diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeServiceImpl.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeServiceImpl.java
index d2d59eb..9102ea3 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeServiceImpl.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeServiceImpl.java
@@ -108,6 +108,11 @@
     @Override
     public void verifyScope (TokenContext context, OAuth2Scope requiredScope)
             throws KustvaktException {
+        if (context == null) {
+            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
+                    "Authentication required. Please log in!");
+        }
+        
         if (!adminDao.isAdmin(context.getUsername())
                 && context.getTokenType().equals(TokenType.BEARER)) {
             Map<String, Object> parameters = context.getParameters();
diff --git a/full/src/main/resources/kustvakt.conf b/full/src/main/resources/kustvakt.conf
index c410011..128ad0c 100644
--- a/full/src/main/resources/kustvakt.conf
+++ b/full/src/main/resources/kustvakt.conf
@@ -44,11 +44,25 @@
 delete.group = soft
 delete.group.member = soft
 
-# availability regex (only support | )
+
+# Availability regex only support |
+# It should be removed/commented when the data doesn't contain availability field.
+# 
 availability.regex.free = CC-BY.*
-availability.regex.public = ACA.*|QAO.NC
+availability.regex.public = ACA.*|QAO-NC
 availability.regex.all = QAO.*
 
+
+# Define resource filters for search and match info API
+# AuthenticationFilter activates authentication using OAuth2 tokens
+# DemoUserFilter allows access to API without login
+# 
+# Default values: AuthenticationFilter,DemoUserFilter
+#
+search.resource.filters=AuthenticationFilter,DemoUserFilter
+
+
+
 # options referring to the security module!
 
 # OAuth 
@@ -81,6 +95,7 @@
 security.secure.hash.algorithm=BCRYPT
 security.encryption.loadFactor = 10
 
+# DEPRECATED
 # JWT
 security.jwt.issuer=korap.ids-mannheim.de
 security.sharedSecret=this-is-shared-secret-code-for-JWT-Signing.It-must-contains-minimum-256-bits
@@ -94,8 +109,4 @@
 security.idleTimeoutDuration = 25M
 security.multipleLogIn = true
 security.loginAttemptNum = 3
-security.authAttemptTTL = 45M
-
-#EM: deprecated and not used
-#security.validation.stringLength = 150
-#security.validation.emailLength = 50
+security.authAttemptTTL = 45M
\ No newline at end of file