect.Multiset;
-
-import java.io.IOException;
-import java.util.*;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-/**
- * @author hanl
- * @date 06/12/2013
- */
-@Deprecated
-public class CollectionQueryBuilder {
-
-    private enum Relation {
-        OR, AND
-    }
-
-    private CollectionTypes types;
-    private List<Map> rq;
-    private Multimap<String, String> mfilter;
-    private Multimap<String, String> mextension;
-    private Relation simpleFilterRel = Relation.OR;
-    private Relation simpleExtendRel = Relation.OR;
-
-
-    public CollectionQueryBuilder() {
-        this.rq = new ArrayList<>();
-        this.mfilter = ArrayListMultimap.create();
-        this.mextension = ArrayListMultimap.create();
-        this.types = new CollectionTypes();
-    }
-
-    public CollectionQueryBuilder addResource(String query) {
-        try {
-            List v = JsonUtils.read(query, LinkedList.class);
-            this.rq.addAll(v);
-        } catch (IOException e) {
-            throw new IllegalArgumentException("Conversion went wrong!");
-        }
-        return this;
-    }
-
-    public CollectionQueryBuilder addResources(List<String> queries) {
-        for (String query : queries)
-            addResource(query);
-        return this;
-    }
-
-    public CollectionQueryBuilder addMetaFilter(String key, String value) {
-        this.mfilter.put(key, value);
-        return this;
-    }
-
-
-    public CollectionQueryBuilder addMetaFilterQuery(String queries) {
-        this.mfilter.putAll(resRel(queries));
-        return this;
-    }
-
-    public CollectionQueryBuilder addMetaExtend(String key, String value) {
-        this.mextension.put(key, value);
-        return this;
-    }
-
-
-    public CollectionQueryBuilder setFilterAttributeRelation(Relation rel) {
-        simpleFilterRel = rel;
-        return this;
-    }
-
-
-    public CollectionQueryBuilder setExtendAttributeRelation(Relation rel) {
-        simpleExtendRel = rel;
-        return this;
-    }
-
-    public CollectionQueryBuilder addMetaExtendQuery(String queries) {
-        this.mextension.putAll(resRel(queries));
-        return this;
-    }
-
-
-    @Deprecated
-    private List<Map> createFilter(Relation rel) {
-        String relation = rel == Relation.AND ? "and" : "or";
-        List<Map> mfil = new ArrayList<>();
-        boolean multypes = this.mfilter.keySet().size() > 1;
-        String def_key = null;
-
-        if (!multypes) {
-            Multiset<String> keys = this.mfilter.keys();
-            def_key = keys.toArray(new String[keys.size()])[0];
-        }
-
-        List value = this.createValue(this.mfilter);
-
-        if (mfilter.values().size() == 1)
-            Collections.addAll(mfil, types.createMetaFilter((Map) value.get(0)));
-        else {
-            Map group;
-            if (!multypes)
-                group = types.createGroup(relation, def_key, value);
-            else
-                group = types.createGroup(relation, null, value);
-            Collections.addAll(mfil, types.createMetaFilter(group));
-        }
-        return mfil;
-    }
-
-    @Deprecated
-    private List<Map> createExtender(Relation rel) {
-        String relation = rel == Relation.AND ? "and" : "or";
-        List<Map> mex = new ArrayList();
-        boolean multypes = this.mextension.keys().size() > 1;
-        String def_key = null;
-
-        if (!multypes)
-            def_key = this.mextension.keys().toArray(new String[0])[0];
-
-        List value = this.createValue(this.mextension);
-        // todo: missing: - takes only one resource, but resources can be chained!
-        if (this.mextension.values().size() == 1)
-            Collections.addAll(mex, types.createMetaExtend((Map) value.get(0)));
-        else {
-            Map group;
-            if (!multypes)
-                group = types.createGroup(relation, def_key, value);
-            else
-                group = types.createGroup(relation, null, value);
-            Collections.addAll(mex, types.createMetaExtend(group));
-        }
-        return mex;
-    }
-
-    private List<Map> join() {
-        List<Map> cursor = new ArrayList<>(this.rq);
-        if (!this.mfilter.isEmpty())
-            cursor.addAll(this.createFilter(simpleFilterRel));
-        if (!this.mextension.isEmpty())
-            cursor.addAll(this.createExtender(simpleExtendRel));
-        return cursor;
-    }
-
-    private List createValue(Multimap<String, String> map) {
-        List value = new ArrayList<>();
-        String[] dates = new String[3];
-        for (String key : map.keySet()) {
-            if (key.equals("pubDate")) {
-                dates = processDates((List<String>) map.get(key));
-                continue;
-            }
-
-            if (map.get(key).size() == 1) {
-                Map term = types.createTerm(key, null,
-                        map.get(key).toArray(new String[0])[0], null);
-                value.add(term);
-            } else {
-                boolean multypes = map.keySet().size() > 1;
-                List g = new ArrayList();
-                for (String v : map.get(key))
-                    g.add(types.createTerm(null, v, null));
-
-                if (multypes) {
-                    Map group = types.createGroup("and", key, g);
-                    value.add(group);
-                } else
-                    value.addAll(g);
-
-            }
-        }
-
-        int idx = 3;
-        if (dates[0] != null && dates[0].equals("r")) {
-            Map term1 = types.createTerm(null, dates[1], "korap:date");
-            Map term2 = types.createTerm(null, dates[2], "korap:date");
-            Map group = types.createGroup("between", "pubDate", Arrays.asList(term1, term2));
-            value.add(group);
-        } else if (dates[1] != null) {
-            Map term1 = types.createTerm(null, dates[1], "korap:date");
-            Map group = types.createGroup("since", "pubDate", Arrays.asList(term1));
-            value.add(group);
-        } else if (dates[2] != null) {
-            Map term1 = types.createTerm(null, dates[2], "korap:date");
-            Map group = types.createGroup("until", "pubDate", Arrays.asList(term1));
-            value.add(group);
-        }
-
-        for (int i = idx; i < dates.length; i++) {
-            if (dates[i] != null) {
-                Map term1 = types.createTerm(dates[i], "korap:date");
-                Map group = types.createGroup("exact", "pubDate", Arrays.asList(term1));
-                value.add(group);
-            }
-        }
-        return value;
-    }
-
-    private String[] processDates(List<String> dates) {
-        if (dates.isEmpty())
-            return new String[3];
-        String[] el = new String[dates.size() + 3];
-        int idx = 3;
-        for (String value : dates) {
-            if (value.contains("<")) {
-                String[] sp = value.split("<");
-                el[1] = sp[1];
-            } else if (value.contains(">")) {
-                String[] sp = value.split(">");
-                el[2] = sp[1];
-            } else {
-                el[idx] = value;
-                idx++;
-            }
-        }
-        if (el[1] != null && el[2] != null)
-            el[0] = "r";
-        return el;
-    }
-
-    public List<Map> raw() {
-        return join();
-    }
-
-    public String toCollections() {
-        Map meta = new LinkedHashMap();
-        meta.put("collections", join());
-        return JsonUtils.toJSON(meta);
-    }
-
-    /**
-     * returns all references to parents and meta query as string representation
-     *
-     * @return
-     */
-    public JsonNode toNode() {
-        return JsonUtils.valueToTree(join());
-    }
-
-    public String toJSON() {
-        return JsonUtils.toJSON(join());
-    }
-
-
-    /**
-     * resolves all queries as equal (hierarchy) AND/OR relations
-     * grouping is not supported!
-     *
-     * @param queries
-     * @return
-     */
-    private Multimap<String, String> resRel(String queries) {
-        Multimap<String, String> qmap = ArrayListMultimap.create();
-        String op = null;
-        if (queries.contains("AND") | queries.contains("OR"))
-            op = queries.contains("AND") ? "AND" : "OR";
-        else if (queries.contains("&") | queries.contains("|"))
-            op = queries.contains("&") ? "&" : "|";
-
-        if (op == null)
-            return qmap;
-
-        String[] spl = queries.trim().split(op);
-        for (String query : spl) {
-            String[] q = query.split("=");
-            if (q.length > 1) {
-                String attr = q[0].trim();
-                String val = q[1].trim();
-                qmap.put(attr, val);
-            }
-            // todo: return error when query not well-formed
-        }
-        return qmap;
-    }
-
-    /**
-     * resolve relations and allow grouping of attributes: (tc1 and tc1) or (tc3)
-     *
-     * @param queries
-     * @param filter  flag if either filter or extend collection
-     * @return
-     */
-    private void resRelation(String queries, boolean filter) {
-        Pattern p = Pattern.compile("\\(([\\w\\s:]+)\\)");
-        List _fill = new ArrayList();
-        Matcher m = p.matcher(queries);
-        while (m.find()) {
-            String gr = m.group(1);
-            _fill.add(gr);
-            String whole = "(" + gr + ")";
-            int fin = queries.lastIndexOf(whole);
-            String sub = queries.substring(queries.indexOf(whole), queries.lastIndexOf(whole));
-            queries.replace(whole, "");
-        }
-    }
-
-    private void v(String queries, boolean filter) {
-        // and exclude sub-groups?? : ((tc=121))
-        Pattern p = Pattern.compile("\\(([\\w\\s=]+)\\)");
-        List _fill = new ArrayList();
-        Matcher m = p.matcher(queries);
-        while (m.find()) {
-            String gr = m.group(1);
-
-        }
-
-    }
-
-    public void clear() {
-        this.rq.clear();
-        this.mfilter.clear();
-        this.mextension.clear();
-    }
-}
diff --git a/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder3.java b/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder3.java
index 6b1ee91..220b6b9 100644
--- a/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder3.java
+++ b/src/main/java/de/ids_mannheim/korap/utils/CollectionQueryBuilder3.java
@@ -31,13 +31,41 @@
         this.base = null;
     }
 
-    public CollectionQueryBuilder3 addSegment(String field, EQ eq,
-            String value) {
+//    /**
+//     * convencience method for equal field value search operation
+//     * @param field
+//     * @param value
+//     * @return
+//     */
+//    public CollectionQueryBuilder3 eq(String field, String value) {
+//        fieldValue(field, "match:eq", value);
+//        return this;
+//    }
+//
+//    /**
+//     * convencience method for unequal field value search operation
+//     * @param field
+//     * @param value
+//     * @return
+//     */
+//    public CollectionQueryBuilder3 uneq(String field, String value) {
+//        fieldValue(field, "match:ne", value);
+//        return this;
+//    }
+
+
+    /**
+     * raw method for field - value pair adding. Supports all operators (leq, geq, contains, etc.)
+     * @param field
+     * @param op
+     * @param value
+     * @return
+     */
+    public CollectionQueryBuilder3 fieldValue(String field, String op, String value) {
         if (base == null)
-            this.builder
-                    .append(field + (eq.equals(EQ.EQUAL) ? "=" : "!=") + value);
+            this.builder.append(field + op + value);
         else {
-            JsonNode node = Utils.buildDoc(field, value, eq);
+            JsonNode node = Utils.buildDoc(field, value, op);
             appendToBaseGroup(node);
         }
         return this;
@@ -49,7 +77,7 @@
      * @param query will be parenthised in order to make sub query element
      * @return
      */
-    public CollectionQueryBuilder3 addSub(String query) {
+    public CollectionQueryBuilder3 addQuery(String query) {
         if (!query.startsWith("(") && !query.endsWith(")"))
             query = "(" + query + ")";
 
@@ -75,12 +103,7 @@
         return this;
     }
 
-    @Deprecated
-    public CollectionQueryBuilder3 addRaw(String collection) {
-        return this;
-    }
-
-    public Object getRequest() {
+    private Object build() {
         Object request = base;
         if (request == null) {
             CollectionQueryProcessor tree = new CollectionQueryProcessor(
@@ -98,17 +121,16 @@
      *
      * @param query
      */
-    public void setBaseQuery(String query) {
+    public CollectionQueryBuilder3 setBaseQuery(String query) {
         this.base = JsonUtils.readTree(query);
+        return this;
     }
 
     public String toJSON() {
-        return JsonUtils.toJSON(getRequest());
+        return JsonUtils.toJSON(build());
     }
 
-
-
-    private void appendToBaseGroup(JsonNode node) {
+    private CollectionQueryBuilder3 appendToBaseGroup(JsonNode node) {
         if (base.at("/collection/@type").asText().equals("koral:docGroup")) {
             ArrayNode group = (ArrayNode) base.at("/collection/operands");
             if (node instanceof ArrayNode)
@@ -119,14 +141,17 @@
             throw new IllegalArgumentException("No group found to add to!");
         // fixme: if base is a doc only, this function is not supported. requirement is a koral:docGroup, since
         // combination operator is unknown otherwise
+        return this;
     }
 
+
     public static class Utils {
 
-        public static JsonNode buildDoc(String key, String value, EQ eq) {
+        public static JsonNode buildDoc(String key, String value, String op) {
             ObjectNode node = JsonUtils.createObjectNode();
             node.put("@type", "koral:doc");
-            node.put("match", eq.equals(EQ.EQUAL) ? "match:eq" : "match:ne");
+            // eq.equals(EQ.EQUAL) ? "match:eq" : "match:ne"
+            node.put("match", op);
             node.put("key", key);
             node.put("value", value);
 
diff --git a/src/main/java/de/ids_mannheim/korap/utils/PrefixTreeMap.java b/src/main/java/de/ids_mannheim/korap/utils/PrefixTreeMap.java
index 493a574..b07df0d 100644
--- a/src/main/java/de/ids_mannheim/korap/utils/PrefixTreeMap.java
+++ b/src/main/java/de/ids_mannheim/korap/utils/PrefixTreeMap.java
@@ -1,6 +1,5 @@
 package de.ids_mannheim.korap.utils;
 
-import java.util.Map;
 import java.util.SortedMap;
 import java.util.TreeMap;
 
@@ -12,7 +11,7 @@
 
 
     public SortedMap<String, V> getPrefixSubMap(String prefix) {
-        if (prefix.length() > 0) {
+        if (prefix != null && prefix.length() > 0) {
             SortedMap d = this.subMap(prefix, getEnd(prefix));
             if (d.isEmpty())
                 return null;
diff --git a/src/main/java/de/ids_mannheim/korap/utils/SqlBuilder.java b/src/main/java/de/ids_mannheim/korap/utils/SqlBuilder.java
new file mode 100644
index 0000000..8b22d25
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/utils/SqlBuilder.java
@@ -0,0 +1,92 @@
+package de.ids_mannheim.korap.utils;
+
+/**
+ * @author hanl
+ * @date 26/11/2015
+ */
+public class SqlBuilder {
+
+    private StringBuffer buffer;
+    private String table;
+    private String[] fields;
+    private String where;
+
+    public SqlBuilder(String table) {
+        this.buffer = new StringBuffer();
+        this.table = table;
+    }
+
+    public SqlBuilder select(String... fields) {
+        this.buffer.append("SELECT ");
+        if (fields.length > 0) {
+            for (int i = 0; i < fields.length; i++) {
+                if (i > 0)
+                    this.buffer.append(", ");
+                this.buffer.append(fields[i]);
+            }
+        }else
+            this.buffer.append("*");
+        this.buffer.append(" FROM ").append(table);
+        return this;
+    }
+
+    public SqlBuilder update(String... fields) {
+        this.buffer.append("UPDATE ").append(table);
+        this.fields = fields;
+        return this;
+    }
+
+    public SqlBuilder insert(String... fields) {
+        this.buffer.append("INSERT INTO ").append(table);
+        this.fields = fields;
+        return this;
+    }
+
+    public SqlBuilder delete() {
+        this.buffer.append("DELETE FROM ").append(table);
+        return this;
+    }
+
+    public SqlBuilder params(String... values) {
+        if (this.buffer.lastIndexOf("INSERT INTO") != -1) {
+            this.buffer.append(" (");
+            for (int i = 0; i < this.fields.length; i++) {
+                if (i > 0)
+                    this.buffer.append(", ");
+                this.buffer.append(fields[i]);
+            }
+
+            StringBuffer b = new StringBuffer();
+            for (int i = 0; i < values.length; i++) {
+                if (i > 0)
+                    b.append(", ");
+                b.append(values[i]);
+            }
+            this.buffer.append(") VALUES (").append(b.toString()).append(")");
+        }
+        if (this.buffer.lastIndexOf("UPDATE") != -1) {
+            this.buffer.append(" SET ");
+            for (int i = 0; i < this.fields.length; i++) {
+                if (i > 0)
+                    this.buffer.append(", ");
+                this.buffer.append(fields[i]).append("=").append(values[i]);
+            }
+        }
+        return this;
+    }
+
+    public SqlBuilder where(String where) {
+        this.where = where;
+        return this;
+    }
+
+    @Override
+    public String toString() {
+        StringBuffer b = new StringBuffer(this.buffer);
+        //exclude where clauses from insert statements
+        if (this.where != null && this.buffer.lastIndexOf("INSERT INTO") == -1)
+            b.append(" WHERE ").append(where);
+        return b.append(";").toString();
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/utils/StringUtils.java b/src/main/java/de/ids_mannheim/korap/utils/StringUtils.java
index 410f006..ba81285 100644
--- a/src/main/java/de/ids_mannheim/korap/utils/StringUtils.java
+++ b/src/main/java/de/ids_mannheim/korap/utils/StringUtils.java
@@ -31,9 +31,11 @@
 
     public static Set<String> toSet(String values, String sep) {
         Set<String> set = new HashSet<>();
-        StringTokenizer tokenizer = new StringTokenizer(values, sep);
-        while (tokenizer.hasMoreTokens())
-            set.add(tokenizer.nextToken());
+        if (values != null && !values.isEmpty()) {
+            StringTokenizer tokenizer = new StringTokenizer(values, sep);
+            while (tokenizer.hasMoreTokens())
+                set.add(tokenizer.nextToken());
+        }
         return set;
     }
 
@@ -135,8 +137,11 @@
     }
 
     public static String getTokenType(String token) {
-        return token.substring(0, token.lastIndexOf(" ")).replaceAll("\\s", "")
-                .toLowerCase();
+        if (token.contains(" "))
+            return token.substring(0, token.lastIndexOf(" "))
+                    .replaceAll("\\s", "").toLowerCase();
+        else
+            return null;
     }
 
     public static boolean isInteger(String value) {
diff --git a/src/main/java/de/ids_mannheim/korap/web/KustvaktBaseServer.java b/src/main/java/de/ids_mannheim/korap/web/KustvaktBaseServer.java
index e371f45..880c9d9 100644
--- a/src/main/java/de/ids_mannheim/korap/web/KustvaktBaseServer.java
+++ b/src/main/java/de/ids_mannheim/korap/web/KustvaktBaseServer.java
@@ -4,6 +4,9 @@
 import com.sun.jersey.api.core.ResourceConfig;
 import com.sun.jersey.spi.container.servlet.ServletContainer;
 import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.KustvaktClassLoader;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.web.service.BootupInterface;
 import lombok.Getter;
 import lombok.Setter;
 import org.eclipse.jetty.server.Connector;
@@ -14,6 +17,10 @@
 import org.eclipse.jetty.servlet.ServletHolder;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
 
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
 /**
  * @author hanl
  * @date 01/06/2015
@@ -21,7 +28,8 @@
 public class KustvaktBaseServer {
 
     public static void main(String[] args) throws Exception {
-        KustvaktArgs kargs = readAttributes(args);
+        KustvaktBaseServer server = new KustvaktBaseServer();
+        KustvaktArgs kargs = server.readAttributes(args);
 
         if (kargs.config != null)
             BeanConfiguration.loadFileContext(kargs.config);
@@ -30,10 +38,11 @@
 
         kargs.setRootPackages(
                 new String[] { "de.ids_mannheim.korap.web.service.light" });
-        startServer(kargs);
+        server.runPreStart();
+        server.startServer(kargs);
     }
 
-    public static KustvaktArgs readAttributes(String[] args) {
+    protected KustvaktArgs readAttributes(String[] args) {
         KustvaktArgs kargs = new KustvaktArgs();
         for (int i = 0; i < args.length; i++) {
             switch ((args[i])) {
@@ -53,8 +62,8 @@
                     StringBuffer b = new StringBuffer();
 
                     b.append("Parameter description: \n")
-                            .append("--config  <Path to spring configuration file> : Configuration file\n").append(
-                            "--port  <Server port> : Port under which the server is accessible \n")
+                            .append("--config  <Path to spring configuration file> : Configuration file\n")
+                            .append("--port  <Server port> : Port under which the server is accessible \n")
                             //                            .append("--props  <Path to kustvakt properties> : list of configuration properties\n")
                             .append("--help : This help menu\n");
                     System.out.println(b.toString());
@@ -65,7 +74,35 @@
         return kargs;
     }
 
-    public static void startServer(KustvaktArgs kargs) {
+    public static void runPreStart() {
+        Set<Class<? extends BootupInterface>> set = KustvaktClassLoader
+                .loadSubTypes(BootupInterface.class);
+
+        List<BootupInterface> list = new ArrayList<>(set.size());
+
+        for (Class cl : set) {
+            BootupInterface iface;
+            try {
+                iface = (BootupInterface) cl.newInstance();
+                if (iface.position() == -1 | iface.position() > set.size())
+                    list.add(iface);
+                else
+                    list.add(0, iface);
+            }catch (InstantiationException | IllegalAccessException e) {
+                continue;
+            }
+        }
+        System.out.println("Found boot loading interfaces: " + list);
+        for (BootupInterface iface : list) {
+            try {
+                iface.load();
+            }catch (KustvaktException e) {
+                // don't do anything!
+            }
+        }
+    }
+
+    protected void startServer(KustvaktArgs kargs) {
         if (kargs.port == -1)
             kargs.setPort(
                     BeanConfiguration.getBeans().getConfiguration().getPort());
diff --git a/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java b/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
index d917afb..6a89cf8 100644
--- a/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
+++ b/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
@@ -1,6 +1,5 @@
 // Connector to the Lucene Backend
 package de.ids_mannheim.korap.web;
-
 import de.ids_mannheim.korap.Krill;
 import de.ids_mannheim.korap.KrillCollection;
 import de.ids_mannheim.korap.KrillIndex;
@@ -10,11 +9,10 @@
 import de.ids_mannheim.korap.utils.KustvaktLogger;
 import org.apache.lucene.store.MMapDirectory;
 import org.slf4j.Logger;
-
+import java.nio.file.Paths;
 import java.io.File;
 import java.io.IOException;
 import java.util.List;
-
 /**
  * The SearchKrill class allows for searching in the
  * Lucene based Krill backend by applying KoralQuery.
@@ -29,30 +27,33 @@
     String indexDir = "/data/prep_corpus/index/";
     String i = "/Users/hanl/Projects/prep_corpus";
     String klinux10 = "/vol/work/hanl/indices";
-
     private KrillIndex index;
-
     /**
      * Constructor
      */
     // todo: use korap.config to get index location
-    public SearchKrill(String path) {
+    public SearchKrill (String path) {
         try {
-            File f = new File(path);
-            log.info("Loading index from " + path);
-            if (!f.exists()) {
-                KustvaktLogger.ERROR_LOGGER.error("Index not found!");
-                System.exit(-1);
+            if (path.equals(":temp:")) {
+                this.index = new KrillIndex();
             }
-            this.index = new KrillIndex(new MMapDirectory(new File(path)));
-        }catch (IOException e) {
+            else {
+                File f = new File(path);
+                log.info("Loading index from " + path);
+                if (!f.exists()) {
+                    KustvaktLogger.ERROR_LOGGER.error("Index not found!");
+                    System.exit(-1);
+                };
+                this.index = new KrillIndex(new MMapDirectory(Paths.get(path)));
+            };
+        } catch (IOException e) {
             KustvaktLogger.ERROR_LOGGER
                     .error("Unable to loadSubTypes index: {}", e.getMessage());
-        }
-    }
-
-    ;
-
+        };
+    };
+    public KrillIndex getIndex () {
+        return this.index;
+    };
     /**
      * Search in the Lucene index.
      *
@@ -62,14 +63,10 @@
         qlog.trace(json);
         if (this.index != null)
             return new Krill(json).apply(this.index).toJsonString();
-
         Result kr = new Result();
         kr.addError(601, "Unable to find index");
         return kr.toJsonString();
-    }
-
-    ;
-
+    };
     /**
      * Search in the Lucene index and return matches as token lists.
      *
@@ -80,39 +77,30 @@
         qlog.trace(json);
         if (this.index != null)
             return new Krill(json).apply(this.index).toTokenListJsonString();
-
         Result kr = new Result();
         kr.addError(601, "Unable to find index");
         return kr.toJsonString();
-    }
-
-    ;
-
+    };
     /**
      * Get info on a match - by means of a richly annotated html snippet.
      *
      * @param id match id
      */
     public String getMatch(String id) {
-
         if (this.index != null) {
             try {
                 return this.index.getMatch(id).toJsonString();
-            }catch (QueryException qe) {
+            }
+            catch (QueryException qe) {
                 Match km = new Match();
                 km.addError(qe.getErrorCode(), qe.getMessage());
                 return km.toJsonString();
             }
-        }
-        ;
-
+        };
         Match km = new Match();
         km.addError(601, "Unable to find index");
         return km.toJsonString();
-    }
-
-    ;
-
+    };
     public String getMatch(String id, List<String> foundries,
             List<String> layers, boolean includeSpans,
             boolean includeHighlights, boolean sentenceExpansion) {
@@ -123,21 +111,17 @@
                         .getMatchInfo(id, "tokens", true, foundries, layers,
                                 includeSpans, includeHighlights,
                                 sentenceExpansion).toJsonString();
-            }catch (QueryException qe) {
+            } catch (QueryException qe) {
                 Match km = new Match();
                 km.addError(qe.getErrorCode(), qe.getMessage());
                 return km.toJsonString();
             }
-        }
-        ;
+        };
 
         Match km = new Match();
         km.addError(601, "Unable to find index");
         return km.toJsonString();
-    }
-
-    ;
-
+    };
     /**
      * Get info on a match - by means of a richly annotated html snippet.
      *
@@ -153,36 +137,33 @@
 
         if (this.index != null) {
             try {
-
-		/*
-          For multiple foundries/layers use
-		  String idString,
-		  "tokens",
-		  true,
-		  ArrayList<String> foundry,
-		  ArrayList<String> layer,
-		  boolean includeSpans,
-		  boolean includeHighlights,
-		  boolean extendToSentence
-		 */
-
+                /*
+                  For multiple foundries/layers use
+                  String idString,
+                  "tokens",
+                  true,
+                  ArrayList<String> foundry,
+                  ArrayList<String> layer,
+                  boolean includeSpans,
+                  boolean includeHighlights,
+                  boolean extendToSentence
+                */
                 return this.index.getMatchInfo(id, "tokens", foundry, layer,
-                        includeSpans, includeHighlights, sentenceExpansion)
+                        includeSpans, includeHighlights,
+                        sentenceExpansion)
                         .toJsonString();
-            }catch (QueryException qe) {
+            }
+            catch (QueryException qe) {
                 Match km = new Match();
                 km.addError(qe.getErrorCode(), qe.getMessage());
                 return km.toJsonString();
             }
-        }
-        ;
-
+        };
         Match km = new Match();
         km.addError(601, "Unable to find index");
         return km.toJsonString();
-    }
+    };
 
-    ;
 
     /**
      * Get statistics on (virtual) collections.
@@ -192,45 +173,37 @@
     @Deprecated
     public String getStatistics(String json) {
         qlog.trace(json);
-
         if (this.index == null) {
             return "{\"documents\" : -1, error\" : \"No index given\" }";
-        }
-
+        };
         // Create Virtual collection from json search
         KrillCollection kc = new KrillCollection(json);
-
         // Set index
         kc.setIndex(this.index);
-
         long docs = 0,
                 tokens = 0,
                 sentences = 0,
                 paragraphs = 0;
-
         // Get numbers from index (currently slow)
         try {
             docs = kc.numberOf("documents");
             tokens = kc.numberOf("tokens");
             sentences = kc.numberOf("sentences");
             paragraphs = kc.numberOf("paragraphs");
-        }catch (IOException e) {
-            e.printStackTrace();
         }
-        ;
-
+        catch (IOException e) {
+            e.printStackTrace();
+        };
         // Build json response
         StringBuilder sb = new StringBuilder("{");
         sb.append("\"documents\":").append(docs).append(",\"tokens\":")
                 .append(tokens).append(",\"sentences\":").append(sentences)
                 .append(",\"paragraphs\":").append(paragraphs).append("}");
         return sb.toString();
-
-    }
-
+    };
     public String getMatchId(String type, String docid, String tofrom) {
         return new StringBuilder().append("match-").append(type).append("!")
                 .append(type).append("_").append(docid).append("-")
                 .append(tofrom).toString();
-    }
-};
+    };
+};
\ No newline at end of file
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/AuthFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/AuthFilter.java
index eff8b57..60a2891 100644
--- a/src/main/java/de/ids_mannheim/korap/web/filter/AuthFilter.java
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/AuthFilter.java
@@ -39,15 +39,17 @@
             try {
                 context = userController
                         .getTokenStatus(authentication, host, ua);
-
             }catch (KustvaktException e) {
                 throw KustvaktResponseHandler.throwit(e);
             }
 
+            // fixme: give reason why access is not granted?
             if (context != null && (
                     (context.isSecureRequired() && request.isSecure())
                             | !context.isSecureRequired()))
                 request.setSecurityContext(new KorAPContext(context));
+            else
+                throw KustvaktResponseHandler.throwAuthenticationException();
         }
         return request;
     }
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/BootupInterface.java b/src/main/java/de/ids_mannheim/korap/web/service/BootupInterface.java
new file mode 100644
index 0000000..1eb6f36
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/BootupInterface.java
@@ -0,0 +1,15 @@
+package de.ids_mannheim.korap.web.service;
+
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+
+/**
+ * @author hanl
+ * @date 12/01/2016
+ */
+public interface BootupInterface {
+
+    void load() throws KustvaktException;
+    int position();
+
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java b/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java
new file mode 100644
index 0000000..a4d753a
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/CollectionLoader.java
@@ -0,0 +1,70 @@
+package de.ids_mannheim.korap.web.service;
+
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.handlers.CollectionDao;
+import de.ids_mannheim.korap.resources.Permissions;
+import de.ids_mannheim.korap.resources.ResourceFactory;
+import de.ids_mannheim.korap.resources.VirtualCollection;
+import de.ids_mannheim.korap.security.ac.PolicyBuilder;
+import de.ids_mannheim.korap.user.Attributes;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.CollectionQueryBuilder3;
+
+/**
+ * @author hanl
+ * @date 12/01/2016
+ */
+public class CollectionLoader implements BootupInterface {
+
+    @Override
+    public void load() throws KustvaktException {
+        int uid = (Integer) KustvaktConfiguration.KUSTVAKT_USER
+                .get(Attributes.ID);
+
+        User user = User.UserFactory
+                .toUser(KustvaktConfiguration.KUSTVAKT_USER);
+
+        //todo: load default collections!
+        CollectionQueryBuilder3 bui = new CollectionQueryBuilder3();
+        bui.addQuery("creationDate since 1775");
+
+        VirtualCollection c1 = ResourceFactory
+                .createCollection("Weimarer Werke", bui.toJSON(), uid);
+        c1.setDescription("Goethe-Werke in Weimar (seit 1775)");
+
+        bui = new CollectionQueryBuilder3();
+        bui.addQuery("textType = Aphorismus");
+
+        VirtualCollection c2 = ResourceFactory
+                .createCollection("Aphorismen", bui.toJSON(), uid);
+        c2.setDescription("Aphorismentexte Goethes");
+
+        bui = new CollectionQueryBuilder3();
+        bui.addQuery("title ~ \"Werther\"");
+
+        VirtualCollection c3 = ResourceFactory
+                .createCollection("Werther", bui.toJSON(), uid);
+        c3.setDescription("Goethe - Die Leiden des jungen Werther");
+
+        CollectionDao dao = new CollectionDao(
+                BeanConfiguration.getBeans().getPersistenceClient());
+
+        dao.storeResource(c1, user);
+        dao.storeResource(c2, user);
+        dao.storeResource(c3, user);
+
+        PolicyBuilder b = new PolicyBuilder(user);
+        b.setPermissions(Permissions.PERMISSIONS.ALL);
+        b.setResources(c1, c2, c3);
+        b.setConditions("public");
+        b.create();
+
+    }
+
+    @Override
+    public int position() {
+        return 1;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java b/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java
new file mode 100644
index 0000000..29dc462
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/PolicyLoader.java
@@ -0,0 +1,60 @@
+package de.ids_mannheim.korap.web.service;
+
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.handlers.CollectionDao;
+import de.ids_mannheim.korap.handlers.ResourceDao;
+import de.ids_mannheim.korap.interfaces.db.PersistenceClient;
+import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
+import de.ids_mannheim.korap.resources.Corpus;
+import de.ids_mannheim.korap.resources.Permissions;
+import de.ids_mannheim.korap.security.ac.PolicyBuilder;
+import de.ids_mannheim.korap.security.ac.PolicyDao;
+import de.ids_mannheim.korap.security.ac.ResourceFinder;
+import de.ids_mannheim.korap.security.ac.SecurityManager;
+import de.ids_mannheim.korap.user.User;
+
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author hanl
+ * @date 15/01/2016
+ */
+public class PolicyLoader implements BootupInterface {
+
+    @Override
+    public void load() throws KustvaktException {
+        PersistenceClient cl = BeanConfiguration.getBeans()
+                .getPersistenceClient();
+        Set<ResourceOperationIface> ifaces = new HashSet<>();
+        ifaces.add(new ResourceDao(cl));
+        ifaces.add(new CollectionDao(cl));
+
+        SecurityManager.setProviders(new PolicyDao(cl),
+                BeanConfiguration.getBeans().getEncryption(), ifaces);
+        ResourceFinder.setProviders(new PolicyDao(cl));
+
+        User user = User.UserFactory
+                .toUser(KustvaktConfiguration.KUSTVAKT_USER);
+        PolicyBuilder builder = new PolicyBuilder(user);
+        builder.addCondition("public");
+        builder.setResources(new Corpus("GOE", user.getId()));
+        builder.setPermissions(Permissions.PERMISSIONS.ALL);
+        builder.create();
+
+        // redundant if user is the user who created the condition for the resource
+        //        try {
+        //            ConditionManagement cm = new ConditionManagement(user);
+        ////            cm.addUser(user.getUsername(), new PolicyCondition("public"), true);
+        //        }catch (KustvaktException e) {
+        //            e.printStackTrace();
+        //        }
+    }
+
+    @Override
+    public int position() {
+        return -1;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/UserLoader.java b/src/main/java/de/ids_mannheim/korap/web/service/UserLoader.java
new file mode 100644
index 0000000..898b303
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/UserLoader.java
@@ -0,0 +1,33 @@
+package de.ids_mannheim.korap.web.service;
+
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.handlers.EntityDao;
+
+/**
+ * @author hanl
+ * @date 12/01/2016
+ */
+public class UserLoader implements BootupInterface {
+    @Override
+    public void load() throws KustvaktException {
+        boolean r = BeanConfiguration.hasContext();
+        if (r) {
+            EntityDao dao = new EntityDao(
+                    BeanConfiguration.getBeans().getPersistenceClient());
+
+            if (dao.size() > 0)
+                return;
+
+            BeanConfiguration.getBeans().getAuthenticationManager()
+                    .createUserAccount(KustvaktConfiguration.KUSTVAKT_USER,
+                            false);
+        }
+    }
+
+    @Override
+    public int position() {
+        return 0;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/AuthService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java
similarity index 92%
rename from src/main/java/de/ids_mannheim/korap/web/service/AuthService.java
rename to src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java
index 9c14f48..a357c67 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/AuthService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/AuthService.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.web.service;
+package de.ids_mannheim.korap.web.service.full;
 
 import com.sun.jersey.spi.container.ContainerRequest;
 import com.sun.jersey.spi.container.ResourceFilters;
@@ -72,6 +72,8 @@
         return Response.ok(JsonUtils.toJSON(m)).build();
     }
 
+
+    // fixme: moved to user
     @GET
     @Path("status")
     @ResourceFilters({ AuthFilter.class, DefaultFilter.class })
@@ -83,7 +85,6 @@
         return Response.ok(ctx.toJSON()).build();
     }
 
-    // todo: rename scope to scopes!
     @GET
     @Path("apiToken")
     public Response requestAPIToken(@Context HttpHeaders headers,
@@ -91,7 +92,7 @@
             @HeaderParam(ContainerRequest.USER_AGENT) String agent,
             @HeaderParam(ContainerRequest.HOST) String host,
             @HeaderParam("referer-url") String referer,
-            @QueryParam("scopes") String scopes) {
+            @QueryParam("scope") String scopes) {
         List<String> auth = headers
                 .getRequestHeader(ContainerRequest.AUTHORIZATION);
 
@@ -221,4 +222,22 @@
         }
         return Response.ok().entity(context.toJSON()).build();
     }
+
+    //fixme: moved from userservice
+    @GET
+    @Path("logout")
+    @ResourceFilters({ AuthFilter.class, DefaultFilter.class,
+            PiwikFilter.class })
+    public Response logout(@Context SecurityContext ctx,
+            @Context Locale locale) {
+        TokenContext context = (TokenContext) ctx.getUserPrincipal();
+        try {
+            controller.logout(context);
+        }catch (KustvaktException e) {
+            jlog.error("Logout Exception", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        return Response.ok().build();
+    }
+
 }
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/OAuthService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/OAuthService.java
similarity index 98%
rename from src/main/java/de/ids_mannheim/korap/web/service/OAuthService.java
rename to src/main/java/de/ids_mannheim/korap/web/service/full/OAuthService.java
index ae4c57e..a73ec3a 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/OAuthService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/OAuthService.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.web.service;
+package de.ids_mannheim.korap.web.service.full;
 
 import com.sun.jersey.spi.container.ContainerRequest;
 import com.sun.jersey.spi.container.ResourceFilters;
@@ -117,27 +117,25 @@
         return Response.ok(info.toJSON()).build();
     }
 
-    // todo: change parameter to scopes!
     @GET
     @Path("info")
     @ResourceFilters({ AuthFilter.class, DefaultFilter.class,
             PiwikFilter.class })
     public Response getStatus(@Context SecurityContext context,
-            @QueryParam("scopes") String scopes) {
+            @QueryParam("scope") String scopes) {
         TokenContext ctx = (TokenContext) context.getUserPrincipal();
         User user;
         try {
             user = this.controller.getUser(ctx.getUsername());
             this.controller.getUserDetails(user);
-            Set<String> base_scope = StringUtils
-                    .toSet((String) ctx.getParameters().get(Attributes.SCOPES),
-                            " ");
+            Set<String> base_scope = StringUtils.toSet(scopes, " ");
             base_scope.retainAll(StringUtils.toSet(scopes));
             scopes = StringUtils.toString(base_scope);
         }catch (KustvaktException e) {
             throw KustvaktResponseHandler.throwit(e);
         }
         // json format with scope callback parameter
+        // todo: add other scopes as well!
         return Response.ok(JsonUtils.toJSON(Scopes
                 .mapOpenIDConnectScopes(scopes, user.getDetails()))).build();
     }
@@ -174,7 +172,7 @@
             @Context SecurityContext context,
             @HeaderParam(ContainerRequest.USER_AGENT) String agent,
             @HeaderParam(ContainerRequest.HOST) String host,
-            MultivaluedMap<String, String> form)
+            MultivaluedMap<String, Object> form)
             throws OAuthSystemException, URISyntaxException {
         // user needs to be authenticated to this service!
         TokenContext c = (TokenContext) context.getUserPrincipal();
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
new file mode 100644
index 0000000..3ded56a
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
@@ -0,0 +1,1097 @@
+package de.ids_mannheim.korap.web.service.full;//package de.ids_mannheim.korap.ext.web;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.sun.jersey.core.util.MultivaluedMapImpl;
+import com.sun.jersey.spi.container.ResourceFilters;
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.exceptions.EmptyResultException;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.NotAuthorizedException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
+import de.ids_mannheim.korap.query.serialize.MetaQueryBuilder;
+import de.ids_mannheim.korap.query.serialize.QuerySerializer;
+import de.ids_mannheim.korap.resource.rewrite.FoundryInject;
+import de.ids_mannheim.korap.resource.rewrite.RewriteHandler;
+import de.ids_mannheim.korap.resources.*;
+import de.ids_mannheim.korap.security.ac.ResourceFinder;
+import de.ids_mannheim.korap.security.ac.ResourceHandler;
+import de.ids_mannheim.korap.security.ac.SecurityManager;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.CollectionQueryBuilder3;
+import de.ids_mannheim.korap.utils.JsonUtils;
+import de.ids_mannheim.korap.utils.KustvaktLogger;
+import de.ids_mannheim.korap.utils.StringUtils;
+import de.ids_mannheim.korap.web.ClientsHandler;
+import de.ids_mannheim.korap.web.KustvaktServer;
+import de.ids_mannheim.korap.web.SearchKrill;
+import de.ids_mannheim.korap.web.TRACE;
+import de.ids_mannheim.korap.web.filter.AuthFilter;
+import de.ids_mannheim.korap.web.filter.DefaultFilter;
+import de.ids_mannheim.korap.web.filter.PiwikFilter;
+import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
+import org.slf4j.Logger;
+
+import javax.ws.rs.*;
+import javax.ws.rs.core.*;
+import java.util.*;
+
+/**
+ * @author hanl
+ * @date 29/01/2014
+ */
+@Path(KustvaktServer.API_VERSION + "/")
+@ResourceFilters({ AuthFilter.class, DefaultFilter.class, PiwikFilter.class })
+@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+public class ResourceService {
+
+    private static Logger jlog = KustvaktLogger
+            .getLogger(ResourceService.class);
+
+    private SearchKrill searchKrill;
+    private ResourceHandler resourceHandler;
+    private AuthenticationManagerIface controller;
+    private ClientsHandler graphDBhandler;
+    private KustvaktConfiguration config;
+    private RewriteHandler processor;
+
+    public ResourceService() {
+        this.controller = BeanConfiguration.getBeans()
+                .getAuthenticationManager();
+        this.config = BeanConfiguration.getBeans().getConfiguration();
+        this.resourceHandler = new ResourceHandler();
+        this.searchKrill = new SearchKrill(config.getIndexDir());
+
+        UriBuilder builder = UriBuilder.fromUri("http://10.0.10.13").port(9997);
+        this.graphDBhandler = new ClientsHandler(builder.build());
+
+        this.processor = new RewriteHandler(config);
+        this.processor.add(FoundryInject.class);
+    }
+
+    /**
+     * retrieve resources dependent by type. determines based on
+     * the user's permission or resource owner if the user can access the resource.
+     *
+     * @param locale
+     * @param context
+     * @param type
+     * @return valid resources in json format
+     */
+    @GET
+    @Path("{type}")
+    public Response getResources(@Context Locale locale,
+            @Context SecurityContext context, @PathParam("type") String type) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        Set<KustvaktResource> resources = new HashSet<>();
+        type = StringUtils.normalize(type);
+        Class cl_type = ResourceFactory.getResourceClass(type);
+        if (cl_type == null) {
+            //todo return bad request response
+        }
+
+        try {
+            User user = controller.getUser(ctx.getUsername());
+
+            resources = ResourceFinder
+                    .search(user, ResourceFactory.getResourceClass(type));
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        Set values = new HashSet();
+        for (KustvaktResource resource : resources) {
+            // fixme: remove -- to costly
+            //            if (cl_type.equals(VirtualCollection.class)) {
+            //                VirtualCollection c = (VirtualCollection) resource;
+            //                CollectionQueryBuilder3 query = new CollectionQueryBuilder3();
+            //                query.setBaseQuery(c.getQuery());
+            //                String stats = searchKrill.getStatistics(query.toJSON());
+            //
+            //                c.setStats(JsonUtils.readSimple(stats, Map.class));
+            //
+            //            }else if (cl_type.equals(Corpus.class)) {
+            //                Corpus c = (Corpus) resource;
+            //                CollectionQueryBuilder3 query = new CollectionQueryBuilder3();
+            //                query.addQuery("corpusID=" + c.getPersistentID());
+            //                String stats = searchKrill.getStatistics(query.toJSON());
+            //                c.setStats(JsonUtils.readSimple(stats, Map.class));
+            //            }
+            values.add(resource.toMap());
+        }
+        return Response.ok(JsonUtils.toJSON(values)).build();
+    }
+
+    @GET
+    @Path("{type}/{id}/{child}")
+    public Response getResource(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id, @PathParam("child") String child) {
+        return getResource(context, locale, type,
+                StringUtils.joinResources(id, child));
+    }
+
+    /**
+     * @param context
+     * @param locale
+     * @param id
+     * @param type
+     * @return
+     */
+    @GET
+    @Path("{type}/{id}")
+    public Response getResource(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        type = StringUtils.normalize(type);
+        Class cl_type = ResourceFactory.getResourceClass(type);
+        KustvaktResource resource;
+        try {
+            User user = controller.getUser(ctx.getUsername());
+            if (StringUtils.isInteger(id))
+                resource = resourceHandler
+                        .findbyIntId(Integer.valueOf(id), user);
+            else
+                resource = resourceHandler.findbyStrId(id, user,
+                        ResourceFactory.getResourceClass(type));
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        CollectionQueryBuilder3 query = new CollectionQueryBuilder3();
+        if (cl_type.equals(VirtualCollection.class)) {
+            VirtualCollection c = (VirtualCollection) resource;
+            query.setBaseQuery(c.getQuery());
+        }else if (cl_type.equals(Corpus.class)) {
+            Corpus c = (Corpus) resource;
+            query.addQuery("corpusID=" + c.getPersistentID());
+        }
+
+        return Response.ok(JsonUtils.toJSON(resource.toMap())).build();
+    }
+
+    //    @GET
+    //    @Path("colloc")
+    //    public Response getCollocationsAll(@Context SecurityContext ctx,
+    //            @Context Locale locale, @QueryParam("props") String properties,
+    //            @QueryParam("sfskip") Integer sfs,
+    //            @QueryParam("sflimit") Integer limit, @QueryParam("q") String query,
+    //            @QueryParam("ql") String ql, @QueryParam("context") Integer context,
+    //            @QueryParam("foundry") String foundry,
+    //            @QueryParam("paths") Boolean wPaths) {
+    //        TokenContext tokenContext = (TokenContext) ctx.getUserPrincipal();
+    //        ColloQuery.ColloQueryBuilder builder;
+    //        CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+    //        String result;
+    //        try {
+    //            User user = controller.getUser(tokenContext.getUsername());
+    //            Set<VirtualCollection> resources = ResourceFinder
+    //                    .search(user, VirtualCollection.class);
+    //            for (KustvaktResource c : resources)
+    //                cquery.addResource(((VirtualCollection) c).getQuery());
+    //
+    //            builder = functions
+    //                    .buildCollocations(query, ql, properties, context, limit,
+    //                            sfs, foundry, new ArrayList<Dependency>(), wPaths,
+    //                            cquery);
+    //
+    //            result = graphDBhandler
+    //                    .getResponse("distCollo", "q", builder.build().toJSON());
+    //        }catch (KustvaktException e) {
+    //            throw KustvaktResponseHandler.throwit(e);
+    //        }catch (JsonProcessingException e) {
+    //            throw KustvaktResponseHandler.throwit(StatusCodes.ILLEGAL_ARGUMENT);
+    //        }
+    //        return Response.ok(result).build();
+    //    }
+
+    //    /**
+    //     * @param locale
+    //     * @param properties a json object string containing field, op and value for the query
+    //     * @param query
+    //     * @param context
+    //     * @return
+    //     */
+    //    @GET
+    //    @Path("{type}/{id}/colloc")
+    //    public Response getCollocations(@Context SecurityContext ctx,
+    //            @Context Locale locale, @QueryParam("props") String properties,
+    //            @QueryParam("sfskip") Integer sfs,
+    //            @QueryParam("sflimit") Integer limit, @QueryParam("q") String query,
+    //            @QueryParam("ql") String ql, @QueryParam("context") Integer context,
+    //            @QueryParam("foundry") String foundry,
+    //            @QueryParam("paths") Boolean wPaths, @PathParam("id") String id,
+    //            @PathParam("type") String type) {
+    //        ColloQuery.ColloQueryBuilder builder;
+    //        type = StringUtils.normalize(type);
+    //        id = StringUtils.decodeHTML(id);
+    //        TokenContext tokenContext = (TokenContext) ctx.getUserPrincipal();
+    //        String result;
+    //        try {
+    //            CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+    //            try {
+    //                User user = controller.getUser(tokenContext.getUsername());
+    //
+    //                KustvaktResource resource = this.resourceHandler
+    //                        .findbyStrId(id, user, type);
+    //
+    //                if (resource instanceof VirtualCollection)
+    //                    cquery.addResource(
+    //                            ((VirtualCollection) resource).getQuery());
+    //                else if (resource instanceof Corpus)
+    //                    cquery.addMetaFilter("corpusID",
+    //                            resource.getPersistentID());
+    //                else
+    //                    throw KustvaktResponseHandler
+    //                            .throwit(StatusCodes.ILLEGAL_ARGUMENT,
+    //                                    "Type parameter not supported", type);
+    //
+    //            }catch (KustvaktException e) {
+    //                throw KustvaktResponseHandler.throwit(e);
+    //            }catch (NumberFormatException ex) {
+    //                throw KustvaktResponseHandler
+    //                        .throwit(StatusCodes.ILLEGAL_ARGUMENT);
+    //            }
+    //
+    //            builder = functions
+    //                    .buildCollocations(query, ql, properties, context, limit,
+    //                            sfs, foundry, new ArrayList<Dependency>(), wPaths,
+    //                            cquery);
+    //
+    //            result = graphDBhandler
+    //                    .getResponse("distCollo", "q", builder.build().toJSON());
+    //
+    //        }catch (JsonProcessingException e) {
+    //            throw KustvaktResponseHandler.throwit(StatusCodes.ILLEGAL_ARGUMENT);
+    //        }catch (KustvaktException e) {
+    //            throw KustvaktResponseHandler.throwit(e);
+    //        }
+    //
+    //        return Response.ok(result).build();
+    //    }
+    @POST
+    @Path("colloc")
+    public Response getCollocatioBase(@QueryParam("q") String query) {
+        String result;
+        try {
+            result = graphDBhandler.getResponse("distCollo", "q", query);
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        return Response.ok(result).build();
+    }
+
+    @Deprecated
+    public Response postMatchFavorite() {
+        return Response.ok().build();
+    }
+
+    @TRACE
+    @Path("search")
+    public Response buildQuery(@Context Locale locale,
+            @Context SecurityContext securityContext, @QueryParam("q") String q,
+            @QueryParam("ql") String ql, @QueryParam("v") String v,
+            @QueryParam("context") String context,
+            @QueryParam("cutoff") Boolean cutoff,
+            @QueryParam("count") Integer pageLength,
+            @QueryParam("offset") Integer pageIndex,
+            @QueryParam("page") Integer startPage,
+            @QueryParam("ref") String reference, @QueryParam("cq") String cq) {
+        TokenContext ctx = (TokenContext) securityContext.getUserPrincipal();
+        QuerySerializer ss;
+        CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+        User user;
+        try {
+            user = controller.getUser(ctx.getUsername());
+            Set<Corpus> resources = ResourceFinder.search(user, Corpus.class);
+            for (KustvaktResource corpus : resources)
+                cquery.addQuery("corpusID=" + corpus.getPersistentID());
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        ss = new QuerySerializer().setQuery(q, ql, v);
+        if (cq != null)
+            ss.setCollection(cq);
+
+        MetaQueryBuilder meta = new MetaQueryBuilder();
+        if (pageIndex != null)
+            meta.addEntry("startIndex", pageIndex);
+        if (pageIndex == null && startPage != null)
+            meta.addEntry("startPage", startPage);
+        if (pageLength != null)
+            meta.addEntry("count", pageLength);
+        if (context != null)
+            meta.setSpanContext(context);
+        meta.addEntry("cutOff", cutoff);
+
+        ss.setMeta(meta);
+
+        String query = this.processor.preProcess(ss.toJSON(), user);
+        return Response.ok(query).build();
+    }
+
+    /**
+     * currently only supports either no reference at all in which case all corpora are retrieved or a corpus name like "WPD".
+     * No virtual collections supported!
+     *
+     * @param locale
+     * @param q
+     * @param ql
+     * @param v
+     * @param pageLength
+     * @param pageIndex
+     * @return
+     */
+    // todo: test
+    @TRACE
+    @Path("{type}/{id}/search")
+    public Response buildQuery(@Context Locale locale,
+            @Context SecurityContext securityContext, @QueryParam("q") String q,
+            @QueryParam("ql") String ql, @QueryParam("v") String v,
+            @QueryParam("context") String context,
+            @QueryParam("cutoff") Boolean cutoff,
+            @QueryParam("count") Integer pageLength,
+            @QueryParam("offset") Integer pageIndex,
+            @QueryParam("page") Integer startPage,
+            @PathParam("type") String type, @PathParam("id") String id,
+            @QueryParam("cq") String cq) {
+        TokenContext ctx = (TokenContext) securityContext.getUserPrincipal();
+        type = StringUtils.normalize(type);
+        id = StringUtils.decodeHTML(id);
+        QuerySerializer ss;
+        //fixme: not used anywhere!
+        CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+        if (cq != null)
+            cquery.setBaseQuery(cq);
+
+        try {
+            User user = controller.getUser(ctx.getUsername());
+
+            KustvaktResource resource;
+            if (StringUtils.isInteger(id))
+                resource = this.resourceHandler
+                        .findbyIntId(Integer.valueOf(id), user);
+            else
+                resource = this.resourceHandler.findbyStrId(id, user,
+                        ResourceFactory.getResourceClass(type));
+
+            if (resource instanceof VirtualCollection)
+                cquery.addQuery(((VirtualCollection) resource).getQuery());
+            else if (resource instanceof Corpus)
+                cquery.addQuery("corpusID=" + resource.getPersistentID());
+
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        ss = new QuerySerializer().setQuery(q, ql, v);
+
+        // todo: parse resources
+        if (cq != null)
+            ss.setCollection(cq);
+
+        MetaQueryBuilder meta = new MetaQueryBuilder();
+        if (pageIndex != null)
+            meta.addEntry("startIndex", pageIndex);
+        if (pageIndex == null && startPage != null)
+            meta.addEntry("startPage", startPage);
+        if (pageLength != null)
+            meta.addEntry("count", pageLength);
+        if (context != null)
+            meta.setSpanContext(context);
+        if (cutoff != null)
+            meta.addEntry("cutOff", cutoff);
+
+        ss.setMeta(meta.raw());
+
+        // todo: policy parsing before return
+        return Response.ok(ss.toJSON()).build();
+    }
+
+    @POST
+    @Path("search")
+    public Response queryRaw(@Context SecurityContext context,
+            @Context Locale locale, @QueryParam("engine") String engine,
+            String jsonld) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        //        KustvaktConfiguration.BACKENDS eng = KustvaktConfiguration
+        //                .chooseBackend(engine);
+
+        // todo: should be possible to add the meta part to the query serialization
+        try {
+            User user = controller.getUser(ctx.getUsername());
+            jsonld = this.processor.preProcess(jsonld, user);
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        jlog.info("Serialized search: {}", jsonld);
+
+        String result = searchKrill.search(jsonld);
+        KustvaktLogger.QUERY_LOGGER.trace("The result set: {}", result);
+        return Response.ok(result).build();
+    }
+
+    @GET
+    @Path("search")
+    public Response searchbyNameAll(@Context SecurityContext securityContext,
+            @Context Locale locale, @QueryParam("q") String q,
+            @QueryParam("ql") String ql, @QueryParam("v") String v,
+            @QueryParam("context") String ctx,
+            @QueryParam("cutoff") Boolean cutoff,
+            @QueryParam("count") Integer pageLength,
+            @QueryParam("offset") Integer pageIndex,
+            @QueryParam("page") Integer pageInteger,
+            @QueryParam("cq") String cq, @QueryParam("engine") String engine) {
+        TokenContext context = (TokenContext) securityContext
+                .getUserPrincipal();
+        CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+        KustvaktConfiguration.BACKENDS eng = this.config.chooseBackend(engine);
+        User user;
+        // todo: not added to query!!
+        try {
+            user = controller.getUser(context.getUsername());
+            Set<Corpus> resources = ResourceFinder.search(user, Corpus.class);
+            for (KustvaktResource resource : resources)
+                cquery.addQuery("corpusID=" + resource.getPersistentID());
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        String result;
+        QuerySerializer serializer = new QuerySerializer();
+        serializer.setQuery(q, ql, v);
+
+        // todo: parse for security reasons
+        if (cq != null)
+            serializer.setCollection(cq);
+
+        MetaQueryBuilder meta = new MetaQueryBuilder();
+        meta.addEntry("startIndex", pageIndex);
+        meta.addEntry("startPage", pageInteger);
+        meta.setSpanContext(ctx);
+        meta.addEntry("count", pageLength);
+        // todo: what happened to cutoff?
+        meta.addEntry("cutoff", cutoff);
+        //        meta.addMeta(pageIndex, pageInteger, pageLength, ctx, cutoff);
+        // fixme: should only apply to CQL queries per default!
+        //        meta.addEntry("itemsPerResource", 1);
+        serializer.setMeta(meta.raw());
+
+        // policy rewrite!
+        String query = this.processor.preProcess(serializer.toJSON(), user);
+
+        jlog.info("the serialized query {}", query);
+
+        if (eng.equals(KustvaktConfiguration.BACKENDS.NEO4J)) {
+            MultivaluedMap map = new MultivaluedMapImpl();
+            map.add("q", query);
+            map.add("count", String.valueOf(pageLength));
+            map.add("lctxs",
+                    String.valueOf(meta.getSpanContext().getLeft_size()));
+            map.add("rctxs",
+                    String.valueOf(meta.getSpanContext().getRight_size()));
+            try {
+                result = this.graphDBhandler.getResponse(map, "distKwic");
+            }catch (KustvaktException e) {
+                throw KustvaktResponseHandler.throwit(e);
+            }
+        }else
+            result = searchKrill.search(query);
+        KustvaktLogger.QUERY_LOGGER.trace("The result set: {}", result);
+        return Response.ok(result).build();
+    }
+
+    /**
+     * String search, String ql, List<String> parents,
+     * String cli, String cri, int cls, int crs,
+     * int num, int page, boolean cutoff)
+     * param context will be like this: context: "3-t,2-c"
+     * <p/>
+     * id does not have to be an integer. name is also possible, in which case a type reference is required
+     *
+     * @param securityContext
+     * @param locale
+     * @return
+     */
+    //fixme: does not use policyrewrite!
+    @GET
+    @Path("/{type}/{id}/search")
+    public Response searchbyName(@Context SecurityContext securityContext,
+            @Context Locale locale, @QueryParam("q") String query,
+            @QueryParam("ql") String ql, @QueryParam("v") String v,
+            @QueryParam("context") String ctx,
+            @QueryParam("cutoff") Boolean cutoff,
+            @QueryParam("count") Integer pageLength,
+            @QueryParam("offset") Integer pageIndex,
+            @QueryParam("page") Integer pageInteger, @PathParam("id") String id,
+            @PathParam("type") String type, @QueryParam("cq") String cq,
+            @QueryParam("raw") Boolean raw,
+            @QueryParam("engine") String engine) {
+        // ref is a virtual collection id!
+        TokenContext context = (TokenContext) securityContext
+                .getUserPrincipal();
+        KustvaktConfiguration.BACKENDS eng = this.config.chooseBackend(engine);
+        type = StringUtils.normalize(type);
+        id = StringUtils.decodeHTML(id);
+        raw = raw == null ? false : raw;
+
+        try {
+            User user = controller.getUser(context.getUsername());
+            MetaQueryBuilder meta = new MetaQueryBuilder();
+
+            if (!raw) {
+                QuerySerializer s = new QuerySerializer();
+                s.setQuery(query, ql, v);
+                CollectionQueryBuilder3 builder = new CollectionQueryBuilder3();
+
+                KustvaktResource resource;
+                if (StringUtils.isInteger(id))
+                    resource = this.resourceHandler
+                            .findbyIntId(Integer.valueOf(id), user);
+                else
+                    resource = this.resourceHandler.findbyStrId(id, user,
+                            ResourceFactory.getResourceClass(type));
+
+                if (resource instanceof VirtualCollection)
+                    builder.addQuery(((VirtualCollection) resource).getQuery());
+                else if (resource instanceof Corpus)
+                    builder.addQuery("corpusID=" + resource.getPersistentID());
+                else
+                    throw KustvaktResponseHandler
+                            .throwit(StatusCodes.ILLEGAL_ARGUMENT,
+                                    "Type parameter not supported", type);
+
+                //                functions.createQuery(id, type, user, query, ql, v);
+
+                meta.addEntry("startIndex", pageIndex);
+                meta.addEntry("startPage", pageInteger);
+                meta.setSpanContext(ctx);
+                meta.addEntry("count", pageLength);
+                // todo: what happened to cutoff?
+                meta.addEntry("cutoff", cutoff);
+                // should only apply to CQL queries
+                //                meta.addEntry("itemsPerResource", 1);
+                s.setMeta(meta);
+
+                query = s.toJSON();
+                //                PolicyParser parser = new PolicyParser(user);
+                //                query = parser.parse(s.toJSON());
+            }
+            String result;
+            try {
+
+                // rewrite process
+                query = this.processor.preProcess(query, user);
+
+                if (eng.equals(KustvaktConfiguration.BACKENDS.NEO4J)) {
+                    if (raw)
+                        throw KustvaktResponseHandler
+                                .throwit(StatusCodes.ILLEGAL_ARGUMENT,
+                                        "raw not supported!", null);
+                    MultivaluedMap map = new MultivaluedMapImpl();
+                    map.add("q", query);
+                    map.add("count", String.valueOf(pageLength));
+                    map.add("lctxs", String.valueOf(
+                            meta.getSpanContext().getLeft_size()));
+                    map.add("rctxs", String.valueOf(
+                            meta.getSpanContext().getRight_size()));
+                    result = this.graphDBhandler.getResponse(map, "distKwic");
+                }else
+                    result = searchKrill.search(query);
+
+            }catch (Exception e) {
+                KustvaktLogger.ERROR_LOGGER
+                        .error("Exception for serialized query: " + query, e);
+                throw KustvaktResponseHandler
+                        .throwit(500, e.getMessage(), null);
+            }
+
+            KustvaktLogger.QUERY_LOGGER.trace("The result set: {}", result);
+            return Response.ok(result).build();
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+    }
+
+    @POST
+    @Path("stats")
+    public Response getStats(@Context SecurityContext context,
+            @Context Locale locale, String json) {
+        CollectionQueryBuilder3 builder = new CollectionQueryBuilder3();
+        builder.addQuery(json);
+        String stats = searchKrill.getStatistics(builder.toJSON());
+
+        if (stats.contains("-1"))
+            throw KustvaktResponseHandler.throwit(StatusCodes.EMPTY_RESULTS);
+
+        return Response.ok(stats).build();
+    }
+
+    @GET
+    @Path("{type}/{id}/{child}/stats")
+    public Response getStatisticsbyName(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id, @PathParam("child") String child) {
+        return getStatisticsbyId(context, locale, type,
+                StringUtils.joinResources(id, child));
+    }
+
+    @GET
+    @Path("{type}/{id}/stats")
+    public Response getStatisticsbyId(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        type = StringUtils.normalize(type);
+        id = StringUtils.decodeHTML(id);
+
+        Class sl = ResourceFactory.getResourceClass(type);
+        if (!sl.equals(VirtualCollection.class) & !sl.equals(Corpus.class))
+            throw KustvaktResponseHandler.throwit(StatusCodes.ILLEGAL_ARGUMENT,
+                    "Requested Resource type not supported", type);
+
+        try {
+            User user = controller.getUser(ctx.getUsername());
+            KustvaktResource resource;
+            if (StringUtils.isInteger(id))
+                resource = this.resourceHandler
+                        .findbyIntId(Integer.valueOf(id), user);
+            else
+                resource = this.resourceHandler.findbyStrId(id, user,
+                        ResourceFactory.getResourceClass(type));
+
+            //todo ?!
+            CollectionQueryBuilder3 query = new CollectionQueryBuilder3();
+            if (resource instanceof VirtualCollection) {
+                query.setBaseQuery(((VirtualCollection) resource).getQuery());
+            }else if (resource instanceof Corpus) {
+                query.addQuery("corpusID=" + resource.getName());
+            }
+
+            // rewrite process
+            String qstr = this.processor.preProcess(query.toJSON(), user);
+            return Response.ok(searchKrill.getStatistics(qstr)).build();
+        }catch (KustvaktException e) {
+            e.printStackTrace();
+            throw KustvaktResponseHandler.throwit(e);
+        }
+    }
+
+    /**
+     * @param context
+     * @param locale
+     * @param json
+     * @return
+     */
+    //todo: rename
+    @POST
+    @Path("collection_raw")
+    public Response createRawCollection(@Context SecurityContext context,
+            @Context Locale locale, String json) {
+        TokenContext c = (TokenContext) context.getUserPrincipal();
+        VirtualCollection cache = ResourceFactory.getCachedCollection(json);
+        User user;
+        try {
+            user = controller.getUser(c.getUsername());
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        VirtualCollection tmp = resourceHandler
+                .getCache(cache.getId(), VirtualCollection.class);
+        if (tmp == null) {
+            CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3()
+                    .setBaseQuery(cache.getQuery());
+            String query = this.processor.preProcess(cache.getQuery(), user);
+            String stats = searchKrill.getStatistics(query);
+            cache.setStats(JsonUtils.readSimple(stats, Map.class));
+            resourceHandler.cache(cache);
+        }else
+            cache = tmp;
+
+        Map vals = new HashMap();
+        vals.put("id", cache.getId());
+        vals.put("statistics", cache.getStats());
+        return Response.ok(JsonUtils.toJSON(vals)).build();
+    }
+
+    @POST
+    @Path("{type}/{id}")
+    public Response updateResource(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id, String json) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        User user;
+        try {
+            user = controller.getUser(ctx.getUsername());
+            KustvaktResource resource = this.resourceHandler
+                    .findbyStrId(id, user,
+                            ResourceFactory.getResourceClass(type));
+            JsonNode node = JsonUtils.readTree(json);
+
+            if (node.isObject() && !node.path("name").isMissingNode()) {
+                String s = node.path("name").asText();
+                if (s.equals("null") || s.isEmpty())
+                    throw KustvaktResponseHandler
+                            .throwit(StatusCodes.ILLEGAL_ARGUMENT,
+                                    "Name must be set", "name");
+                resource.setName(s);
+            }
+
+            if (node.isObject() && !node.path("description").isMissingNode())
+                resource.setDescription(node.path("description").asText());
+            this.resourceHandler.updateResources(user, resource);
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        return Response.ok().build();
+    }
+
+    //todo: change or deprecate
+    @POST
+    @Path("nv/{type}")
+    public Response storeResource(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @QueryParam("name") String name,
+            @QueryParam("description") String description,
+            // deprecate -> if you want to store a resource based on another, build the query first yourself or via a function
+            @QueryParam("ref") String reference,
+            @QueryParam("cache") Boolean cache,
+            @QueryParam("query") String query) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        cache = cache != null ? cache : false;
+        type = StringUtils.normalize(type);
+        reference = StringUtils.decodeHTML(reference);
+        Map vals = new HashMap();
+        User user;
+        try {
+            user = controller.getUser(ctx.getUsername());
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        if (VirtualCollection.class
+                .equals(ResourceFactory.getResourceClass(type))) {
+            VirtualCollection cachetmp, collection;
+
+            String base;
+            if (reference != null && !reference.equals("null")) {
+                try {
+                    base = resourceHandler.findbyStrId(reference, user,
+                            VirtualCollection.class).getQuery();
+                }catch (KustvaktException e) {
+                    throw KustvaktResponseHandler.throwit(e);
+                }
+
+            }else if (query != null)
+                base = query;
+            else
+                // todo: throw exception response for no resource to save!
+                return null;
+
+            CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+            cquery.setBaseQuery(base);
+
+            cachetmp = ResourceFactory.getCachedCollection(cquery.toJSON());
+
+            // see if collection was cached!
+            VirtualCollection tmp = resourceHandler
+                    .getCache(cachetmp.getId(), VirtualCollection.class);
+            // if not cached, fill with stats values
+            if (tmp == null) {
+                String stats = searchKrill.getStatistics(cquery.toJSON());
+                cachetmp.setStats(JsonUtils.readSimple(stats, Map.class));
+            }
+
+            if (!cache) {
+                collection = ResourceFactory
+                        .getPermanentCollection(cachetmp, name, description,
+                                user.getId());
+                vals = collection.toMap();
+                try {
+                    resourceHandler.storeResources(user, collection);
+                }catch (KustvaktException e) {
+                    KustvaktLogger.ERROR_LOGGER
+                            .error("Exception encountered!", e);
+                    throw KustvaktResponseHandler.throwit(e);
+                }
+            }else {
+                resourceHandler.cache(cachetmp);
+                vals = cachetmp.toMap();
+            }
+        }
+        return Response.ok(JsonUtils.toJSON(vals)).build();
+    }
+
+    /**
+     * store a virtual collection. Retrieve cached entry first and then store VCollection
+     *
+     * @param context
+     * @param locale
+     * @param query
+     * @return
+     */
+    @POST
+    @Path("{type}")
+    public Response storeResource(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @QueryParam("filter") Boolean filter,
+            @QueryParam("name") String name,
+            @QueryParam("description") String description,
+            @QueryParam("ref") String reference,
+            @QueryParam("cache") Boolean cache, String query) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        filter = filter != null ? filter : false;
+        cache = cache != null ? cache : false;
+        type = StringUtils.normalize(type);
+        reference = StringUtils.decodeHTML(reference);
+        Map vals = new HashMap();
+        User user;
+        try {
+            user = controller.getUser(ctx.getUsername());
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        if (VirtualCollection.class
+                .equals(ResourceFactory.getResourceClass(type))) {
+
+            VirtualCollection cachetmp, collection;
+            Object read = JsonUtils.readTree(query);
+            CollectionQueryBuilder3 cquery = new CollectionQueryBuilder3();
+            if (reference != null && !reference.equals("null")) {
+                try {
+                    cquery.addQuery(resourceHandler.findbyStrId(reference, user,
+                            VirtualCollection.class).getQuery());
+                }catch (KustvaktException e) {
+                    throw KustvaktResponseHandler.throwit(e);
+                }
+                // todo: 11.01
+                //                if (!filter)
+                //                    cquery.addMetaExtendQuery(query);
+                //                else
+                //                    cquery.addMetaFilterQuery(query);
+                //            }else {
+                //                if (read != null)
+                //                    cquery.addResource(query);
+                //                else
+                //                    cquery.addMetaFilterQuery(query);
+            }
+            cachetmp = ResourceFactory.getCachedCollection(cquery.toJSON());
+
+            // see if vc was cached!
+            VirtualCollection tmp = resourceHandler
+                    .getCache(cachetmp.getId(), VirtualCollection.class);
+
+            // if not cached, fill with stats values
+            if (tmp == null) {
+                String stats = searchKrill.getStatistics(cquery.toJSON());
+                cachetmp.setStats(JsonUtils.readSimple(stats, Map.class));
+            }
+
+            if (!cache && !user.isDemo()) {
+                collection = ResourceFactory
+                        .getPermanentCollection(cachetmp, name, description,
+                                user.getId());
+                vals = collection.toMap();
+                try {
+                    resourceHandler.storeResources(user, collection);
+                }catch (KustvaktException e) {
+                    KustvaktLogger.ERROR_LOGGER
+                            .error("Exception encountered!", e);
+                    throw KustvaktResponseHandler.throwit(e);
+                }
+            }else {
+                resourceHandler.cache(cachetmp);
+                vals = cachetmp.toMap();
+            }
+        }
+        return Response.ok(JsonUtils.toJSON(vals)).build();
+    }
+
+    @DELETE
+    @Path("{type}/{id}/{child}")
+    public Response deleteResourcewChild(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id, @PathParam("child") String child) {
+        return deleteResource(context, locale, type,
+                StringUtils.joinResources(id, child));
+    }
+
+    @DELETE
+    @Path("{type}/{id}")
+    public Response deleteResource(@Context SecurityContext context,
+            @Context Locale locale, @PathParam("type") String type,
+            @PathParam("id") String id) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        type = StringUtils.normalizeHTML(type);
+        id = StringUtils.decodeHTML(id);
+        try {
+            User user = controller.getUser(ctx.getUsername());
+            KustvaktResource r = ResourceFactory.getResource(type);
+            r.setPersistentID(id);
+            //todo: eliminate the need to find the resource first!
+            resourceHandler.deleteResources(user, r);
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        return Response.ok().build();
+    }
+
+    //fixme: only allowed for corpus?!
+    @GET
+    @Path("/corpus/{id}/{docid}/{rest}/matchInfo")
+    public Response getMatchInfo(@Context SecurityContext ctx,
+            @Context Locale locale, @PathParam("id") String id,
+            @PathParam("docid") String docid, @PathParam("rest") String rest,
+            @QueryParam("foundry") Set<String> foundries,
+            @QueryParam("layer") Set<String> layers,
+            @QueryParam("spans") Boolean spans) {
+        TokenContext tokenContext = (TokenContext) ctx.getUserPrincipal();
+        spans = spans != null ? spans : false;
+        String matchid = searchKrill.getMatchId(id, docid, rest);
+
+        if (layers == null || layers.isEmpty())
+            layers = new HashSet<>();
+
+        boolean match_only = foundries == null || foundries.isEmpty();
+
+        User user;
+        try {
+            user = controller.getUser(tokenContext.getUsername());
+        }catch (KustvaktException e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        String results;
+        // fixme: checks for policy matching
+        // fixme: currently disabled, due to mishab in foundry/layer spec
+        // fixme:
+        if (foundries != null && foundries.size() > 1000) {
+            Set<String> f_list = new HashSet<>();
+            Set<String> l_list = new HashSet<>();
+
+            for (String spl : new ArrayList<>(foundries)) {
+                try {
+                    de.ids_mannheim.korap.security.ac.SecurityManager manager = SecurityManager
+                            .init(spl, user, Permissions.PERMISSIONS.READ);
+                    if (!manager.isAllowed())
+                        continue;
+
+                    String[] sep = StringUtils.splitAnnotations(spl);
+                    if (spl != null) {
+                        f_list.add(sep[0]);
+                        l_list.add(sep[1]);
+                    }
+                    results = searchKrill
+                            .getMatch(matchid, new ArrayList<>(f_list),
+                                    new ArrayList<>(l_list), spans, false,
+                                    true);
+                }catch (EmptyResultException e) {
+                    throw KustvaktResponseHandler
+                            .throwit(StatusCodes.EMPTY_RESULTS,
+                                    "Resource not found!", id);
+                }catch (NotAuthorizedException e) {
+                    throw KustvaktResponseHandler
+                            .throwit(StatusCodes.PERMISSION_DENIED,
+                                    "Permission denied", id);
+                }
+
+            }
+            // all foundries shall be returned
+        }else if (foundries != null && foundries.contains("*")) {
+            Set<Layer> resources;
+            try {
+                resources = ResourceFinder.search(user, Layer.class);
+            }catch (KustvaktException e) {
+                KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+                throw KustvaktResponseHandler.throwit(e);
+            }
+            // returns foundries and layers.
+            // todo: needs testing!
+            foundries = new HashSet<>();
+            layers = new HashSet<>();
+            for (Layer r : resources) {
+                String[] spl = StringUtils.splitAnnotations(r.getName());
+                if (spl != null) {
+                    foundries.add(spl[0]);
+                    layers.add(spl[1]);
+                }
+            }
+        }
+        try {
+            if (!match_only)
+                results = searchKrill
+                        .getMatch(matchid, new ArrayList<>(foundries),
+                                new ArrayList<>(layers), spans, false, true);
+            else
+                results = searchKrill.getMatch(matchid);
+        }catch (Exception e) {
+            KustvaktLogger.ERROR_LOGGER.error("Exception encountered!", e);
+            throw KustvaktResponseHandler
+                    .throwit(StatusCodes.ILLEGAL_ARGUMENT, e.getMessage(), "");
+        }
+        return Response.ok(results).build();
+    }
+
+    // todo:?!
+    @POST
+    @Path("match/{id}/save")
+    @Deprecated
+    public Response save(@PathParam("{id}") String id,
+            @QueryParam("d") String description,
+            @Context SecurityContext context) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        // save match for user and later retrieval!
+
+        //        KustvaktResource match = new QueryMatch(id);
+        //        match.setDescription(description);
+        //        match.setCreated(TimeUtils.getNow().getMillis());
+        //        try {
+        //            this.resourceHandler.storeResources(controller.getUser(ctx), match);
+        //        } catch (KustvaktException | NotAuthorizedException e) {
+        //            throw MappedHTTPResponse.throwit(e);
+        //        }
+
+        return Response.ok().build();
+    }
+
+    @GET
+    @Path("matches")
+    @Deprecated
+    public Response get(@Context SecurityContext context) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        //todo save match for user and later retrieval!
+        //todo: retrieve matches in range! --choices: date, document, id (matchid)
+        return Response.ok().build();
+    }
+
+    @POST
+    @Path("match/{id}/delete")
+    @Deprecated
+    public Response remove(@PathParam("{id}") String id,
+            @Context SecurityContext context) {
+        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+        // save match for user and later retrieval!
+        try {
+            this.resourceHandler
+                    .deleteResources(this.controller.getUser(ctx.getUsername()),
+                            id);
+        }catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        return Response.ok().build();
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/UserService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/UserService.java
similarity index 85%
rename from src/main/java/de/ids_mannheim/korap/web/service/UserService.java
rename to src/main/java/de/ids_mannheim/korap/web/service/full/UserService.java
index fd221a4..dceb241 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/UserService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/UserService.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.web.service;
+package de.ids_mannheim.korap.web.service.full;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
@@ -10,7 +10,6 @@
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
-import de.ids_mannheim.korap.security.ac.ResourceHandler;
 import de.ids_mannheim.korap.user.*;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import de.ids_mannheim.korap.utils.KustvaktLogger;
@@ -18,16 +17,15 @@
 import de.ids_mannheim.korap.utils.TimeUtils;
 import de.ids_mannheim.korap.web.KustvaktServer;
 import de.ids_mannheim.korap.web.filter.AuthFilter;
+import de.ids_mannheim.korap.web.filter.BlockingFilter;
 import de.ids_mannheim.korap.web.filter.DefaultFilter;
 import de.ids_mannheim.korap.web.filter.PiwikFilter;
 import de.ids_mannheim.korap.web.utils.FormRequestWrapper;
 import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
 import org.slf4j.Logger;
 
-import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.*;
 import javax.ws.rs.core.*;
-import java.io.IOException;
 import java.util.*;
 
 /**
@@ -44,7 +42,6 @@
     private static Logger jlog = KustvaktLogger
             .getLogger(KustvaktLogger.SECURITY_LOG);
     private AuthenticationManagerIface controller;
-    private ResourceHandler resourceHandler;
 
     private
     @Context
@@ -53,7 +50,6 @@
     public UserService() {
         this.controller = BeanConfiguration.getBeans()
                 .getAuthenticationManager();
-        //        this.resourceHandler = BeanConfiguration.getResourceHandler();
     }
 
     // fixme: json contains password in clear text. Encrypt request?
@@ -62,18 +58,17 @@
     @Path("register")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response signUp(
-            @Context HttpServletRequest request,
             @HeaderParam(ContainerRequest.USER_AGENT) String agent,
             @HeaderParam(ContainerRequest.HOST) String host,
             @Context Locale locale, MultivaluedMap form_values) {
-
-        FormRequestWrapper wrapper = new FormRequestWrapper(request, form_values);
+        Map<String, Object> wrapper = FormRequestWrapper
+                .toMap(form_values, true);
 
         wrapper.put(Attributes.HOST, host);
         wrapper.put(Attributes.USER_AGENT, agent);
         UriBuilder uriBuilder;
         User user;
-        if (wrapper.getParameter(Attributes.EMAIL) == null)
+        if (wrapper.get(Attributes.EMAIL) == null)
             throw KustvaktResponseHandler
                     .throwit(StatusCodes.ILLEGAL_ARGUMENT, "parameter missing",
                             "email");
@@ -83,7 +78,7 @@
             uriBuilder.path(KustvaktServer.API_VERSION).path("user")
                     .path("confirm");
 
-            user = controller.createUserAccount(wrapper.toMap(true));
+            user = controller.createUserAccount(wrapper, true);
 
         }catch (KustvaktException e) {
             throw KustvaktResponseHandler.throwit(e);
@@ -103,7 +98,8 @@
             return Response.ok(JsonUtils.toJSON(object)).build();
         }else {
             // todo: return error or warning
-            return null;
+            throw KustvaktResponseHandler.throwit(StatusCodes.ILLEGAL_ARGUMENT,
+                    "failed to validate uri paramter", "confirmation fragment");
         }
 
     }
@@ -137,11 +133,11 @@
     @Produces(MediaType.TEXT_HTML)
     public Response confirmRegistration(@QueryParam("uri") String uritoken,
             @Context Locale locale, @QueryParam("user") String username) {
-        if (uritoken == null)
+        if (uritoken == null || uritoken.isEmpty())
             throw KustvaktResponseHandler
                     .throwit(StatusCodes.ILLEGAL_ARGUMENT, "parameter missing",
-                            "Uri-Token");
-        if (username == null)
+                            "uri parameter");
+        if (username == null || username.isEmpty())
             throw KustvaktResponseHandler
                     .throwit(StatusCodes.ILLEGAL_ARGUMENT, "parameter missing",
                             "Username");
@@ -149,8 +145,8 @@
         try {
             controller.confirmRegistration(uritoken, username);
         }catch (KustvaktException e) {
-            throw KustvaktResponseHandler
-                    .throwit(e);
+            e.printStackTrace();
+            throw KustvaktResponseHandler.throwit(e);
         }
         return Response.ok("success").build();
     }
@@ -216,25 +212,26 @@
 
     @GET
     @Path("info")
-    @ResourceFilters({ AuthFilter.class, DefaultFilter.class,
-            PiwikFilter.class })
+    @ResourceFilters({ AuthFilter.class, DefaultFilter.class, PiwikFilter.class,
+            BlockingFilter.class })
     public Response getStatus(@Context SecurityContext context,
-            @QueryParam("scopes") String scope) {
+            @QueryParam("scopes") String scopes) {
         TokenContext ctx = (TokenContext) context.getUserPrincipal();
         User user;
         try {
             user = controller.getUser(ctx.getUsername());
             controller.getUserDetails(user);
-            Set<String> base_scope = StringUtils
-                    .toSet((String) ctx.getParameters().get(Attributes.SCOPES),
-                            " ");
-            base_scope.retainAll(StringUtils.toSet(scope));
-            scope = StringUtils.toString(base_scope);
+            Set<String> base_scope = StringUtils.toSet(scopes, " ");
+            if (scopes != null)
+                base_scope.retainAll(StringUtils.toSet(scopes));
+            scopes = StringUtils.toString(base_scope);
         }catch (KustvaktException e) {
             throw KustvaktResponseHandler.throwit(e);
         }
-        return Response.ok(JsonUtils.toJSON(Scopes
-                .mapOpenIDConnectScopes(scope, user.getDetails()))).build();
+        Map m = Scopes.mapOpenIDConnectScopes(scopes, user.getDetails());
+        m.put("scopes", scopes);
+
+        return Response.ok(JsonUtils.toJSON(m)).build();
     }
 
     @GET
@@ -264,21 +261,15 @@
     @ResourceFilters({ AuthFilter.class, DefaultFilter.class,
             PiwikFilter.class })
     public Response updateSettings(@Context SecurityContext context,
-            @Context Locale locale, String values) {
+            @Context Locale locale, MultivaluedMap<String, Object> form) {
         TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        Map<String, Object> settings;
-        try {
-            settings = JsonUtils.read(values, Map.class);
-        }catch (IOException e) {
-            throw KustvaktResponseHandler
-                    .throwit(StatusCodes.REQUEST_INVALID,
-                            "Could not read parameters", values);
-        }
+        Map<String, Object> settings = FormRequestWrapper.toMap(form, false);
 
         try {
             User user = controller.getUser(ctx.getUsername());
             UserSettings us = controller.getUserSettings(user);
-            // todo:
+            // todo: check setting only within the scope of user settings permissions; not foundry range. Latter is part of
+            // frontend which only displays available foundries and
             //            SecurityManager.findbyId(us.getDefaultConstfoundry(), user, Foundry.class);
             //            SecurityManager.findbyId(us.getDefaultLemmafoundry(), user, Foundry.class);
             //            SecurityManager.findbyId(us.getDefaultPOSfoundry(), user, Foundry.class);
@@ -320,24 +311,15 @@
     @ResourceFilters({ AuthFilter.class, DefaultFilter.class,
             PiwikFilter.class })
     public Response updateDetails(@Context SecurityContext context,
-            @Context Locale locale, String values) {
+            @Context Locale locale, MultivaluedMap form) {
         TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        System.out.println("TO BE UPDATED DATA " + values);
-        System.out.println("USER CONTEXT " + ctx);
-        Map<String, String> details;
-        try {
-            details = JsonUtils.read(values, Map.class);
-        }catch (IOException e) {
-            error.error("Exception encountered!", e);
-            throw KustvaktResponseHandler
-                    .throwit(StatusCodes.REQUEST_INVALID,
-                            "Could not read parameters", values);
-        }
+
+        Map<String, Object> wrapper = FormRequestWrapper.toMap(form, true);
 
         try {
             User user = controller.getUser(ctx.getUsername());
             UserDetails det = controller.getUserDetails(user);
-            det.updateDetails(details);
+            det.updateDetails(wrapper);
             controller.updateUserDetails(user, det);
             if (user.isDemo())
                 return Response.notModified().build();
@@ -441,20 +423,4 @@
         }
         return Response.ok(queryStr).build();
     }
-
-    @GET
-    @Path("logout")
-    @ResourceFilters({ AuthFilter.class, DefaultFilter.class,
-            PiwikFilter.class })
-    public Response logout(@Context SecurityContext ctx,
-            @Context Locale locale) {
-        TokenContext context = (TokenContext) ctx.getUserPrincipal();
-        try {
-            controller.logout(context);
-        }catch (KustvaktException e) {
-            error.error("Logout Exception", e);
-            throw KustvaktResponseHandler.throwit(e);
-        }
-        return Response.ok().build();
-    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java b/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java
index a70ef91..f526c63 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java
@@ -9,8 +9,8 @@
 import de.ids_mannheim.korap.query.serialize.MetaQueryBuilder;
 import de.ids_mannheim.korap.query.serialize.QuerySerializer;
 import de.ids_mannheim.korap.resource.rewrite.FoundryInject;
-import de.ids_mannheim.korap.resource.rewrite.PublicCollection;
 import de.ids_mannheim.korap.resource.rewrite.RewriteHandler;
+import de.ids_mannheim.korap.utils.CollectionQueryBuilder3;
 import de.ids_mannheim.korap.utils.KustvaktLogger;
 import de.ids_mannheim.korap.web.ClientsHandler;
 import de.ids_mannheim.korap.web.SearchKrill;
@@ -49,7 +49,6 @@
         this.graphDBhandler = new ClientsHandler(builder.build());
         this.processor = new RewriteHandler(config);
         this.processor.add(FoundryInject.class);
-        this.processor.add(PublicCollection.class);
     }
 
     /**
@@ -107,7 +106,6 @@
         // todo: should be possible to add the meta part to the query serialization
         jlog.info("Serialized search: {}", jsonld);
 
-        // fixme: to use the systemarchitecture pointcut thingis, searchkrill must be injected via
         String result = searchKrill.search(jsonld);
         KustvaktLogger.QUERY_LOGGER.trace("The result set: {}", result);
         return Response.ok(result).build();
@@ -238,11 +236,11 @@
     @POST
     @Path("stats")
     public Response getStats(String json) {
-        //        CollectionQueryBuilder builder = new CollectionQueryBuilder();
-        //        builder.addResource(json);
+        CollectionQueryBuilder3 builder = new CollectionQueryBuilder3();
+        builder.addQuery(json);
 
         // todo: policy override in extension!
-        String stats = searchKrill.getStatistics(json);
+        String stats = searchKrill.getStatistics(builder.toJSON());
         if (stats.contains("-1"))
             throw KustvaktResponseHandler.throwit(StatusCodes.EMPTY_RESULTS);
 
@@ -276,4 +274,5 @@
 
         return Response.ok(results).build();
     }
+
 }
diff --git a/src/main/java/de/ids_mannheim/korap/web/utils/FormRequestWrapper.java b/src/main/java/de/ids_mannheim/korap/web/utils/FormRequestWrapper.java
index 05a1bb5..6a07ba3 100644
--- a/src/main/java/de/ids_mannheim/korap/web/utils/FormRequestWrapper.java
+++ b/src/main/java/de/ids_mannheim/korap/web/utils/FormRequestWrapper.java
@@ -3,7 +3,9 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;
 import javax.ws.rs.core.MultivaluedMap;
-import java.util.*;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
 
 /**
  * Helper class to wrapp multivaluedmap into a hashmap. Depending on the strict parameter,
@@ -14,7 +16,7 @@
  */
 public class FormRequestWrapper extends HttpServletRequestWrapper {
 
-    private MultivaluedMap<String, String> form;
+    private MultivaluedMap<String, Object> form;
 
     /**
      * Constructs a request object wrapping the given request.
@@ -23,7 +25,7 @@
      * @throws IllegalArgumentException if the request is null
      */
     public FormRequestWrapper(HttpServletRequest request,
-            MultivaluedMap<String, String> form) {
+            MultivaluedMap<String, Object> form) {
         super(request);
         this.form = form;
     }
@@ -32,7 +34,7 @@
     public String getParameter(String name) {
         String value = super.getParameter(name);
         if (value == null)
-            value = form.getFirst(name);
+            value = String.valueOf(form.getFirst(name));
         return value;
     }
 
@@ -46,13 +48,22 @@
         return values;
     }
 
-    public HashMap<String, Object> toMap(boolean strict) {
+    public Map<String, Object> singleValueMap() {
+        return toMap(this.form, false);
+    }
+
+    /**
+     * @param strict returns only values with size equal to one. If false pairs key to first value
+     *               in value list and returns the result
+     * @return key/value map
+     */
+    public static Map<String, Object> toMap(MultivaluedMap<String, Object> form,
+            boolean strict) {
         HashMap<String, Object> map = new HashMap<>();
-        for (Map.Entry<String, List<String>> e : form.entrySet()) {
-            if (e.getValue().size() == 1)
-                map.put(e.getKey(), e.getValue().get(0));
-            else if (!strict)
-                map.put(e.getKey(), e.getValue());
+        for (String key : form.keySet()) {
+            if (strict && form.get(key).size() > 1)
+                continue;
+            map.put(key, form.getFirst(key));
         }
         return map;
     }
@@ -62,7 +73,7 @@
     }
 
     public void put(String key, String... values) {
-        this.form.put(key, Arrays.asList(values));
+        this.form.put(key, Arrays.<Object>asList(values));
     }
 
 }
diff --git a/src/main/java/de/ids_mannheim/korap/web/utils/FormWrapper.java b/src/main/java/de/ids_mannheim/korap/web/utils/FormWrapper.java
deleted file mode 100644
index f099158..0000000
--- a/src/main/java/de/ids_mannheim/korap/web/utils/FormWrapper.java
+++ /dev/null
@@ -1,37 +0,0 @@
-package de.ids_mannheim.korap.web.utils;
-
-import javax.ws.rs.core.MultivaluedMap;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-/**
- * Helper class to wrapp multivaluedmap into a hashmap. Depending on the strict parameter,
- * list values are retained in the resulting wrapper map.
- *
- * @author hanl
- * @date 18/05/2015
- */
-@Deprecated
-public class FormWrapper extends HashMap<String, Object> {
-
-    public FormWrapper(MultivaluedMap form, boolean strict) {
-        super(toMap(form, strict));
-    }
-
-    public FormWrapper(MultivaluedMap form) {
-        super(toMap(form, true));
-    }
-
-    private static HashMap<String, Object> toMap(MultivaluedMap<String, Object> form,
-            boolean strict) {
-        HashMap<String, Object> map = new HashMap<>();
-        for (Map.Entry<String, List<Object>> e : form.entrySet()) {
-            if (e.getValue().size() == 1)
-                map.put(e.getKey(), e.getValue().get(0));
-            else if (!strict)
-                map.put(e.getKey(), e.getValue());
-        }
-        return map;
-    }
-}
diff --git a/src/main/resources/db/mysql/V0.1__userdatabase.sql b/src/main/resources/db/mysql/V0.1__userdatabase.sql
new file mode 100644
index 0000000..6444651
--- /dev/null
+++ b/src/main/resources/db/mysql/V0.1__userdatabase.sql
@@ -0,0 +1,104 @@
+-- rename all columns in new way!
+CREATE TABLE IF NOT EXISTS korap_users (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    username VARCHAR(100) NOT NULL UNIQUE,
+    password VARCHAR(100) NOT NULL,
+    account_lock boolean NOT NULL,
+    account_creation BIGINT NOT NULL,
+    type INTEGER DEFAULT 0,
+    uri_fragment VARCHAR(100),
+    uri_expiration BIGINT,
+    loginSuccess INTEGER,
+    loginFailed INTEGER,
+    account_link VARCHAR(100)
+);
+
+CREATE TABLE IF NOT EXISTS shib_users (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    username VARCHAR(100) NOT NULL UNIQUE,
+    account_creation BIGINT NOT NULL,
+    type INTEGER DEFAULT 1,
+    loginSuccess INTEGER,
+    loginFailed INTEGER,
+    account_link VARCHAR(100)
+);
+
+CREATE TABLE IF NOT EXISTS user_details (
+    Id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    user_id INTEGER NOT NULL UNIQUE,
+    firstName VARCHAR(100),
+    lastName VARCHAR(100),
+    gender VARCHAR(100),
+    phone VARCHAR(100),
+    institution VARCHAR(100),
+    email VARCHAR(100),
+    address VARCHAR(100),
+    country VARCHAR(100),
+    privateUsage BOOLEAN,
+    foreign key (user_id)
+    references korap_users (id)
+    on delete cascade
+);
+
+CREATE TABLE IF NOT EXISTS user_settings (
+    Id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    user_id INTEGER NOT NULL UNIQUE,
+    fileNameForExport VARCHAR(100),
+    itemForSimpleAnnotation INTEGER,
+    leftContextItemForExport VARCHAR(100),
+    leftContextSizeForExport INTEGER,
+    locale VARCHAR(100),
+    leftContextItem VARCHAR(100),
+    leftContextSize INTEGER,
+    rightContextItem VARCHAR(100),
+    rightContextItemForExport VARCHAR(100),
+    rightContextSize INTEGER,
+    rightContextSizeForExport INTEGER,
+    selectedCollection VARCHAR(100),
+    queryLanguage VARCHAR(100),
+    pageLength INTEGER,
+    metadataQueryExpertModus BOOLEAN,
+    searchSettingsTab INTEGER,
+    selectedGraphType INTEGER,
+    selectedSortType VARCHAR(100),
+    selectedViewForSearchResults VARCHAR(100),
+    POSFoundry VARCHAR(100),
+    lemmaFoundry VARCHAR(100),
+    constFoundry VARCHAR(100),
+    relFoundry VARCHAR(100),
+    collectData BOOLEAN,
+    foreign key (user_id)
+    references korap_users (id)
+    on delete cascade
+);
+
+-- deprecated
+CREATE OR REPLACE VIEW allusers AS
+    SELECT
+        id,
+        username,
+        password,
+        account_lock,
+        account_creation,
+        type,
+        uri_fragment,
+        uri_expiration,
+        loginSuccess,
+        loginFailed,
+        account_link
+    from
+        korap_users
+    UNION ALL SELECT
+        id,
+        username,
+        NULL as password,
+        NULL as account_lock,
+        account_creation,
+        type,
+        NULL as uri_fragment,
+        NULL as uri_expiration,
+        loginSuccess,
+        loginFailed,
+        account_link
+    from
+        shib_users;
diff --git a/src/main/resources/db/mysql/V0.2__resourcesdatabase.sql b/src/main/resources/db/mysql/V0.2__resourcesdatabase.sql
new file mode 100644
index 0000000..01b8c26
--- /dev/null
+++ b/src/main/resources/db/mysql/V0.2__resourcesdatabase.sql
@@ -0,0 +1,60 @@
+-- why unsigned?
+CREATE TABLE IF NOT EXISTS resource_store (
+id INTEGER PRIMARY KEY AUTO_INCREMENT,
+persistent_id VARCHAR(100) NOT NULL UNIQUE,
+name VARCHAR(100),
+description VARCHAR(300),
+parent_id Integer unsigned null,
+created BIGINT NOT NULL,
+type INTEGER NOT NULL,
+creator INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS resource_tree (
+parent_id INTEGER,
+child_id INTEGER,
+depth INTEGER,
+name_path VARCHAR(250),
+PRIMARY KEY (parent_id , child_id),
+foreign key (parent_id)
+references resource_store (id)
+on delete cascade,
+foreign key (child_id)
+references resource_store (id)
+on delete cascade
+);
+
+
+CREATE TABLE IF NOT EXISTS user_queries (
+    id INTEGER PRIMARY KEY,
+    queryLanguage VARCHAR(100),
+    name VARCHAR(100),
+    query VARCHAR(200),
+    description VARCHAR(150),
+    foreign key (id)
+    references resource_store(id)
+    on delete cascade
+);
+
+CREATE TABLE IF NOT EXISTS coll_store (
+    id INTEGER,
+    query VARCHAR(500),
+    user_id INTEGER,
+    created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    -- is foreign key constraint valid after refactoring?
+    foreign key (id) references resource_store(id)
+    on delete cascade);
+
+
+CREATE TABLE IF NOT EXISTS matchInfo (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    user_id BIGINT NOT NULL,
+    matchInfo VARCHAR(100)
+);
+
+CREATE TABLE IF NOT EXISTS doc_store (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    persistent_id VARCHAR(100) UNIQUE,
+    created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    disabled BOOLEAN default true
+);
\ No newline at end of file
diff --git a/src/main/resources/db/mysql/V0.3__securitydatabase.sql b/src/main/resources/db/mysql/V0.3__securitydatabase.sql
new file mode 100644
index 0000000..b7d826b
--- /dev/null
+++ b/src/main/resources/db/mysql/V0.3__securitydatabase.sql
@@ -0,0 +1,135 @@
+-- last_modified timestamp ON UPDATE CURRENT_TIMESTAMP,
+CREATE TABLE IF NOT EXISTS policy_store (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    target_id BIGINT NOT NULL,
+    created TIMESTAMP,
+    creator INTEGER NOT NULL,
+    posix SMALLINT NOT NULL,
+    expire TIMESTAMP NULL,
+    enable TIMESTAMP NULL,
+    iprange VARCHAR(200)
+);
+
+CREATE TABLE IF NOT EXISTS group_ref (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    group_id VARCHAR(100) NOT NULL,
+    policy_id INTEGER NOT NULL
+);
+
+
+CREATE TABLE IF NOT EXISTS group_store (
+    name VARCHAR(100) PRIMARY KEY,
+    description VARCHAR(200),
+    sym_use INTEGER DEFAULT -1,
+    export VARCHAR(30) DEFAULT NULL,
+    query_only VARCHAR(30) DEFAULT NULL,
+    licence INTEGER DEFAULT -1,
+    -- basically every resource we have is an academic resource, thus a non-commercial use is infered!
+    commercial BOOLEAN DEFAULT FALSE
+);
+
+CREATE TABLE IF NOT EXISTS group_users (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    user_id BIGINT NOT NULL,
+    -- make integer
+    group_id VARCHAR(100) NOT NULL,
+    admin BOOLEAN NOT NULL DEFAULT FALSE,
+    FOREIGN KEY (group_id)
+        REFERENCES group_store (name) on delete cascade
+);
+
+CREATE TABLE IF NOT EXISTS param_store (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    p_key VARCHAR(100) NOT NULL,
+    p_value VARCHAR(150) NOT NULL,
+    resource INTEGER DEFAULT -1,
+    pid INTEGER DEFAULT -1,
+    FOREIGN KEY (resource)
+        REFERENCES resource_store(id)
+    on delete cascade,
+    FOREIGN KEY (pid)
+        REFERENCES policy_store(id)
+    on delete cascade
+);
+
+CREATE TABLE IF NOT EXISTS param_map (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    policy_id INTEGER NOT NULL,
+    param_id INTEGER NOT NULL,
+    value VARCHAR(100) NOT NULL,
+    flag BOOLEAN NOT NULL DEFAULT FALSE,
+    FOREIGN KEY (param_id)
+        REFERENCES param_store (id),
+    FOREIGN KEY (policy_id)
+        REFERENCES policy_store (id)
+);
+
+create or replace view policy_view as
+select
+    po.id as pid,
+    po.target_id as id,
+    rs.persistent_id as persistent_id,
+    rs.name as name,
+    rs.type as type,
+    c.group_id as group_id,
+    po.posix as perm,
+    po.creator as creator,
+    po.expire as expire,
+    po.enable as enable,
+    po.iprange as iprange
+from
+policy_store as po
+inner join
+group_ref as c ON c.policy_id = po.id
+inner join
+resource_store as rs ON rs.id = po.target_id
+union all select
+              - 1 as pid,
+              rs.id as id,
+              rs.persistent_id as persistent_id,
+              rs.name as name,
+              type as type,
+              'self' as group_id,
+              127 as perm,
+              creator,
+              NULL as expire,
+              rs.created as enable,
+              null as iprange
+          from
+          resource_store as rs;
+
+
+CREATE TABLE IF NOT EXISTS audit_records (
+id INTEGER PRIMARY KEY AUTO_INCREMENT,
+aud_category VARCHAR(100),
+aud_target VARCHAR(100),
+aud_user VARCHAR(100),
+aud_location VARCHAR(100),
+aud_operation VARCHAR(100),
+aud_field_1 VARCHAR(400),
+aud_timestamp TIMESTAMP,
+aud_failure VARCHAR(100)
+);
+
+
+-- indices
+create trigger delete_policy after delete on resource_store
+for each row delete from policy_store where target_id=OLD.id;
+
+DELIMITER //
+CREATE TRIGGER tree_entry_insert AFTER INSERT ON resource_store FOR EACH ROW BEGIN
+	INSERT INTO resource_tree (parent_id, child_id, depth, name_path)
+	VALUES (NEW.id, NEW.id, 0, NEW.name);
+	INSERT INTO resource_tree (parent_id, child_id, depth, name_path)
+	SELECT parent_id, NEW.id, depth + 1, concat(name_path,"/",NEW.name) FROM resource_tree WHERE child_id = NEW.parent_id;
+END; //
+
+DELIMITER ;
+
+-- todo: are this automatically adapted when refactoring?
+CREATE INDEX group_index ON group_users(user_id);
+CREATE INDEX policy_index ON group_ref(policy_id);
+CREATE UNIQUE INDEX resource_tree_index ON resource_tree (parent_id, depth, child_id);
+CREATE UNIQUE INDEX param_unique ON param_store (p_key, p_value);
+
+-- foreign key constraints
diff --git a/src/main/resources/db/mysql/V1.0__initial_version.sql b/src/main/resources/db/mysql/V1.0__initial_version.sql
deleted file mode 100644
index 8e4c17b..0000000
--- a/src/main/resources/db/mysql/V1.0__initial_version.sql
+++ /dev/null
@@ -1,326 +0,0 @@
-
--- rename all columns in new way!
-CREATE TABLE IF NOT EXISTS korapusers (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    username VARCHAR(100) NOT NULL UNIQUE,
-    password VARCHAR(100) NOT NULL,
-    accountLock boolean NOT NULL,
-    accountCreation TIMESTAMP NOT NULL,
-    type INTEGER DEFAULT 0,
-    URI_PASS_Fragment VARCHAR(100),
-    URI_CONF_Fragment VARCHAR(100),
-    URI_Expiration TIMESTAMP,
-    loginSuccess INTEGER,
-    loginFailed INTEGER,
-    accountExpiration TIMESTAMP NOT NULL,
-    accountLink VARCHAR(100)
-);
-
-CREATE TABLE IF NOT EXISTS shibusers (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    username VARCHAR(100) NOT NULL UNIQUE,
-    accountCreation TIMESTAMP NOT NULL,
-    type INTEGER DEFAULT 1,
-    loginSuccess INTEGER,
-    loginFailed INTEGER,
-    accountExpiration TIMESTAMP NOT NULL,
-    accountLink VARCHAR(100)
-);
-
-CREATE TABLE IF NOT EXISTS udetails (
-    Id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    userID INTEGER NOT NULL UNIQUE,
-    firstName VARCHAR(100),
-    lastName VARCHAR(100),
-    gender VARCHAR(100),
-    phone VARCHAR(100),
-    institution VARCHAR(100),
-    email VARCHAR(100),
-    address VARCHAR(100),
-    country VARCHAR(100),
-    privateUsage BOOLEAN,
-    foreign key (userID)
-    references korapusers (id)
-    on delete cascade
-);
-
-CREATE TABLE IF NOT EXISTS usettings (
-    Id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    userID INTEGER NOT NULL UNIQUE,
-    fileNameForExport VARCHAR(100),
-    itemForSimpleAnnotation INTEGER,
-    leftContextItemForExport VARCHAR(100),
-    leftContextSizeForExport INTEGER,
-    locale VARCHAR(100),
-    leftContextItem VARCHAR(100),
-    leftContextSize INTEGER,
-    rightContextItem VARCHAR(100),
-    rightContextItemForExport VARCHAR(100),
-    rightContextSize INTEGER,
-    rightContextSizeForExport INTEGER,
-    selectedCollection VARCHAR(100),
-    queryLanguage VARCHAR(100),
-    pageLength INTEGER,
-    metadataQueryExpertModus BOOLEAN,
-    searchSettingsTab INTEGER,
-    selectedGraphType INTEGER,
-    selectedSortType VARCHAR(100),
-    selectedViewForSearchResults VARCHAR(100),
-    POSFoundry VARCHAR(100),
-    lemmaFoundry VARCHAR(100),
-    constFoundry VARCHAR(100),
-    relFoundry VARCHAR(100),
-    collectData BOOLEAN,
-    foreign key (userID)
-    references korapusers (id)
-    on delete cascade
-);
-
-CREATE OR REPLACE VIEW allusers AS
-    SELECT 
-        id,
-        username,
-        password,
-        accountLock,
-        accountCreation,
-        type,
-        URI_PASS_Fragment,
-        URI_CONF_Fragment,
-        URI_Expiration,
-        loginSuccess,
-        loginFailed,
-        accountExpiration,
-        accountLink
-    from
-        korapusers 
-    UNION ALL SELECT 
-        id,
-        username,
-        NULL as password,
-        NULL as accountLock,
-        accountCreation,
-        type,
-        NULL as URI_PASS_Fragment,
-        NULL as URI_CONF_Fragment,
-        NULL as URI_Expiration,
-        loginSuccess,
-        loginFailed,
-        accountExpiration,
-        accountLink
-    from
-        shibusers;
-
--- why unsigned?
-CREATE TABLE IF NOT EXISTS r_store (
-id INTEGER PRIMARY KEY AUTO_INCREMENT,
-persistent_id VARCHAR(100) NOT NULL UNIQUE,
-name VARCHAR(100),
-description VARCHAR(300),
-parent_id Integer unsigned null,
-created timestamp default current_timestamp,
-type INTEGER NOT NULL,
-creator INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS uqueries (
-    id INTEGER PRIMARY KEY,
-    queryLanguage VARCHAR(100),
-    name VARCHAR(100),
-    query VARCHAR(200),
-    description VARCHAR(150),
-    foreign key (id)
-    references r_store(id)
-    on delete cascade
-);
-
-CREATE TABLE IF NOT EXISTS r_tree (
-parent_id INTEGER,
-child_id INTEGER,
-depth INTEGER,
-name_path VARCHAR(250),
-PRIMARY KEY (parent_id , child_id),
-foreign key (parent_id)
-references r_store (id)
-on delete cascade,
-foreign key (child_id)
-references r_store (id)
-on delete cascade
-);
-
-
-CREATE TABLE IF NOT EXISTS cstorage (
-    id INTEGER,
-    refCorpus VARCHAR(100),
-    query VARCHAR(500),
-    foreign key (id) references r_store(id)
-    on delete cascade);
-
-
-CREATE TABLE IF NOT EXISTS matchInfo (id INTEGER PRIMARY KEY AUTO_INCREMENT, userid BIGINT NOT NULL,
-matchInfo VARCHAR(100));
-
-CREATE TABLE IF NOT EXISTS resourceRecords (
-    AUD_ID INTEGER PRIMARY KEY AUTO_INCREMENT,
-    AUD_RESOURCE VARCHAR(100),
-    AUD_USER VARCHAR(100),
-    AUD_LOC VARCHAR(100),
-    AUD_OP VARCHAR(100),
-    AUD_TIMESTAMP TIMESTAMP,
-    AUD_FAILURE VARCHAR(100)
-);
-
-CREATE TABLE IF NOT EXISTS databaseRecords (
-    AUD_ID INTEGER PRIMARY KEY AUTO_INCREMENT,
-    AUD_TARGET VARCHAR(100),
-    AUD_USER VARCHAR(100),
-    AUD_LOC VARCHAR(100),
-    AUD_OP VARCHAR(100),
-    AUD_TIMESTAMP TIMESTAMP,
-    AUD_FAILURE VARCHAR(100)
-);
-
-CREATE TABLE IF NOT EXISTS securityRecords (
-    AUD_ID INTEGER PRIMARY KEY AUTO_INCREMENT,
-    AUD_USER VARCHAR(100),
-    AUD_LOC VARCHAR(100),
-    AUD_OP VARCHAR(100),
-    AUD_TIMESTAMP TIMESTAMP,
-    AUD_FAILURE VARCHAR(100)
-);
-
-
-CREATE TABLE IF NOT EXISTS doc_trace (
-id VARCHAR(200) PRIMARY KEY,
-resource INTEGER,
-created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-foreign key (resource)
-references r_store(id)
-);
-
--- last_modified timestamp ON UPDATE CURRENT_TIMESTAMP,
-CREATE TABLE IF NOT EXISTS p_store (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    target_id BIGINT NOT NULL,
-    created TIMESTAMP,
-    creator INTEGER NOT NULL,
-    posix SMALLINT NOT NULL,
-    expire TIMESTAMP NULL,
-    enable TIMESTAMP NULL,
-    iprange varchar(200)
-);
-
-CREATE TABLE IF NOT EXISTS conditionDef (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    groupRef VARCHAR(100) NOT NULL,
-    policyid INTEGER NOT NULL
-);
-
-
-CREATE TABLE IF NOT EXISTS groupStore (
-    name VARCHAR(100) PRIMARY KEY,
-    description VARCHAR(200),
-    sym_use INTEGER DEFAULT -1,
-    export VARCHAR(30) DEFAULT NULL,
-    query_only VARCHAR(30) DEFAULT NULL,
-    licence INTEGER DEFAULT -1,
-    -- basically every resource we have is an academic resource, thus a non-commercial use is infered!
-    commercial BOOLEAN DEFAULT FALSE
-);
-
-CREATE TABLE IF NOT EXISTS groupUsers (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    userID BIGINT NOT NULL,
-    groupRef VARCHAR(100) NOT NULL,
-    admin BOOLEAN NOT NULL DEFAULT FALSE,
-    FOREIGN KEY (groupRef)
-        REFERENCES groupStore (name) on delete cascade
-);
-
-CREATE TABLE IF NOT EXISTS paramStore (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    p_key VARCHAR(100) NOT NULL,
-    p_value VARCHAR(150) NOT NULL,
-    resource INTEGER DEFAULT -1,
-    pid INTEGER DEFAULT -1,
-    FOREIGN KEY (resource)
-        REFERENCES r_store(id)
-    on delete cascade,
-    FOREIGN KEY (pid)
-        REFERENCES p_store(id)
-    on delete cascade
-);
-
-CREATE TABLE IF NOT EXISTS paramMapping (
-    id INTEGER PRIMARY KEY AUTO_INCREMENT,
-    policyID INTEGER NOT NULL,
-    paramID INTEGER NOT NULL,
-    value VARCHAR(100) NOT NULL,
-    flag BOOLEAN NOT NULL DEFAULT FALSE,
-    FOREIGN KEY (paramID)
-        REFERENCES paramStore (id),
-    FOREIGN KEY (policyID)
-        REFERENCES p_store (id)
-);
-
-create or replace view p_view as
-select
-    po.id as pid,
-    po.target_id as id,
-    rs.persistent_id as persistent_id,
-    rs.name as name,
-    rs.type as type,
-    c.groupref as groupref,
-    po.posix as perm,
-    po.creator as creator,
-    po.expire as expire,
-    po.enable as enable,
-    po.iprange as iprange
-from
-p_store as po
-inner join
-conditionDef as c ON c.policyid = po.id
-inner join
-r_store as rs ON rs.id = po.target_id
-union all select
-              - 1 as pid,
-              rs.id as id,
-              rs.persistent_id as persistent_id,
-              rs.name as name,
-              type as type,
-              'self' as groupref,
-              127 as perm,
-              creator,
-              NULL as expire,
-              rs.created as enable,
-              null as iprange
-          from
-          r_store as rs;
-
-
--- indices
-create trigger delete_policy after delete on r_store
-for each row delete from p_store where target_id=OLD.id;
-
-DELIMITER //
-CREATE TRIGGER tree_entry_insert AFTER INSERT ON r_store FOR EACH ROW BEGIN
-	INSERT INTO r_tree (parent_id, child_id, depth, name_path)
-	VALUES (NEW.id, NEW.id, 0, NEW.name);
-	INSERT INTO r_tree (parent_id, child_id, depth, name_path)
-	SELECT parent_id, NEW.id, rt.depth + 1, concat(name_path,"/",NEW.name) FROM r_tree WHERE child_id = NEW.parent_id;
-END; //
-
-DELIMITER ;
-
--- todo: are this automatically adapted when refactoring?
-CREATE INDEX group_index ON groupUsers(userid);
-CREATE INDEX policy_index ON conditionDef(policyid);
-CREATE UNIQUE INDEX r_tree_index ON r_tree (parent_id, depth, child_id);
-CREATE UNIQUE INDEX para_unique ON paramStore (p_key, p_value);
-
--- foreign key constraints
-
-
-
-
-
-
diff --git a/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql b/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql
index 227d660..fe75267 100644
--- a/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql
+++ b/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql
@@ -1,6 +1,6 @@
 
 -- oauth2 db tables
-create table oauth2_client (
+create table if not exists oauth2_client (
 client_id VARCHAR(100) UNIQUE PRIMARY KEY,
 client_secret VARCHAR(200),
 redirect_uri VARCHAR(250),
@@ -11,7 +11,7 @@
 
 
 -- status 1 = valid, 0 = revoked, -1 = disabled
-create table oauth2_access_token (
+create table if not exists oauth2_access_token (
 id INTEGER PRIMARY KEY AUTO_INCREMENT,
 access_token VARCHAR(300),
 auth_code VARCHAR(250),
@@ -33,7 +33,7 @@
 
 
 -- also scopes?
-create table oauth2_refresh_token (
+create table if not exists oauth2_refresh_token (
 id INTEGER PRIMARY KEY AUTO_INCREMENT,
 client_id VARCHAR(100),
 user_id INTEGER,
diff --git a/src/main/resources/db/mysql/initial_version.sql b/src/main/resources/db/mysql/initial_version.sql
new file mode 100644
index 0000000..3bff5cc
--- /dev/null
+++ b/src/main/resources/db/mysql/initial_version.sql
@@ -0,0 +1,326 @@
+--
+---- rename all columns in new way!
+--CREATE TABLE IF NOT EXISTS korapusers (
+--    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+--    username VARCHAR(100) NOT NULL UNIQUE,
+--    password VARCHAR(100) NOT NULL,
+--    accountLock boolean NOT NULL,
+--    accountCreation TIMESTAMP NOT NULL,
+--    type INTEGER DEFAULT 0,
+--    URI_PASS_Fragment VARCHAR(100),
+--    URI_CONF_Fragment VARCHAR(100),
+--    URI_Expiration TIMESTAMP,
+--    loginSuccess INTEGER,
+--    loginFailed INTEGER,
+--    accountExpiration TIMESTAMP NOT NULL,
+--    accountLink VARCHAR(100)
+--);
+--
+--CREATE TABLE IF NOT EXISTS shibusers (
+--    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+--    username VARCHAR(100) NOT NULL UNIQUE,
+--    accountCreation TIMESTAMP NOT NULL,
+--    type INTEGER DEFAULT 1,
+--    loginSuccess INTEGER,
+--    loginFailed INTEGER,
+--    accountExpiration TIMESTAMP NOT NULL,
+--    accountLink VARCHAR(100)
+--);
+--
+--CREATE TABLE IF NOT EXISTS udetails (
+--    Id INTEGER PRIMARY KEY AUTO_INCREMENT,
+--    userID INTEGER NOT NULL UNIQUE,
+--    firstName VARCHAR(100),
+--    lastName VARCHAR(100),
+--    gender VARCHAR(100),
+--    phone VARCHAR(100),
+--    institution VARCHAR(100),
+--    email VARCHAR(100),
+--    address VARCHAR(100),
+--    country VARCHAR(100),
+--    privateUsage BOOLEAN,
+--    foreign key (userID)
+--    references korapusers (id)
+--    on delete cascade
+--);
+--
+--CREATE TABLE IF NOT EXISTS usettings (
+--    Id INTEGER PRIMARY KEY AUTO_INCREMENT,
+--    userID INTEGER NOT NULL UNIQUE,
+--    fileNameForExport VARCHAR(100),
+--    itemForSimpleAnnotation INTEGER,
+--    leftContextItemForExport VARCHAR(100),
+--    leftContextSizeForExport INTEGER,
+--    locale VARCHAR(100),
+--    leftContextItem VARCHAR(100),
+--    leftContextSize INTEGER,
+--    rightContextItem VARCHAR(100),
+--    rightContextItemForExport VARCHAR(100),
+--    rightContextSize INTEGER,
+--    rightContextSizeForExport INTEGER,
+--    selectedCollection VARCHAR(100),
+--    queryLanguage VARCHAR(100),
+--    pageLength INTEGER,
+--    metadataQueryExpertModus BOOLEAN,
+--    searchSettingsTab INTEGER,
+--    selectedGraphType INTEGER,
+--    selectedSortType VARCHAR(100),
+--    selectedViewForSearchResults VARCHAR(100),
+--    POSFoundry VARCHAR(100),
+--    lemmaFoundry VARCHAR(100),
+--    constFoundry VARCHAR(100),
+--    relFoundry VARCHAR(100),
+--    collectData BOOLEAN,
+--    foreign key (userID)
+--    references korapusers (id)
+--    on delete cascade
+--);
+--
+--CREATE OR REPLACE VIEW allusers AS
+--    SELECT
+--        id,
+--        username,
+--        password,
+--        accountLock,
+--        accountCreation,
+--        type,
+--        URI_PASS_Fragment,
+--        URI_CONF_Fragment,
+--        URI_Expiration,
+--        loginSuccess,
+--        loginFailed,
+--        accountExpiration,
+--        accountLink
+--    from
+--        korapusers
+--    UNION ALL SELECT
+--        id,
+--        username,
+--        NULL as password,
+--        NULL as accountLock,
+--        accountCreation,
+--        type,
+--        NULL as URI_PASS_Fragment,
+--        NULL as URI_CONF_Fragment,
+--        NULL as URI_Expiration,
+--        loginSuccess,
+--        loginFailed,
+--        accountExpiration,
+--        accountLink
+--    from
+--        shibusers;
+
+---- why unsigned?
+--CREATE TABLE IF NOT EXISTS r_store (
+--id INTEGER PRIMARY KEY AUTO_INCREMENT,
+--persistent_id VARCHAR(100) NOT NULL UNIQUE,
+--name VARCHAR(100),
+--description VARCHAR(300),
+--parent_id Integer unsigned null,
+--created timestamp default current_timestamp,
+--type INTEGER NOT NULL,
+--creator INTEGER NOT NULL
+--);
+--
+--CREATE TABLE IF NOT EXISTS uqueries (
+--    id INTEGER PRIMARY KEY,
+--    queryLanguage VARCHAR(100),
+--    name VARCHAR(100),
+--    query VARCHAR(200),
+--    description VARCHAR(150),
+--    foreign key (id)
+--    references r_store(id)
+--    on delete cascade
+--);
+
+CREATE TABLE IF NOT EXISTS r_tree (
+parent_id INTEGER,
+child_id INTEGER,
+depth INTEGER,
+name_path VARCHAR(250),
+PRIMARY KEY (parent_id , child_id),
+foreign key (parent_id)
+references r_store (id)
+on delete cascade,
+foreign key (child_id)
+references r_store (id)
+on delete cascade
+);
+
+
+CREATE TABLE IF NOT EXISTS cstorage (
+    id INTEGER,
+    refCorpus VARCHAR(100),
+    query VARCHAR(500),
+    -- is foreign key constraint valid after refactoring?
+    foreign key (id) references r_store(id)
+    on delete cascade);
+
+
+CREATE TABLE IF NOT EXISTS matchInfo (id INTEGER PRIMARY KEY AUTO_INCREMENT, userid BIGINT NOT NULL,
+matchInfo VARCHAR(100));
+
+CREATE TABLE IF NOT EXISTS resourceRecords (
+    AUD_ID INTEGER PRIMARY KEY AUTO_INCREMENT,
+    AUD_RESOURCE VARCHAR(100),
+    AUD_USER VARCHAR(100),
+    AUD_LOC VARCHAR(100),
+    AUD_OP VARCHAR(100),
+    AUD_TIMESTAMP TIMESTAMP,
+    AUD_FAILURE VARCHAR(100)
+);
+
+CREATE TABLE IF NOT EXISTS databaseRecords (
+    AUD_ID INTEGER PRIMARY KEY AUTO_INCREMENT,
+    AUD_TARGET VARCHAR(100),
+    AUD_USER VARCHAR(100),
+    AUD_LOC VARCHAR(100),
+    AUD_OP VARCHAR(100),
+    AUD_TIMESTAMP TIMESTAMP,
+    AUD_FAILURE VARCHAR(100)
+);
+
+CREATE TABLE IF NOT EXISTS securityRecords (
+    AUD_ID INTEGER PRIMARY KEY AUTO_INCREMENT,
+    AUD_USER VARCHAR(100),
+    AUD_LOC VARCHAR(100),
+    AUD_OP VARCHAR(100),
+    AUD_TIMESTAMP TIMESTAMP,
+    AUD_FAILURE VARCHAR(100)
+);
+
+
+--CREATE TABLE IF NOT EXISTS doc_store (
+--    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+--    persistent_id VARCHAR(100) UNIQUE,
+--    created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+--    disabled BOOLEAN default true
+--);
+
+-- last_modified timestamp ON UPDATE CURRENT_TIMESTAMP,
+CREATE TABLE IF NOT EXISTS p_store (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    target_id BIGINT NOT NULL,
+    created TIMESTAMP,
+    creator INTEGER NOT NULL,
+    posix SMALLINT NOT NULL,
+    expire TIMESTAMP NULL,
+    enable TIMESTAMP NULL,
+    iprange VARCHAR(200)
+);
+
+CREATE TABLE IF NOT EXISTS conditionDef (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    groupRef VARCHAR(100) NOT NULL,
+    policyid INTEGER NOT NULL
+);
+
+
+CREATE TABLE IF NOT EXISTS groupStore (
+    name VARCHAR(100) PRIMARY KEY,
+    description VARCHAR(200),
+    sym_use INTEGER DEFAULT -1,
+    export VARCHAR(30) DEFAULT NULL,
+    query_only VARCHAR(30) DEFAULT NULL,
+    licence INTEGER DEFAULT -1,
+    -- basically every resource we have is an academic resource, thus a non-commercial use is infered!
+    commercial BOOLEAN DEFAULT FALSE
+);
+
+CREATE TABLE IF NOT EXISTS groupUsers (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    userID BIGINT NOT NULL,
+    groupRef VARCHAR(100) NOT NULL,
+    admin BOOLEAN NOT NULL DEFAULT FALSE,
+    FOREIGN KEY (groupRef)
+        REFERENCES groupStore (name) on delete cascade
+);
+
+CREATE TABLE IF NOT EXISTS paramStore (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    p_key VARCHAR(100) NOT NULL,
+    p_value VARCHAR(150) NOT NULL,
+    resource INTEGER DEFAULT -1,
+    pid INTEGER DEFAULT -1,
+    FOREIGN KEY (resource)
+        REFERENCES r_store(id)
+    on delete cascade,
+    FOREIGN KEY (pid)
+        REFERENCES p_store(id)
+    on delete cascade
+);
+
+CREATE TABLE IF NOT EXISTS paramMapping (
+    id INTEGER PRIMARY KEY AUTO_INCREMENT,
+    policyID INTEGER NOT NULL,
+    paramID INTEGER NOT NULL,
+    value VARCHAR(100) NOT NULL,
+    flag BOOLEAN NOT NULL DEFAULT FALSE,
+    FOREIGN KEY (paramID)
+        REFERENCES paramStore (id),
+    FOREIGN KEY (policyID)
+        REFERENCES p_store (id)
+);
+
+create or replace view p_view as
+select
+    po.id as pid,
+    po.target_id as id,
+    rs.persistent_id as persistent_id,
+    rs.name as name,
+    rs.type as type,
+    c.groupref as groupref,
+    po.posix as perm,
+    po.creator as creator,
+    po.expire as expire,
+    po.enable as enable,
+    po.iprange as iprange
+from
+p_store as po
+inner join
+conditionDef as c ON c.policyid = po.id
+inner join
+r_store as rs ON rs.id = po.target_id
+union all select
+              - 1 as pid,
+              rs.id as id,
+              rs.persistent_id as persistent_id,
+              rs.name as name,
+              type as type,
+              'self' as groupref,
+              127 as perm,
+              creator,
+              NULL as expire,
+              rs.created as enable,
+              null as iprange
+          from
+          r_store as rs;
+
+
+-- indices
+create trigger delete_policy after delete on r_store
+for each row delete from p_store where target_id=OLD.id;
+
+DELIMITER //
+CREATE TRIGGER tree_entry_insert AFTER INSERT ON r_store FOR EACH ROW BEGIN
+	INSERT INTO r_tree (parent_id, child_id, depth, name_path)
+	VALUES (NEW.id, NEW.id, 0, NEW.name);
+	INSERT INTO r_tree (parent_id, child_id, depth, name_path)
+	SELECT parent_id, NEW.id, rt.depth + 1, concat(name_path,"/",NEW.name) FROM r_tree WHERE child_id = NEW.parent_id;
+END; //
+
+DELIMITER ;
+
+-- todo: are this automatically adapted when refactoring?
+CREATE INDEX group_index ON groupUsers(userid);
+CREATE INDEX policy_index ON conditionDef(policyid);
+CREATE UNIQUE INDEX r_tree_index ON r_tree (parent_id, depth, child_id);
+CREATE UNIQUE INDEX para_unique ON paramStore (p_key, p_value);
+
+-- foreign key constraints
+
+
+
+
+
+
diff --git a/src/main/resources/db/mysql/V1.1__mysql_refactoring.sql b/src/main/resources/db/mysql/mysql_refactoring.sql
similarity index 77%
rename from src/main/resources/db/mysql/V1.1__mysql_refactoring.sql
rename to src/main/resources/db/mysql/mysql_refactoring.sql
index 4cc3b21..9b7cd6c 100644
--- a/src/main/resources/db/mysql/V1.1__mysql_refactoring.sql
+++ b/src/main/resources/db/mysql/mysql_refactoring.sql
@@ -5,6 +5,7 @@
 alter table user_settings drop column selectedGraphType;
 alter table user_settings drop column selectedSortType;
 alter table user_settings drop column selectedViewForSearchResults;
+
 rename table udetails to user_details;
 rename table uqueries to user_queries;
 rename table korapusers to korap_users;
@@ -13,6 +14,19 @@
 
 alter table korap_users change column URI_PASS_Fragment uri_fragment VARCHAR(100);
 alter table korap_users change column URI_Expiration uri_expiration TIMESTAMP;
+alter table korap_users drop column URI_CONF_Fragment;
+alter table korap_users change column accountLock account_lock BOOLEAN not null default false;
+alter table korap_users change column accountCreation account_creation TIMESTAMP default CURRENT_TIMESTAMP not null;
+alter table korap_users change column accountExpiration account_expiration TIMESTAMP;
+alter table korap_users change column accountLink account_link VARCHAR(100);
+
+
+alter table shib_users change column accountCreation account_creation TIMESTAMP default CURRENT_TIMESTAMP not null;
+alter table shib_users change column accountExpiration account_expiration TIMESTAMP;
+alter table shib_users change column accountLink account_link VARCHAR(100);
+
+alter table user_details change column userID user_id INTEGER NOT NULL UNIQUE;
+
 drop view allusers;
 
 rename table r_store TO resource_store;
@@ -30,7 +44,7 @@
 rename table cstorage to coll_store;
 alter table coll_store add column (
 created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-userID INTEGER);
+user_id INTEGER);
 alter table coll_store drop column refCorpus;
 
 
@@ -49,21 +63,21 @@
 --);
 
 
-drop table doc_trace;
-
-CREATE TABLE IF NOT EXISTS doc_store (
-id VARCHAR(230) PRIMARY KEY,
-persistent_id VARCHAR(230) UNIQUE,
-created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-disabled BOOLEAN default true
-);
+--drop table doc_trace;
+--
+--CREATE TABLE IF NOT EXISTS doc_store (
+--id VARCHAR(230) PRIMARY KEY,
+--persistent_id VARCHAR(230) UNIQUE,
+--created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+--disabled BOOLEAN default true
+--);
 
 
 
 rename table p_store to policy_store;
 rename table conditionDef to group_ref;
 alter table group_ref change groupRef group_id VARCHAR(100) NOT NULL;
-alter table group_ref change policyId policy_id VARCHAR(100) NOT NULL;
+alter table group_ref change policyId policy_id INTEGER;
 
 drop view p_view;
 create or replace view policy_view as
diff --git a/src/main/resources/db/sqlite/V1__Initial_version.sql b/src/main/resources/db/sqlite/V1__Initial_version.sql
index ee32961..08fbae3 100644
--- a/src/main/resources/db/sqlite/V1__Initial_version.sql
+++ b/src/main/resources/db/sqlite/V1__Initial_version.sql
@@ -2,23 +2,23 @@
 id INTEGER PRIMARY KEY AUTOINCREMENT,
 username VARCHAR(150) NOT NULL UNIQUE,
 password VARCHAR(100) NOT NULL,
-accountLock boolean NOT NULL,
-accountCreation TIMESTAMP NOT NULL,
+account_lock boolean NOT NULL,
+account_creation BIGINT NOT NULL,
 -- deprecate this
 type INTEGER DEFAULT 0,
 uri_fragment VARCHAR(100),
-uri_expiration TIMESTAMP,
-accountLink VARCHAR(100)
+uri_expiration BIGINT,
+account_link VARCHAR(100)
 );
 
 CREATE TABLE IF NOT EXISTS shib_users (
 id INTEGER PRIMARY KEY AUTOINCREMENT,
 username VARCHAR(150) NOT NULL UNIQUE,
-accountCreation TIMESTAMP NOT NULL,
+account_creation BIGINT,
 type INTEGER DEFAULT 1,
 loginSuccess INTEGER,
 loginFailed INTEGER,
-accountLink VARCHAR(100)
+account_link VARCHAR(100)
 );
 
 CREATE TABLE IF NOT EXISTS user_details (
@@ -83,7 +83,7 @@
 name VARCHAR(150),
 description VARCHAR(200),
 query VARCHAR(500),
-created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+created BIGINT NOT NULL,
 user_id INTEGER,
 foreign key(user_id)
 references korap_users(id)
@@ -98,7 +98,7 @@
 aud_location VARCHAR(100),
 aud_field_1 VARCHAR(400),
 aud_args VARCHAR(400),
-aud_timestamp TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+aud_timestamp BIGINT,
 aud_status VARCHAR(100)
 );
 
@@ -113,20 +113,20 @@
 CREATE TABLE IF NOT EXISTS policy_store (
 id INTEGER PRIMARY KEY AUTOINCREMENT,
 target_id BIGINT NOT NULL,
-created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+created BIGINT NOT NULL,
 creator INTEGER NOT NULL,
 posix SMALLINT NOT NULL,
-expire timestamp,
-enable timestamp NOT NULL,
+expire BIGINT,
+enable BIGINT NOT NULL,
 iprange varchar(200)
 );
 
 -- send disabled documents per corpus to backend, so they can be excluded from searching!
 CREATE TABLE IF NOT EXISTS doc_store (
 id INTEGER PRIMARY KEY AUTOINCREMENT,
-persistent_id VARCHAR(265) UNIQUE,
-created DATE DEFAULT CURRENT_TIMESTAMP,
-disabled BOOLEAN default true
+persistent_id VARCHAR(100) UNIQUE,
+created BIGINT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+disabled BOOLEAN DEFAULT TRUE
 );
 
 CREATE TABLE IF NOT EXISTS group_ref (
@@ -244,7 +244,7 @@
 -- in case of code authorization, should match auth code scopes!
 -- use scopes for levelaccess descriptor level[rw],level[r]
 scopes VARCHAR(350),
-expiration TIMESTAMP,
+expiration BIGINT NOT NULL,
 FOREIGN KEY (user_id)
 REFERENCES korap_users(id),
 FOREIGN KEY (client_id)
@@ -257,7 +257,7 @@
 id INTEGER PRIMARY KEY AUTOINCREMENT,
 client_id VARCHAR(100),
 user_id INTEGER,
-expiration TIMESTAMP,
+expiration BIGINT NOT NULL,
 scopes VARCHAR(350),
 FOREIGN KEY (user_id)
 REFERENCES korap_users(id)
@@ -324,10 +324,10 @@
 AFTER INSERT ON resource_store
 FOR EACH ROW BEGIN
 INSERT INTO resource_tree (parent_id, child_id, depth, name_path)
-VALUES (NEW.id, NEW.id, 0, NEW.name);
+VALUES (NEW.id, NEW.id, 0, NEW.persistent_id);
 
 INSERT INTO resource_tree (parent_id, child_id, depth, name_path)
-SELECT parent_id, NEW.id, depth + 1, name_path || "/" ||  NEW.name FROM resource_tree
+SELECT parent_id, NEW.id, depth + 1, name_path || "/" ||  NEW.persistent_id FROM resource_tree
 WHERE child_id = NEW.parent_id;
 END;
 
diff --git a/src/main/resources/default-config.xml b/src/main/resources/default-config.xml
index 3f9f6a6..a756340 100644
--- a/src/main/resources/default-config.xml
+++ b/src/main/resources/default-config.xml
@@ -63,19 +63,19 @@
     <!--class="org.apache.commons.dbcp2.BasicDataSource"-->
     <!-- org.springframework.jdbc.datasource.SingleConnectionDataSource -->
     <bean id="dataSource"
-          class="org.apache.commons.dbcp2.BasicDataSource"
+          class="org.springframework.jdbc.datasource.SingleConnectionDataSource"
           lazy-init="true">
         <property name="driverClassName" value="${jdbc.driverClassName}"/>
         <property name="url" value="${jdbc.url}"/>
         <property name="username" value="${jdbc.username}"/>
         <property name="password" value="${jdbc.password}"/>
         <!-- relevant for single connection datasource and sqlite -->
-        <!--<property name="suppressClose">-->
-        <!--<value>true</value>-->
-        <!--</property>-->
-        <property name="initialSize" value="2"/>
-        <property name="maxIdle" value="2"/>
-        <property name="poolPreparedStatements" value="true"/>
+        <property name="suppressClose">
+            <value>true</value>
+        </property>
+        <!--<property name="initialSize" value="2"/>-->
+        <!--<property name="maxIdle" value="2"/>-->
+        <!--<property name="poolPreparedStatements" value="true"/>-->
     </bean>
 
     <!-- to configure database for sqlite, mysql, etc. migrations -->
diff --git a/src/test/java/CollectionQueryBuilderTest.java b/src/test/java/CollectionQueryBuilderTest.java
index aeb753f..8acd4fb 100644
--- a/src/test/java/CollectionQueryBuilderTest.java
+++ b/src/test/java/CollectionQueryBuilderTest.java
@@ -1,4 +1,5 @@
 import com.fasterxml.jackson.databind.JsonNode;
+import de.ids_mannheim.korap.query.serialize.QuerySerializer;
 import de.ids_mannheim.korap.utils.CollectionQueryBuilder3;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import org.junit.Test;
@@ -12,7 +13,7 @@
     @Test
     public void testsimpleAdd() {
         CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
-        b.addSegment("corpusID", CollectionQueryBuilder3.EQ.EQUAL, "WPD");
+        b.addQuery("corpusID=WPD");
 
         JsonNode node = JsonUtils.readTree(b.toJSON());
 
@@ -25,9 +26,7 @@
     @Test
     public void testSimpleConjunction() {
         CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
-        b.addSegment("corpusID", CollectionQueryBuilder3.EQ.EQUAL, "WPD").and()
-                .addSegment("textClass", CollectionQueryBuilder3.EQ.EQUAL,
-                        "freizeit");
+        b.addQuery("corpusID=WPD & textClass=freizeit");
         JsonNode node = JsonUtils.readTree(b.toJSON());
 
         assert node != null;
@@ -43,11 +42,12 @@
     @Test
     public void testSimpleDisjunction() {
         CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
-        b.addSegment("corpusID", CollectionQueryBuilder3.EQ.EQUAL, "WPD").or()
-                .addSegment("textClass", CollectionQueryBuilder3.EQ.EQUAL,
-                        "freizeit");
+        b.addQuery("corpusID=WPD | textClass=freizeit");
         JsonNode node = JsonUtils.readTree(b.toJSON());
 
+        System.out.println("_____________________________________________");
+        System.out.println(node);
+
         assert node != null;
         assert node.at("/collection/operation").asText().equals("operation:or");
         assert node.at("/collection/operands/0/key").asText()
@@ -59,11 +59,13 @@
     @Test
     public void testComplexSubQuery() {
         CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
-        b.addSegment("corpusID", CollectionQueryBuilder3.EQ.EQUAL, "ADF").or()
-                .addSub("textClass=freizeit & corpusID=WPD");
-
+        b.addQuery(
+                "(corpusID=WPD) | (textClass=freizeit & corpusID=WPD)");
         JsonNode node = JsonUtils.readTree(b.toJSON());
 
+        System.out.println(
+                "_____________________________________________ COMPLEX");
+        System.out.println(node);
         assert node != null;
         assert node.at("/collection/operation").asText().equals("operation:or");
         assert node.at("/collection/operands/0/key").asText()
@@ -76,13 +78,11 @@
     @Test
     public void testAddResourceQueryAfter() {
         CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
-        b.addSegment("corpusID", CollectionQueryBuilder3.EQ.EQUAL, "ADF").or()
-                .addSub("textClass=freizeit & corpusID=WPD");
+        b.addQuery("(corpusID=ADF) | (textClass=freizeit & corpusID=WPD)");
 
         CollectionQueryBuilder3 c = new CollectionQueryBuilder3();
         c.setBaseQuery(b.toJSON());
-        c.addSegment("textClass", CollectionQueryBuilder3.EQ.EQUAL,
-                "wissenschaft");
+        c.addQuery("textClass=wissenschaft");
 
         JsonNode node = JsonUtils.readTree(c.toJSON());
 
@@ -96,12 +96,11 @@
     @Test
     public void testAddComplexResourceQueryAfter() {
         CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
-        b.addSegment("corpusID", CollectionQueryBuilder3.EQ.EQUAL, "ADF").or()
-                .addSub("textClass=freizeit & corpusID=WPD");
+        b.addQuery("(corpusID=ADF) | (textClass=freizeit & corpusID=WPD)");
 
         CollectionQueryBuilder3 c = new CollectionQueryBuilder3();
         c.setBaseQuery(b.toJSON());
-        c.addSub("(textClass=politik & corpusID=AZPS)");
+        c.addQuery("(textClass=politik & corpusID=AZPS)");
 
         JsonNode node = JsonUtils.readTree(c.toJSON());
 
@@ -115,4 +114,21 @@
 
     }
 
+    @Test
+    public void buildQuery() {
+        String query = "[base=Haus]";
+        QuerySerializer s = new QuerySerializer();
+        s.setQuery(query, "poliqarp");
+        CollectionQueryBuilder3 b = new CollectionQueryBuilder3();
+        b.addQuery("corpusID=WPD");
+        s.setCollection("corpusID=WPD");
+
+        System.out.println("QUERY " + s.toJSON());
+    }
+
+    @Test
+    public void testBaseQueryBuild() {
+
+    }
+
 }
diff --git a/src/test/java/FileAuditingTest.java b/src/test/java/FileAuditingTest.java
index 5646590..23b589c 100644
--- a/src/test/java/FileAuditingTest.java
+++ b/src/test/java/FileAuditingTest.java
@@ -6,7 +6,6 @@
 import org.junit.BeforeClass;
 import org.junit.Test;
 
-import java.io.File;
 import java.util.Date;
 
 /**
@@ -24,8 +23,10 @@
     @AfterClass
     public static void finish() {
         BeanConfiguration.closeApplication();
-        File f = new File("logs/default_audit.log");
-        assert f.length() > 0;
+//        File f = new File("logs/default_audit.log");
+//        System.out.println("------------------------------------------------------");
+//        System.out.println("FILE LENGTH "+f.length());
+//        assert f.length() > 0;
     }
 
     @Test
diff --git a/src/test/java/IdRewriteTest.java b/src/test/java/IdRewriteTest.java
index 8415c2c..6c0b8c4 100644
--- a/src/test/java/IdRewriteTest.java
+++ b/src/test/java/IdRewriteTest.java
@@ -20,7 +20,7 @@
     }
 
     @AfterClass
-    public static void drop() {
+    public static void close() {
         BeanConfiguration.closeApplication();
     }
 
diff --git a/src/test/java/de/ids_mannheim/korap/config/ConfigTest.java b/src/test/java/de/ids_mannheim/korap/config/ConfigTest.java
index d098502..4a2ca67 100644
--- a/src/test/java/de/ids_mannheim/korap/config/ConfigTest.java
+++ b/src/test/java/de/ids_mannheim/korap/config/ConfigTest.java
@@ -18,6 +18,12 @@
         BeanConfiguration.closeApplication();
     }
 
+
+    @Test
+    public void create() {
+        BeanConfiguration.loadClasspathContext("test-config.xml");
+    }
+
     @Test
     public void testServiceVersion() {
         String v = ServiceVersion.getAPIVersion();
diff --git a/src/test/java/de/ids_mannheim/korap/config/TestHelper.java b/src/test/java/de/ids_mannheim/korap/config/TestHelper.java
deleted file mode 100644
index fb7eaa7..0000000
--- a/src/test/java/de/ids_mannheim/korap/config/TestHelper.java
+++ /dev/null
@@ -1,49 +0,0 @@
-package de.ids_mannheim.korap.config;
-
-import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.interfaces.db.EntityHandlerIface;
-import de.ids_mannheim.korap.user.KorAPUser;
-import de.ids_mannheim.korap.user.User;
-import org.junit.Assert;
-
-import java.util.Arrays;
-
-/**
- * creates a test user that can be used to access protected functions
- *
- * @author hanl
- * @date 16/10/2015
- */
-public class TestHelper {
-
-    private static final String[] credentials = new String[] { "test1",
-            "testPass#2015" };
-
-    public static boolean setup() {
-        boolean r = BeanConfiguration.hasContext();
-        if (r) {
-            EntityHandlerIface dao = BeanConfiguration.getBeans()
-                    .getUserDBHandler();
-
-            KorAPUser user = User.UserFactory
-                    .getUser(credentials[0], credentials[1]);
-            try {
-                Assert.assertNotNull("userdatabase handler must not be null",
-                        dao);
-                dao.createAccount(user);
-            }catch (KustvaktException e) {
-                e.printStackTrace();
-                return false;
-            }
-        }
-        return r;
-    }
-
-    public static final String[] getCredentials() {
-        return Arrays.copyOf(credentials, 2);
-    }
-
-    private TestHelper() {
-    }
-
-}
diff --git a/src/test/java/de/ids_mannheim/korap/config/UserTestHelper.java b/src/test/java/de/ids_mannheim/korap/config/UserTestHelper.java
new file mode 100644
index 0000000..91bc3fe
--- /dev/null
+++ b/src/test/java/de/ids_mannheim/korap/config/UserTestHelper.java
@@ -0,0 +1,95 @@
+package de.ids_mannheim.korap.config;
+
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.interfaces.db.EntityHandlerIface;
+import de.ids_mannheim.korap.interfaces.db.PersistenceClient;
+import de.ids_mannheim.korap.user.Attributes;
+import de.ids_mannheim.korap.user.User;
+import org.junit.Assert;
+import org.springframework.jdbc.core.RowCallbackHandler;
+import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.*;
+
+/**
+ * creates a test user that can be used to access protected functions
+ *
+ * @author hanl
+ * @date 16/10/2015
+ */
+public class UserTestHelper {
+
+    private static final String[] credentials = new String[] { "test1",
+            "testPass2015" };
+
+    public static boolean setup() {
+        boolean r = BeanConfiguration.hasContext();
+        if (r) {
+            EntityHandlerIface dao = BeanConfiguration.getBeans()
+                    .getUserDBHandler();
+            Map m = new HashMap<>();
+            m.put(Attributes.USERNAME, credentials[0]);
+            m.put(Attributes.PASSWORD, credentials[1]);
+
+            Assert.assertNotNull("userdatabase handler must not be null", dao);
+
+            try {
+                BeanConfiguration.getBeans().getAuthenticationManager()
+                        .createUserAccount(m, false);
+            }catch (KustvaktException e) {
+                // do nothing
+                return false;
+            }
+        }
+        return r;
+    }
+
+    public static boolean drop() {
+        boolean r = BeanConfiguration.hasContext();
+        if (r) {
+            EntityHandlerIface dao = BeanConfiguration.getBeans()
+                    .getUserDBHandler();
+            try {
+                User us = dao.getAccount(credentials[0]);
+                dao.deleteAccount(us.getId());
+            }catch (KustvaktException e) {
+                // do nothing
+            }
+        }
+        return r;
+    }
+
+    public static boolean truncateAll() {
+        boolean r = BeanConfiguration.hasContext();
+        if (r) {
+            String sql = "SELECT Concat('TRUNCATE TABLE ', TABLE_NAME) FROM INFORMATION_SCHEMA.TABLES";
+            final Set<String> queries = new HashSet<>();
+            PersistenceClient cl = BeanConfiguration.getBeans()
+                    .getPersistenceClient();
+            NamedParameterJdbcTemplate source = (NamedParameterJdbcTemplate) cl
+                    .getSource();
+
+            source.query(sql, new RowCallbackHandler() {
+                @Override
+                public void processRow(ResultSet rs) throws SQLException {
+                    queries.add(rs.getString(1));
+
+                }
+            });
+            System.out.println(queries);
+            for (String query : queries)
+                source.update(query, new HashMap<String, Object>());
+        }
+        return r;
+    }
+
+    public static final String[] getCredentials() {
+        return Arrays.copyOf(credentials, 2);
+    }
+
+    private UserTestHelper() {
+    }
+
+}
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/AuthServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/AuthServiceTest.java
index 10d5855..af4ebdd 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/AuthServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/AuthServiceTest.java
@@ -10,4 +10,6 @@
 
 
 
+
+
 }
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/FastJerseyTest.java b/src/test/java/de/ids_mannheim/korap/web/service/FastJerseyTest.java
index ca2600b..c49b605 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/FastJerseyTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/FastJerseyTest.java
@@ -25,7 +25,7 @@
  */
 public abstract class FastJerseyTest {
 
-    protected static String API_VERSION = "v0.1";
+    private final static String API_VERSION = "v0.1";
 
     private static DefaultResourceConfig resourceConfig = new DefaultResourceConfig();
 
@@ -48,6 +48,10 @@
         resourceConfig.getSingletons().add(resourceSingleton);
     }
 
+    public String getAPIVersion() {
+        return API_VERSION;
+    }
+
     public static <T> void addProviderForContext(Class<T> contextClass,
             T contextObject) {
         addSingleton(
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/KustvaktCoreRestTest.java b/src/test/java/de/ids_mannheim/korap/web/service/KustvaktCoreRestTest.java
index d8bf7df..3e8c1a0 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/KustvaktCoreRestTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/KustvaktCoreRestTest.java
@@ -3,6 +3,7 @@
 import com.sun.jersey.api.client.ClientResponse;
 import de.ids_mannheim.korap.config.BeanConfiguration;
 import de.ids_mannheim.korap.query.serialize.CollectionQueryProcessor;
+import de.ids_mannheim.korap.query.serialize.QuerySerializer;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
@@ -32,21 +33,33 @@
         BeanConfiguration.closeApplication();
     }
 
-    @Test
+    //    @Test
     public void testFieldsInSearch() {
-        ClientResponse response = resource().path(API_VERSION).path("search")
-                .queryParam("q", "[base=Wort]").queryParam("ql", "poliqarp")
-                .get(ClientResponse.class);
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("search").queryParam("q", "[base=Wort]")
+                .queryParam("ql", "poliqarp").get(ClientResponse.class);
         assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
-        System.out.println("RESPONSE IS " + response.getEntity(String.class));
     }
 
     @Test
     public void testQuery() {
-        ClientResponse response = resource().path(API_VERSION).path("search")
-                .queryParam("q", "Sonne prox/unit=word/distance<=5 Erde")
-                .queryParam("ql", "CQL").get(ClientResponse.class);
-        System.out.println(response);
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("search").queryParam("q", "[base=Wort]")
+                .queryParam("ql", "poliqarp").get(ClientResponse.class);
+        System.out.println("_______________________________________________");
+        System.out.println(response.getEntity(String.class));
+        assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
+    }
+
+    @Test
+    public void testQueryRaw() {
+        QuerySerializer s = new QuerySerializer();
+        s.setQuery("[base=Wort]", "poliqarp");
+
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("search").post(ClientResponse.class, s.toJSON());
+        System.out.println("_______________________________________________ RAW");
+        System.out.println(response.getEntity(String.class));
         assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
     }
 
@@ -54,34 +67,45 @@
     @Ignore
     @Test
     public void testGetMatchInfoThrowsNoException() {
-        ClientResponse response = resource().path(API_VERSION)
+        ClientResponse response = resource().path(getAPIVersion())
                 .get(ClientResponse.class);
     }
 
-    @Test
+    //    @Test
     public void testGetStatsThrowsNoException() {
         CollectionQueryProcessor pr = new CollectionQueryProcessor();
         pr.process("corpusID=WPD & textClass=Sport");
         Map map = new LinkedHashMap();
         map.put("collection", pr.getRequestMap());
-        ClientResponse response = resource().path(API_VERSION).path("stats")
+        ClientResponse response = resource().path(getAPIVersion()).path("stats")
                 .post(ClientResponse.class, JsonUtils.toJSON(map));
         assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
     }
 
     @Test
+    public void testGetStats2ThrowsNoException() {
+        ClientResponse response = resource().path(getAPIVersion()).path("stats")
+                .post(ClientResponse.class, "creationDate in 1787");
+        String ent = response.getEntity(String.class);
+        assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
+        System.out
+                .println("___________________________________________________");
+        System.out.println("STATS ENTITY " + ent);
+    }
+
+    //    @Test
     public void testBuildQueryThrowsNoException() {
-        ClientResponse response = resource().path(API_VERSION).path("search")
-                .queryParam("q", "[base=Haus & surface=Hauses]")
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("search").queryParam("q", "[base=Haus & surface=Hauses]")
                 .queryParam("ql", "poliqarp").queryParam("cutOff", "true")
                 .queryParam("page", "1").method("TRACE", ClientResponse.class);
         assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
     }
 
-    @Test
+    //    @Test
     public void testQueryByNameThrowsNoException() {
-        ClientResponse response = resource().path(API_VERSION).path("corpus")
-                .path("WPD").path("search")
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("corpus").path("WPD").path("search")
                 .queryParam("q", "[base=Haus & surface=Hauses]")
                 .queryParam("ql", "poliqarp").queryParam("cutOff", "true")
                 .queryParam("page", "1").get(ClientResponse.class);
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/KustvaktResourceServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/KustvaktResourceServiceTest.java
new file mode 100644
index 0000000..6829064
--- /dev/null
+++ b/src/test/java/de/ids_mannheim/korap/web/service/KustvaktResourceServiceTest.java
@@ -0,0 +1,88 @@
+package de.ids_mannheim.korap.web.service;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.sun.jersey.api.client.ClientResponse;
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.security.auth.BasicHttpAuth;
+import de.ids_mannheim.korap.user.Attributes;
+import de.ids_mannheim.korap.utils.JsonUtils;
+import de.ids_mannheim.korap.web.KustvaktBaseServer;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+/**
+ * @author hanl
+ * @date 14/01/2016
+ */
+public class KustvaktResourceServiceTest extends FastJerseyTest {
+
+    @BeforeClass
+    public static void configure() {
+        BeanConfiguration.loadClasspathContext("default-config.xml");
+        setPackages("de.ids_mannheim.korap.web.service.full",
+                "de.ids_mannheim.korap.web.filter",
+                "de.ids_mannheim.korap.web.utils");
+
+        KustvaktBaseServer.runPreStart();
+    }
+
+    @AfterClass
+    public static void close() {
+        BeanConfiguration.closeApplication();
+    }
+
+    @Test
+    public void testSearchSimple() {
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("search").queryParam("q", "[base=Wort]")
+                .queryParam("ql", "poliqarp")
+                //                .queryParam("cq", "corpusID=GOE")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .get(ClientResponse.class);
+        assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
+
+        JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
+        assert node.path("matches").size() > 0;
+    }
+
+    @Test
+    public void testCollectionGet() {
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("collection").header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .get(ClientResponse.class);
+        assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
+
+        JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
+        assert node.size() > 0;
+    }
+
+    @Test
+    public void testStats() {
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("collection").header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .get(ClientResponse.class);
+        assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
+
+        JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
+        assert node != null;
+        String id = node.path(0).path("id").asText();
+
+        response = resource().path(getAPIVersion()).path("collection").path(id)
+                .path("stats").header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .get(ClientResponse.class);
+        assert ClientResponse.Status.OK.getStatusCode() == response.getStatus();
+        node = JsonUtils.readTree(response.getEntity(String.class));
+        System.out.println("STATS RESULT: ");
+        System.out.println(node);
+    }
+
+    @Test
+    public void testResourceStore() {
+
+    }
+}
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/OAuth2EndpointTest.java b/src/test/java/de/ids_mannheim/korap/web/service/OAuth2EndpointTest.java
index 847b875..1d2f68a 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/OAuth2EndpointTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/OAuth2EndpointTest.java
@@ -1,12 +1,14 @@
 package de.ids_mannheim.korap.web.service;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import com.sun.jersey.api.client.ClientResponse;
 import de.ids_mannheim.korap.config.BeanConfiguration;
-import de.ids_mannheim.korap.config.TestHelper;
+import de.ids_mannheim.korap.config.UserTestHelper;
 import de.ids_mannheim.korap.security.auth.BasicHttpAuth;
+import de.ids_mannheim.korap.user.Attributes;
+import de.ids_mannheim.korap.utils.JsonUtils;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
-import org.junit.Test;
 
 /**
  * @author hanl
@@ -15,8 +17,11 @@
 // todo: needs servlet container test server!
 public class OAuth2EndpointTest extends FastJerseyTest {
 
+    private static String[] credentials;
+
     @AfterClass
     public static void close() {
+        UserTestHelper.drop();
         BeanConfiguration.closeApplication();
     }
 
@@ -27,24 +32,68 @@
                 "de.ids_mannheim.korap.web.filter",
                 "de.ids_mannheim.korap.web.utils");
 
-        TestHelper.setup();
-        String[] cred = TestHelper.getCredentials();
-
-        String header = BasicHttpAuth.encode(cred[0], cred[1]);
+        UserTestHelper.setup();
+        credentials = UserTestHelper.getCredentials();
     }
 
-    @Test
+//    @Test
     public void testAuthorizeClient() {
-        ClientResponse response = resource().path("v0.2").path("oauth2")
+        ClientResponse response = resource().path("v0.1").path("oauth2")
                 .path("register")
                 .queryParam("redirect_url", "korap.ids-mannheim.de/redirect")
                 .header("Host", "korap.ids-mannheim.de")
                 .post(ClientResponse.class);
-        System.out.println(response);
+        assert response.getStatus() == ClientResponse.Status.OK.getStatusCode();
     }
 
+//    @Test
     public void testRevokeClient() {
+        ClientResponse response = resource().path("v0.1").path("oauth2")
+                .path("register")
+                .queryParam("redirect_url", "korap.ids-mannheim.de/redirect")
+                .header("Host", "korap.ids-mannheim.de")
+                .post(ClientResponse.class);
+        assert response.getStatus() == ClientResponse.Status.OK.getStatusCode();
+        JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
 
     }
 
+//    @Test
+    public void authenticate() {
+        String enc = BasicHttpAuth.encode(credentials[0], credentials[1]);
+        ClientResponse response = resource().path("v0.1").path("oauth2")
+                .path("register")
+                .queryParam("redirect_url", "korap.ids-mannheim.de/redirect")
+                .header("Host", "korap.ids-mannheim.de")
+                .header(Attributes.AUTHORIZATION, enc)
+                .post(ClientResponse.class);
+        assert response.getStatus() == ClientResponse.Status.OK.getStatusCode();
+        String e = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(e);
+
+        String cl_s = node.path("client_secret").asText();
+        String cl_id = node.path("client_id").asText();
+
+        response = resource().path("v0.1").path("oauth2").path("authorize")
+                .queryParam("client_id", cl_id)
+                .queryParam("client_secret", cl_s)
+                .queryParam("response_type", "code")
+                .queryParam("redirect_uri", "korap.ids-mannheim.de/redirect")
+//                .header(Attributes.AUTHORIZATION, enc)
+                .header("Content-Type", "application/x-www-form-urlencoded")
+                .post(ClientResponse.class);
+
+        e = response.getEntity(String.class);
+        assert response.getStatus() == ClientResponse.Status.OK.getStatusCode();
+        node = JsonUtils.readTree(e);
+
+        response = resource().path("v0.1").path("oauth2").path("authorize")
+                .queryParam("code", node.path("authorization_code").asText())
+                .queryParam("grant_type", "authorization_code")
+                .queryParam("client_id", cl_id)
+                .queryParam("client_secret", cl_s).post(ClientResponse.class);
+
+        assert response.getStatus() == ClientResponse.Status.OK.getStatusCode();
+    }
+
 }
diff --git a/src/test/resources/test-config.xml b/src/test/resources/test-config.xml
index 2188edc..082d616 100644
--- a/src/test/resources/test-config.xml
+++ b/src/test/resources/test-config.xml
@@ -99,6 +99,7 @@
         <constructor-arg ref="kustvakt_db"/>
     </bean>
 
+    <!-- deprecated : load via constructor -->
     <!--fixme: change name according to convention -->
     <bean id="collectionProvider"
           class="de.ids_mannheim.korap.handlers.CollectionDao">