diff --git a/full/pom.xml b/full/pom.xml
index 5d2a0cf..238fbc6 100644
--- a/full/pom.xml
+++ b/full/pom.xml
@@ -221,6 +221,16 @@
 			<artifactId>spring-tx</artifactId>
 			<version>${spring-framework.version}</version>
 		</dependency>
+		<dependency>
+		    <groupId>org.springframework.security</groupId>
+		    <artifactId>spring-security-core</artifactId>
+		    <version>4.2.3.RELEASE</version>
+		</dependency>
+		<dependency>
+		    <groupId>org.springframework.security</groupId>
+		    <artifactId>spring-security-web</artifactId>
+		    <version>4.2.3.RELEASE</version>
+		</dependency>
 
 		<!-- Flyway -->
 		<dependency>
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
index 7072d5b..8c41ab0 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
@@ -8,6 +8,7 @@
 
 import de.ids_mannheim.korap.config.JWTSigner;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationIface;
@@ -34,7 +35,6 @@
                 config.getIssuer(), config.getTokenTTL());
     }
 
-
     @Override
     public TokenContext getTokenContext (String authToken)
             throws KustvaktException {
@@ -42,7 +42,7 @@
         //Element ein = invalided.get(authToken);
         try {
             context = signedToken.getTokenContext(authToken);
-            context.setAuthenticationType(getIdentifier());
+            context.setTokenType(getTokenType());
         }
         catch (JOSEException | ParseException ex) {
             throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT);
@@ -65,7 +65,7 @@
         catch (ParseException e) {
             throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT);
         }
-        c.setAuthenticationType(getIdentifier());
+        c.setTokenType(getTokenType());
         c.setToken(jwt.serialize());
         //id_tokens.put(new Element(c.getToken(), c));
         return c;
@@ -86,4 +86,10 @@
             throws KustvaktException {
         return null;
     }
+    
+
+    @Override
+    public TokenType getTokenType () {
+        return TokenType.API;
+    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/BasicAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/BasicAuthentication.java
index 793b990..96b5800 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/BasicAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/BasicAuthentication.java
@@ -7,7 +7,7 @@
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.authentication.http.TransferEncoding;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.Scopes;
 import de.ids_mannheim.korap.dao.UserDao;
@@ -28,7 +28,8 @@
  * is defined in {@link HttpAuthorizationHandler}. 
  * 
  * Basic authentication is intended to be used with a database. It is 
- * currently only used for testing using a dummy DAO (@see {@link UserDao}). 
+ * currently only used for testing using a dummy DAO (@see {@link UserDao}) 
+ * without passwords.
  *   
  * 
  * @author margaretha
@@ -55,23 +56,13 @@
     @Override
     public TokenContext getTokenContext (String authToken)
             throws KustvaktException {
-        // Hanl: fixme: handle via constructor
-        // EM: ?
         String[] values = transferEncoding.decodeBase64(authToken);
         if (values != null) {
             TokenContext c = new TokenContext();
-            User user = dao.getAccount(values[0]);
-            if (user instanceof KorAPUser
-                    && ((KorAPUser) user).getPassword() != null) {
-                boolean check = crypto.checkHash(values[1],
-                        ((KorAPUser) user).getPassword());
-
-                if (!check) return null;
-            }
             c.setUsername(values[0]);
             c.setExpirationTime(TimeUtils.plusSeconds(this.config.getTokenTTL())
                     .getMillis());
-            c.setAuthenticationType(AuthenticationType.BASIC);
+            c.setTokenType(getTokenType());
             // todo: for production mode, set true
             c.setSecureRequired(false);
             // EM: is this secure?
@@ -107,7 +98,7 @@
 
 
     @Override
-    public AuthenticationType getIdentifier () {
-        return AuthenticationType.BASIC;
+    public TokenType getTokenType () {
+        return TokenType.BASIC;
     }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java b/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
index 9c86533..0b98f76 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
@@ -20,12 +20,11 @@
 import com.unboundid.ldap.sdk.LDAPException;
 
 import de.ids_mannheim.korap.auditing.AuditRecord;
-import de.ids_mannheim.korap.authentication.http.AuthorizationData;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.AuthenticationMethod;
 import de.ids_mannheim.korap.config.BeansFactory;
-import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.FullConfiguration;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.URIParam;
 import de.ids_mannheim.korap.exceptions.EmptyResultException;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
@@ -51,7 +50,6 @@
 import de.ids_mannheim.korap.user.UserDetails;
 import de.ids_mannheim.korap.user.UserSettings;
 import de.ids_mannheim.korap.user.Userdata;
-import de.ids_mannheim.korap.utils.StringUtils;
 import de.ids_mannheim.korap.utils.TimeUtils;
 
 /**
@@ -72,7 +70,7 @@
 	private Collection userdatadaos;
 	private LoginCounter counter;
 	private ValidatorIface validator;
-
+	
 	public KustvaktAuthenticationManager(EntityHandlerIface userdb, AdminHandlerIface admindb, EncryptionIface crypto,
 			FullConfiguration config, AuditingIface auditer, Collection<UserDataDbIface> userdatadaos) {
 		this.entHandler = userdb;
@@ -100,7 +98,7 @@
 	 * @throws KustvaktException
 	 */
 	@Override
-	public TokenContext getTokenStatus(AuthenticationType type, String token, 
+	public TokenContext getTokenStatus(TokenType type, String token, 
 	        String host, String useragent) throws KustvaktException {
 
 		AuthenticationIface provider = getProvider(type , null);
@@ -146,7 +144,7 @@
 	}
 
 	public TokenContext refresh(TokenContext context) throws KustvaktException {
-		AuthenticationIface provider = getProvider(context.getAuthenticationType(), null);
+		AuthenticationIface provider = getProvider(context.getTokenType(), null);
 		if (provider == null) {
 			// todo:
 		}
@@ -170,10 +168,10 @@
 	 * @throws KustvaktException
 	 */
 	@Override
-	public User authenticate(AuthenticationType type, String username, String password, Map<String, Object> attributes)
+	public User authenticate(AuthenticationMethod method, String username, String password, Map<String, Object> attributes)
 			throws KustvaktException {
 		User user;
-		switch (type) {
+		switch (method) {
 		case SHIBBOLETH:
 			// todo:
 			user = authenticateShib(attributes);
@@ -252,9 +250,10 @@
 	} // getAccess
 
 	@Override
-	public TokenContext createTokenContext(User user, Map<String, Object> attr, AuthenticationType type)
+	public TokenContext createTokenContext(User user, Map<String, Object> attr, TokenType type)
 			throws KustvaktException {
-		AuthenticationIface provider = getProvider(type, AuthenticationType.LDAP);
+	    //  use api token
+		AuthenticationIface provider = getProvider(type, TokenType.API);
 
 		// EM: not in the new DB
 //		if (attr.get(Attributes.SCOPES) != null)
@@ -535,11 +534,11 @@
 
 	public void logout(TokenContext context) throws KustvaktException {
 		try {
-			AuthenticationIface provider = getProvider(context.getAuthenticationType(), null);
+			AuthenticationIface provider = getProvider(context.getTokenType(), null);
 
 			if (provider == null) {
 				throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT, "Authentication "
-				        + "provider not supported!", context.getAuthenticationType().name());
+				        + "provider not supported!", context.getTokenType().displayName());
 			}
 			provider.removeUserSession(context.getToken());
 		} catch (KustvaktException e) {
@@ -923,4 +922,5 @@
 			throw new WrappedException(e, StatusCodes.UPDATE_ACCOUNT_FAILED);
 		}
 	}
+
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java b/full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java
index 1ce2772..44ed646 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java
@@ -28,7 +28,7 @@
 
 import com.unboundid.ldap.sdk.*;
 
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 
 import java.io.*;
@@ -78,8 +78,8 @@
     
 	
 	@Override
-	public AuthenticationType getIdentifier () {
-	    return AuthenticationType.LDAP;
+	public TokenType getTokenType () {
+	    return TokenType.API;
 	}
 	 
 	/**
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java
index 0257c68..368c390 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java
@@ -9,7 +9,7 @@
 import de.ids_mannheim.korap.interfaces.AuthenticationIface;
 import de.ids_mannheim.korap.interfaces.db.PersistenceClient;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.NamingUtils;
@@ -64,7 +64,7 @@
         catch (ParseException e) {
             throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT);
         }
-        c.setAuthenticationType(AuthenticationType.OPENID);
+        c.setTokenType(getTokenType());
         c.setToken(jwt.serialize());
         CacheManager.getInstance().getCache("id_tokens")
                 .put(new Element(c.getToken(), c));
@@ -85,7 +85,7 @@
 
 
     @Override
-    public AuthenticationType getIdentifier () {
-        return AuthenticationType.OPENID;
+    public TokenType getTokenType() {
+        return TokenType.ID_TOKEN;
     }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java
index c0eb9cd..b32879e 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java
@@ -6,7 +6,7 @@
 import de.ids_mannheim.korap.interfaces.AuthenticationIface;
 import de.ids_mannheim.korap.interfaces.EncryptionIface;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.TimeUtils;
@@ -67,7 +67,7 @@
                 now.getMillis());
         TokenContext ctx = new TokenContext();
         ctx.setUsername(user.getUsername());
-        ctx.setAuthenticationType(AuthenticationType.SESSION);
+        ctx.setTokenType(TokenType.SESSION);
         ctx.setToken(token);
         ctx.setExpirationTime(ex.getMillis()+(1000));
         ctx.setHostAddress(attr.get(Attributes.HOST).toString());
@@ -93,8 +93,8 @@
 
 
     @Override
-    public AuthenticationType getIdentifier () {
-        return AuthenticationType.OPENID;
+    public TokenType getTokenType () {
+        return TokenType.SESSION;
     }
 
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/http/AuthorizationData.java b/full/src/main/java/de/ids_mannheim/korap/authentication/http/AuthorizationData.java
index 14077e6..32c9c7b 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/http/AuthorizationData.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/http/AuthorizationData.java
@@ -1,6 +1,6 @@
 package de.ids_mannheim.korap.authentication.http;
 
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
 import lombok.Getter;
 import lombok.Setter;
 
@@ -9,8 +9,9 @@
 public class AuthorizationData {
 
     private String token;
-    private AuthenticationType authenticationType;
+    private AuthenticationScheme authenticationScheme;
     private String username;
     private String password;
 
 }
+
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpAuthorizationHandler.java b/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpAuthorizationHandler.java
index f25bd96..bea9bc1 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpAuthorizationHandler.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpAuthorizationHandler.java
@@ -3,13 +3,14 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.utils.ParameterChecker;
 
-/** Implementation of HTTP authentication scheme (see RFC 7253 and 7617)
- *  for client asking for authorization and sending user data.  
+/** Implementation of Basic HTTP authentication scheme (see RFC 7253 
+ *  and 7617) for client asking for authorization and sending user 
+ *  data.  
  * 
  * @author margaretha
  * 
@@ -19,17 +20,17 @@
 
     @Autowired
     private TransferEncoding transferEncoding;
-    
-    public String createAuthorizationHeader (AuthenticationType type,
-            String username, String password) throws KustvaktException {
+
+    public String createBasicAuthorizationHeaderValue (String username, 
+            String password) throws KustvaktException {
         ParameterChecker.checkStringValue(username, "username");
         ParameterChecker.checkStringValue(password, "password");
 
         String credentials = transferEncoding.encodeBase64(username, password);
-        return type.displayName() + " " + credentials;
+        return AuthenticationScheme.BASIC.displayName()+" " + credentials;
     }
 
-    public AuthorizationData parseAuthorizationHeader (
+    public AuthorizationData parseAuthorizationHeaderValue (
             String authorizationHeader) throws KustvaktException {
         ParameterChecker.checkStringValue(authorizationHeader,
                 "authorization header");
@@ -45,13 +46,13 @@
         }
 
         AuthorizationData data = new AuthorizationData();
-        data.setAuthenticationType(
-                AuthenticationType.valueOf(values[0].toUpperCase()));
+        data.setAuthenticationScheme(
+                AuthenticationScheme.valueOf(values[0].toUpperCase()));
         data.setToken(values[1]);
         return data;
     }
 
-    public AuthorizationData parseToken (AuthorizationData data)
+    public AuthorizationData parseBasicToken (AuthorizationData data)
             throws KustvaktException {
         String[] credentials = transferEncoding.decodeBase64(data.getToken());
         data.setUsername(credentials[0]);
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpUnauthorizedHandler.java b/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpUnauthorizedHandler.java
index 026b623..8e296bc 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpUnauthorizedHandler.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/http/HttpUnauthorizedHandler.java
@@ -1,12 +1,14 @@
 package de.ids_mannheim.korap.authentication.http;
 
+import java.util.EnumSet;
+
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.ResponseBuilder;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
-import de.ids_mannheim.korap.config.FullConfiguration;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
 
 /** Implementation of HTTP authentication scheme (see RFC 7253 and 7617)
  *  for server creating responses with status 401 Unauthorized and 
@@ -17,15 +19,16 @@
  */
 @Component
 public class HttpUnauthorizedHandler {
-    @Autowired
-    private FullConfiguration config;
 
     public Response createUnauthenticatedResponse (String notification) {
-        return Response.status(Response.Status.UNAUTHORIZED)
-                .header(HttpHeaders.WWW_AUTHENTICATE,
-                        config.getAuthenticationScheme()
-                                + " realm=\"Kustvakt\"")
-                .entity(notification)
-                .build();
+        ResponseBuilder builder = Response.status(Response.Status.UNAUTHORIZED);
+
+        for (AuthenticationScheme s : EnumSet
+                .allOf(AuthenticationScheme.class)) {
+            builder = builder.header(HttpHeaders.WWW_AUTHENTICATE,
+                    s.displayName() + " realm=\"Kustvakt\"");
+        }
+
+        return builder.entity(notification).build();
     }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java b/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
index 19ab495..2474a5a 100644
--- a/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
+++ b/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
@@ -13,7 +13,7 @@
  *
  */
 @Getter
-public class FullConfiguration extends KustvaktConfiguration{
+public class FullConfiguration extends KustvaktConfiguration {
 
     private String ldapConfig;
 
@@ -41,20 +41,7 @@
         // EM: pattern for matching availability in Krill matches
         setLicensePatterns(properties);
 
-        authenticationScheme = properties.getProperty("authentication.scheme");
-        if (authenticationScheme == null) {
-            throw new NullPointerException(
-                    "authentication.scheme is missing in kustvakt.conf");
-        }
-        authenticationScheme = authenticationScheme.toLowerCase();
-        if (authenticationScheme
-                .equals(AuthenticationType.LDAP.displayName())) {
-            ldapConfig = properties.getProperty("ldap.config");
-            if (ldapConfig == null) {
-                throw new NullPointerException(
-                        "ldap.config is missing in kustvakt.conf");
-            }
-        }
+        ldapConfig = properties.getProperty("ldap.config");
     }
 
     private void setLicensePatterns (Properties properties) {
diff --git a/full/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java b/full/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java
index 816297d..72d15cb 100644
--- a/full/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java
+++ b/full/src/main/java/de/ids_mannheim/korap/handlers/OAuthDb.java
@@ -6,7 +6,7 @@
 import de.ids_mannheim.korap.exceptions.DatabaseException;
 import de.ids_mannheim.korap.interfaces.db.PersistenceClient;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.BooleanUtils;
@@ -209,8 +209,8 @@
                             c.setUsername(rs.getString(Attributes.USERNAME));
                             c.setExpirationTime(exp);
                             c.setToken(token);
-                            c.setAuthenticationType(AuthenticationType.OAUTH2);
-                            //.setTokenType(Attributes.OAUTH2_AUTHORIZATION);
+                            c.setTokenType(TokenType.BEARER);
+//                            c.setTokenType(Attributes.OAUTH2_AUTHORIZATION);
                             c.addContextParameter(Attributes.SCOPES,
                                     rs.getString(Attributes.SCOPES));
                             return c;
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/FullResponseHandler.java b/full/src/main/java/de/ids_mannheim/korap/web/FullResponseHandler.java
index dbd9ef5..c2d8df5 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/FullResponseHandler.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/FullResponseHandler.java
@@ -27,7 +27,7 @@
     @Override
     public WebApplicationException throwit (KustvaktException e) {
         Response r;
-        // EM: for all status codes > 2000?
+
         if (e.getStatusCode() == StatusCodes.AUTHORIZATION_FAILED
                 || e.getStatusCode() >= StatusCodes.AUTHENTICATION_FAILED) {
             String notification = buildNotification(e.getStatusCode(),
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java
index 532965a..fb641d5 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java
@@ -46,6 +46,7 @@
  * Last changes:
  *  removed DocumentDao (EM)
  */
+@Deprecated
 @Controller
 @Path(KustvaktServer.API_VERSION + "/admin")
 @ResourceFilters({ AdminFilter.class, PiwikFilter.class })
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/AnnotationController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/AnnotationController.java
index 803936b..939b13c 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/AnnotationController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/AnnotationController.java
@@ -36,7 +36,7 @@
  */
 @Controller
 @Path("annotation/")
-@ResourceFilters({ AuthenticationFilter.class, DemoUserFilter.class, PiwikFilter.class })
+@ResourceFilters({DemoUserFilter.class, PiwikFilter.class })
 @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
 public class AnnotationController {
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java
index 49f93ac..d5d6a5b 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java
@@ -6,6 +6,7 @@
 import java.util.Locale;
 import java.util.Map;
 
+import javax.servlet.http.HttpServletResponse;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
 import javax.ws.rs.HeaderParam;
@@ -30,11 +31,14 @@
 import de.ids_mannheim.korap.authentication.http.AuthorizationData;
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.AuthenticationMethod;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
+import de.ids_mannheim.korap.user.KorAPUser;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.JsonUtils;
@@ -64,7 +68,7 @@
     @Autowired
     private HttpAuthorizationHandler authorizationHandler;
 
-    private static Boolean DEBUG_LOG = true;
+    private static Boolean DEBUG_LOG = false;
 
     //todo: bootstrap function to transmit certain default configuration settings and examples (example user queries,
     // default usersettings, etc.)
@@ -120,6 +124,43 @@
             throw kustvaktResponseHandler.throwit(e);
         }
     }
+    
+    // EM: testing using spring security authentication manager
+    @GET
+    @Path("ldap/token")
+    public Response requestToken (@Context HttpHeaders headers,
+            @Context Locale locale,
+            @HeaderParam(ContainerRequest.USER_AGENT) String agent,
+            @HeaderParam(ContainerRequest.HOST) String host,
+            @HeaderParam("referer-url") String referer,
+            @QueryParam("scope") String scopes,
+            //   @Context WebServiceContext wsContext, // FB
+            @Context SecurityContext securityContext) {
+        
+        Map<String, Object> attr = new HashMap<>();
+        if (scopes != null && !scopes.isEmpty())
+            attr.put(Attributes.SCOPES, scopes);
+        attr.put(Attributes.HOST, host);
+        attr.put(Attributes.USER_AGENT, agent);
+        
+        User user = new KorAPUser();
+        user.setUsername(securityContext.getUserPrincipal().getName());
+        controller.setAccessAndLocation(user, headers);
+        if (DEBUG_LOG == true) System.out.printf(
+                "Debug: /token/: location=%s, access='%s'.\n",
+                user.locationtoString(), user.accesstoString());
+        attr.put(Attributes.LOCATION, user.getLocation());
+        attr.put(Attributes.CORPUS_ACCESS, user.getCorpusAccess());
+        
+        try {
+            TokenContext context = controller.createTokenContext(user, attr,
+                    TokenType.API);
+            return Response.ok(context.toJson()).build();
+        }
+        catch (KustvaktException e) {
+            throw kustvaktResponseHandler.throwit(e);
+        }
+    }
 
 
     @GET
@@ -146,8 +187,13 @@
         AuthorizationData authorizationData;
         try {
             authorizationData = authorizationHandler.
-                    parseAuthorizationHeader(auth.get(0));
-            authorizationData = authorizationHandler.parseToken(authorizationData);
+                    parseAuthorizationHeaderValue(auth.get(0));
+            if (authorizationData.getAuthenticationScheme().equals(AuthenticationScheme.BASIC)){
+                authorizationData = authorizationHandler.parseBasicToken(authorizationData);
+            }
+            else {
+                // EM: throw exception that auth scheme is not supported?
+            }
            
         }
         catch (KustvaktException e) {
@@ -205,7 +251,7 @@
         TokenContext context;
         try {
             // User user = controller.authenticate(0, values[0], values[1], attr); Implementation by Hanl
-            User user = controller.authenticate(AuthenticationType.LDAP,
+            User user = controller.authenticate(AuthenticationMethod.LDAP,
                     authorizationData.getUsername(), authorizationData.getPassword(), attr); // Implementation with IdM/LDAP
             // Userdata data = this.controller.getUserData(user, UserDetails.class); // Implem. by Hanl
             // todo: is this necessary?
@@ -217,8 +263,9 @@
             attr.put(Attributes.LOCATION, user.getLocation());
             attr.put(Attributes.CORPUS_ACCESS, user.getCorpusAccess());
             context = controller.createTokenContext(user, attr,
-                    AuthenticationType.LDAP);
-                    //Attributes.API_AUTHENTICATION);
+                  TokenType.API);
+//            context = controller.createTokenContext(user, attr,
+//                    Attributes.API_AUTHENTICATION);
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
@@ -266,8 +313,8 @@
         AuthorizationData authorizationData;
         try {
             authorizationData = authorizationHandler.
-                    parseAuthorizationHeader(auth.get(0));
-            authorizationData = authorizationHandler.parseToken(authorizationData);
+                    parseAuthorizationHeaderValue(auth.get(0));
+            authorizationData = authorizationHandler.parseBasicToken(authorizationData);
            
         }
         catch (KustvaktException e) {
@@ -290,10 +337,13 @@
         TokenContext context;
         String contextJson;
         try {
-            User user = controller.authenticate(AuthenticationType.SESSION,
+            //EM: authentication scheme default
+            User user = controller.authenticate(AuthenticationMethod.DATABASE,
                     authorizationData.getUsername(), authorizationData.getPassword(), attr);
             context = controller.createTokenContext(user, attr,
-                    AuthenticationType.SESSION);
+                    TokenType.SESSION);
+//            context = controller.createTokenContext(user, attr,
+//                    Attributes.SESSION_AUTHENTICATION);
             contextJson = context.toJson();
             jlog.debug(contextJson);
         }
@@ -327,7 +377,7 @@
 
         try {
             // todo: distinguish type KorAP/Shibusers
-            User user = controller.authenticate(AuthenticationType.SHIBBOLETH,
+            User user = controller.authenticate(AuthenticationMethod.SHIBBOLETH,
                     null, null, attr);
             context = controller.createTokenContext(user, attr, null);
         }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
index 6616a12..a1cd54d 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
@@ -1,23 +1,26 @@
 package de.ids_mannheim.korap.web.controller;
 
-import com.sun.jersey.spi.container.ContainerRequest;
-import com.sun.jersey.spi.container.ResourceFilters;
-import de.ids_mannheim.korap.config.*;
-import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.exceptions.StatusCodes;
-import de.ids_mannheim.korap.handlers.OAuth2Handler;
-import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
-import de.ids_mannheim.korap.interfaces.EncryptionIface;
-import de.ids_mannheim.korap.server.KustvaktServer;
-import de.ids_mannheim.korap.user.*;
-import de.ids_mannheim.korap.utils.JsonUtils;
-import de.ids_mannheim.korap.utils.StringUtils;
-import de.ids_mannheim.korap.web.CoreResponseHandler;
-import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
-import de.ids_mannheim.korap.web.filter.BlockingFilter;
-import de.ids_mannheim.korap.web.filter.DemoUserFilter;
-import de.ids_mannheim.korap.web.filter.PiwikFilter;
-import de.ids_mannheim.korap.web.utils.FormRequestWrapper;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.SecurityContext;
 
 import org.apache.oltu.oauth2.as.issuer.MD5Generator;
 import org.apache.oltu.oauth2.as.issuer.OAuthIssuer;
@@ -32,20 +35,39 @@
 import org.apache.oltu.oauth2.common.message.OAuthResponse;
 import org.apache.oltu.oauth2.common.message.types.GrantType;
 import org.apache.oltu.oauth2.common.message.types.ResponseType;
-import org.apache.oltu.oauth2.common.message.types.TokenType;
 import org.apache.oltu.oauth2.common.utils.OAuthUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.*;
-import javax.ws.rs.core.*;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Set;
+import com.sun.jersey.spi.container.ContainerRequest;
+import com.sun.jersey.spi.container.ResourceFilters;
+
+import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.AuthCodeInfo;
+import de.ids_mannheim.korap.config.AuthenticationMethod;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
+import de.ids_mannheim.korap.config.BeansFactory;
+import de.ids_mannheim.korap.config.ClientInfo;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.config.Scopes;
+import de.ids_mannheim.korap.config.TokenType;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.handlers.OAuth2Handler;
+import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
+import de.ids_mannheim.korap.interfaces.EncryptionIface;
+import de.ids_mannheim.korap.server.KustvaktServer;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.user.UserDetails;
+import de.ids_mannheim.korap.user.Userdata;
+import de.ids_mannheim.korap.utils.JsonUtils;
+import de.ids_mannheim.korap.utils.StringUtils;
+import de.ids_mannheim.korap.web.CoreResponseHandler;
+import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
+import de.ids_mannheim.korap.web.filter.BlockingFilter;
+import de.ids_mannheim.korap.web.filter.DemoUserFilter;
+import de.ids_mannheim.korap.web.filter.PiwikFilter;
+import de.ids_mannheim.korap.web.utils.FormRequestWrapper;
 
 /**
  * @author hanl
@@ -319,10 +341,10 @@
                 // skips authorization code type and returns id_token and access token directly
                 if (oauthRequest.getScopes().contains("openid")) {
                     try {
+                        // EM: MH uses APIAuthentication to create api token
                         TokenContext new_context = this.controller
                                 .createTokenContext(user, attr, null);
-                        //builder.setParam(new_context.getTokenType(),
-                        builder.setParam(new_context.getAuthenticationType().name(),
+                        builder.setParam(new_context.getTokenType().displayName(),
                                 new_context.getToken());
                     }
                     catch (KustvaktException e) {
@@ -503,7 +525,7 @@
                                 .addToken(oauthRequest.getCode(), accessToken,
                                         refreshToken, config.getTokenTTL());
 
-                        builder.setTokenType(TokenType.BEARER.toString());
+                        builder.setTokenType(TokenType.BEARER.displayName());
                         builder.setExpiresIn(String.valueOf(config
                                 .getLongTokenTTL()));
                         builder.setAccessToken(accessToken);
@@ -535,7 +557,8 @@
 
                 openid_valid = true;
                 try {
-                    user = controller.authenticate(AuthenticationType.OAUTH2,
+                    // EM: MH uses database
+                    user = controller.authenticate(AuthenticationMethod.DATABASE,
                             oauthRequest.getUsername(),
                             oauthRequest.getPassword(), attr);
                 }
@@ -555,7 +578,7 @@
                                         " "), config.getLongTokenTTL());
                         builder.setRefreshToken(refresh);
                     }
-                    builder.setTokenType(TokenType.BEARER.toString());
+                    builder.setTokenType(TokenType.BEARER.displayName());
                     builder.setExpiresIn(String.valueOf(config
                             .getLongTokenTTL()));
                     builder.setAccessToken(accessToken);
@@ -571,7 +594,8 @@
                             Scopes.Scope.openid.toString())) {
                 try {
                     if (user == null)
-                        user = controller.authenticate(AuthenticationType.OAUTH2,
+                        // EM: MH uses database
+                        user = controller.authenticate(AuthenticationMethod.DATABASE,
                                 oauthRequest.getUsername(),
                                 oauthRequest.getPassword(), attr);
                     Userdata data = controller.getUserData(user,
@@ -580,11 +604,10 @@
 
                     attr.put(Attributes.CLIENT_SECRET,
                             oauthRequest.getClientSecret());
-                    TokenContext c = controller.createTokenContext(user, attr,
-                            AuthenticationType.OPENID);
+                    TokenContext c = controller.createTokenContext(user, attr,TokenType.ID_TOKEN);
                             //Attributes.OPENID_AUTHENTICATION);
-                    //EM: why openid, not oauth2?
-                    builder.setParam(c.getAuthenticationType().name(), c.getToken());
+                    
+                    builder.setParam(c.getTokenType().displayName(), c.getToken());
                 }
                 catch (KustvaktException e) {
                     throw kustvaktResponseHandler.throwit(e);
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java b/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
index 582cf1a..b1cc781 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
@@ -18,6 +18,7 @@
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.authentication.http.TransferEncoding;
 import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.AuthenticationMethod;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
@@ -30,7 +31,10 @@
 /**
  * @author hanl, margaretha
  * @date 04/2017
+ * 
+ * @see AuthenticationFilter
  */
+@Deprecated
 @Component
 @Provider
 public class AdminFilter implements ContainerRequestFilter, ResourceFilter {
@@ -42,9 +46,6 @@
     private FullResponseHandler kustvaktResponseHandler;
 
     @Autowired
-    private TransferEncoding transferEncoding;
-
-    @Autowired
     private HttpAuthorizationHandler authorizationHandler;
 
     @Override
@@ -54,8 +55,8 @@
 
         AuthorizationData data;
         try {
-            data = authorizationHandler.parseAuthorizationHeader(authorization);
-            data = authorizationHandler.parseToken(data);
+            data = authorizationHandler.parseAuthorizationHeaderValue(authorization);
+            data = authorizationHandler.parseBasicToken(data);
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
@@ -68,7 +69,7 @@
         attributes.put(Attributes.USER_AGENT, agent);
         try {
             // EM: fix me: AuthenticationType based on header value
-            User user = authManager.authenticate(data.getAuthenticationType(),
+            User user = authManager.authenticate(AuthenticationMethod.LDAP,
                     data.getUsername(), data.getPassword(), attributes);
             if (!user.isAdmin()) {
                 throw new KustvaktException(StatusCodes.AUTHENTICATION_FAILED,
@@ -83,7 +84,9 @@
 
         TokenContext c = new TokenContext();
         c.setUsername(data.getUsername());
-        c.setAuthenticationType(data.getAuthenticationType());
+        // EM: needs token type custom param in the authorization header
+//        c.setTokenType();
+        // MH: c.setTokenType(StringUtils.getTokenType(authentication));
         // EM: is this secure? Is token context not sent outside Kustvakt?
         c.setToken(data.getToken());
         c.setHostAddress(host);
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java b/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java
index c3599d4..a6df6a8 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java
@@ -12,6 +12,7 @@
 
 import de.ids_mannheim.korap.authentication.http.AuthorizationData;
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
@@ -22,7 +23,7 @@
 /**
  * @author hanl, margaretha
  * @date 28/01/2014
- * @last update 5/12/2017
+ * @last update 7/12/2017
  */
 @Component
 @Provider
@@ -46,23 +47,33 @@
         String authorization =
                 request.getHeaderValue(ContainerRequest.AUTHORIZATION);
 
-
         if (authorization != null && !authorization.isEmpty()) {
-            TokenContext context;
+            TokenContext context = null;
             AuthorizationData authData;
             try {
                 authData = authorizationHandler
-                        .parseAuthorizationHeader(authorization);
-                context = userController.getTokenStatus(
-                        authData.getAuthenticationType(), authData.getToken(),
-                        host, ua);
+                        .parseAuthorizationHeaderValue(authorization);
+                switch (authData.getAuthenticationScheme()) {
+                    case BASIC:
+                        context = userController.getTokenStatus(TokenType.BASIC,
+                                authData.getToken(), host, ua);
+                        break;
+                    case SESSION:
+                        context = userController.getTokenStatus(TokenType.SESSION,
+                                authData.getToken(), host, ua);
+                        break;
+                    // EM: bearer or api
+                    default:
+                        context = userController.getTokenStatus(TokenType.API,
+                                authData.getToken(), host, ua);
+                        break;
+                }
                 checkContext(context, request);
+                request.setSecurityContext(new KustvaktContext(context));
             }
             catch (KustvaktException e) {
                 throw kustvaktResponseHandler.throwit(e);
             }
-            
-            request.setSecurityContext(new KustvaktContext(context));
         }
         return request;
     }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java b/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
index 40928d7..d3f2cd9 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
@@ -11,7 +11,7 @@
 import com.sun.jersey.spi.container.ResourceFilter;
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.web.utils.KustvaktContext;
@@ -46,13 +46,13 @@
         TokenContext context = new TokenContext();
         String token = null;
         try {
-            token = handler.createAuthorizationHeader(AuthenticationType.BASIC,"demo", "demo2015");
+            token = handler.createBasicAuthorizationHeaderValue("demo", "demo2015");
         }
         catch (KustvaktException e) {
             e.printStackTrace();
         }
         context.setToken(token);
-        context.setAuthenticationType(AuthenticationType.LDAP);
+        context.setTokenType(TokenType.BASIC);
         context.setUsername("demo");
         return new KustvaktContext(context);
     }
diff --git a/full/src/main/resources/kustvakt.conf b/full/src/main/resources/kustvakt.conf
index ea9af81..338c726 100644
--- a/full/src/main/resources/kustvakt.conf
+++ b/full/src/main/resources/kustvakt.conf
@@ -22,10 +22,6 @@
 availability.regex.public = ACA.*
 availability.regex.all = QAO.*
 
-## authentication
-authentication.scheme = ldap
-
-
 kustvakt.management.registration=enable
 
 ## options referring to the security module!
diff --git a/full/src/test/java/de/ids_mannheim/korap/config/StringUtilsTest.java b/full/src/test/java/de/ids_mannheim/korap/config/StringUtilsTest.java
index 3edb434..80a3a87 100644
--- a/full/src/test/java/de/ids_mannheim/korap/config/StringUtilsTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/config/StringUtilsTest.java
@@ -41,7 +41,7 @@
         HttpAuthorizationHandler handler = new HttpAuthorizationHandler();
         String s1 = "basic "
                 + new String(Base64.encodeBase64("test:testPass".getBytes()));
-        AuthorizationData f1 = handler.parseAuthorizationHeader(s1);
+        AuthorizationData f1 = handler.parseAuthorizationHeaderValue(s1);
         assertEquals(s2, f1.getToken());
     }
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java
index d2e31ed..26bbfa5 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java
@@ -17,7 +17,7 @@
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.authentication.http.TransferEncoding;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.TestHelper;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
@@ -61,7 +61,7 @@
 
     @Test
     public void testSessionToken() throws KustvaktException {
-        String auth = handler.createAuthorizationHeader(AuthenticationType.SESSION, 
+        String auth = handler.createBasicAuthorizationHeaderValue( 
                 credentials[0], credentials[1]);
         ClientResponse response = resource().path("auth")
                 .path("sessionToken").header(Attributes.AUTHORIZATION, auth)
@@ -98,7 +98,7 @@
 
     @Test
     public void testSessionTokenExpire() throws KustvaktException {
-        String auth = handler.createAuthorizationHeader(AuthenticationType.SESSION,
+        String auth = handler.createBasicAuthorizationHeaderValue(
                 credentials[0], credentials[1]);
         ClientResponse response = resource().path("auth")
                 .path("sessionToken").header(Attributes.AUTHORIZATION, auth)
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java
index 5083470..7f3b33b 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java
@@ -13,7 +13,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.TestHelper;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.web.service.FastJerseyTest;
@@ -37,7 +37,7 @@
                 
                 .path("user/info")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,
+                        handler.createBasicAuthorizationHeaderValue(
                                 (String) TestHelper.getUserCredentials().get(Attributes.USERNAME),
                                 (String) TestHelper.getUserCredentials().get(Attributes.PASSWORD)))
                 .get(ClientResponse.class);
@@ -61,7 +61,7 @@
         ClientResponse resp = resource()
                 .path("user/info")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,
+                        handler.createBasicAuthorizationHeaderValue(
                                 "kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         String entity = resp.getEntity(String.class);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java
index d03cc9a..1466056 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java
@@ -35,9 +35,7 @@
 import com.sun.jersey.core.util.MultivaluedMapImpl;
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
-import de.ids_mannheim.korap.authentication.http.TransferEncoding;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
 import de.ids_mannheim.korap.config.BeanConfigTest;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.handlers.ResourceDao;
@@ -194,7 +192,7 @@
         HttpPost httppost = new HttpPost(uri);
 
         httppost.addHeader(Attributes.AUTHORIZATION,
-                handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"));
+                handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"));
         HttpResponse response = httpClient.execute(httppost);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatusLine().getStatusCode());
@@ -224,7 +222,7 @@
         HttpPost httppost = new HttpPost(uri);
 
         httppost.addHeader(Attributes.AUTHORIZATION,
-                handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"));
+                handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"));
         HttpResponse response = httpClient.execute(httppost);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatusLine().getStatusCode());
@@ -255,7 +253,7 @@
         HttpPost httppost = new HttpPost(uri);
 
         httppost.addHeader(Attributes.AUTHORIZATION,
-                handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"));
+                handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"));
         HttpResponse response = httpClient.execute(httppost);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatusLine().getStatusCode());
@@ -314,7 +312,7 @@
         URI uri = builder.build();
         HttpPost httppost = new HttpPost(uri);
         httppost.addHeader(Attributes.AUTHORIZATION,
-                handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", password));
+                handler.createBasicAuthorizationHeaderValue("kustvakt", password));
         return httpclient.execute(httppost);
 
     }
@@ -333,7 +331,7 @@
         URI uri = builder.build();
         HttpPost httppost = new HttpPost(uri);
         httppost.addHeader(Attributes.AUTHORIZATION,
-                handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"));
+                handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"));
         HttpResponse response = httpclient.execute(httppost);
         
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java
index 85ecbdd..6d997b7 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java
@@ -13,7 +13,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import de.ids_mannheim.korap.web.service.FastJerseyTest;
@@ -77,8 +77,8 @@
                 .path("p36875-36876").path("matchInfo")
                 .queryParam("foundry", "*")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(
-                                AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue(
+                                "kustvakt", "kustvakt2015"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "172.27.0.32")
                 .get(ClientResponse.class);
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/OAuth2EndpointTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/OAuth2EndpointTest.java
index 1259dc2..9d9f735 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/OAuth2EndpointTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/OAuth2EndpointTest.java
@@ -16,7 +16,7 @@
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.authentication.http.TransferEncoding;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.TestHelper;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.utils.JsonUtils;
@@ -40,8 +40,8 @@
 
     @Test
     public void testAuthorizeClient () throws ClientHandlerException, UniformInterfaceException, KustvaktException {
-        String auth = handler.createAuthorizationHeader(
-                AuthenticationType.OAUTH2, helper().getUser().getUsername(),
+        String auth = handler.createBasicAuthorizationHeaderValue(
+                helper().getUser().getUsername(),
                 (String) TestHelper.getUserCredentials().get(Attributes.PASSWORD));
         ClientResponse response = resource().path(getAPIVersion()).path("oauth2")
                 .path("register")
@@ -78,7 +78,7 @@
     @Ignore
     public void authenticate () throws KustvaktException {
         Map<String, Object> cred = TestHelper.getUserCredentials();
-        String enc = handler.createAuthorizationHeader(AuthenticationType.OAUTH2, 
+        String enc = handler.createBasicAuthorizationHeaderValue( 
                 (String) cred.get(Attributes.USERNAME), (String) cred.get(Attributes.PASSWORD));
         ClientResponse response = resource().path(getAPIVersion()).path("oauth2")
                 .path("register")
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java
index f94839e..43ce416 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java
@@ -14,7 +14,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.db.PolicyHandlerIface;
 import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
@@ -55,7 +55,7 @@
                 .queryParam("perm", Permission.READ.name())
                 .queryParam("expire", "")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -99,7 +99,7 @@
                 .queryParam("loc", "255.255.255.0")
                 .queryParam("expire", "30D")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -137,7 +137,7 @@
                 .queryParam("perm", Permission.DELETE.name())
                 .queryParam("expire", "30D")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/QuerySerializationServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/QuerySerializationServiceTest.java
index a188073..ea6ace6 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/QuerySerializationServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/QuerySerializationServiceTest.java
@@ -21,7 +21,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import de.ids_mannheim.korap.web.service.FastJerseyTest;
@@ -99,7 +99,7 @@
                 .path("corpus/BRZ10/query").queryParam("q", "[orth=der]")
                 .queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .method("GET", ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
@@ -123,7 +123,7 @@
                 .queryParam("name", "Weimarer Werke")
                 .queryParam("description", "Goethe-Werke in Weimar (seit 1775)")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -140,7 +140,7 @@
 
                 .path("collection")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
@@ -165,7 +165,7 @@
                 .queryParam("q", "[orth=der]").queryParam("ql", "poliqarp")
                 .queryParam("context", "base/s:s")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .method("GET", ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceInfoServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceInfoServiceTest.java
index a806bc6..c2ac7bb 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceInfoServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceInfoServiceTest.java
@@ -14,7 +14,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import de.ids_mannheim.korap.web.service.FastJerseyTest;
@@ -52,7 +52,7 @@
         ClientResponse response = resource().path(getAPIVersion())
                 .path("collection")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java
index 1146c66..60e36ef 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java
@@ -19,7 +19,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.handlers.ResourceDao;
 import de.ids_mannheim.korap.resources.KustvaktResource;
@@ -46,7 +46,7 @@
         ClientResponse response = resource().path(getAPIVersion())
                 .path("collection")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
@@ -59,7 +59,7 @@
         response = resource().path(getAPIVersion()).path("collection").path(id)
                 .path("stats")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -79,7 +79,7 @@
                 .path("virtualcollection").path("GOE-VC") // persistent id
                 .queryParam("name", "Goethe collection")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -104,7 +104,7 @@
                 .path("corpus").path("GOE") // persistent id
                 .queryParam("name", "Goethe corpus")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -127,7 +127,7 @@
                 .path("foundry").path("malt") // persistent id
                 .queryParam("name", "malt parser")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -149,7 +149,7 @@
         ClientResponse response = resource().path(getAPIVersion()).path("layer")
                 .path("mate/d").queryParam("name", "Mate dependency")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -172,7 +172,7 @@
                 .path("corpus").path("GOEC") // persistent id
                 .queryParam("name", "Goethe corpus")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.BAD_REQUEST.getStatusCode(),
@@ -208,7 +208,7 @@
                 .queryParam("name", "Brown")
                 .queryParam("description", "Brown corpus")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -242,7 +242,7 @@
                 .queryParam("name", "Brown")
                 .queryParam("description", "Brown corpus")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.BAD_REQUEST.getStatusCode(),
@@ -267,7 +267,7 @@
                 .queryParam("query", "author ~ Asdert")
                 .queryParam("description", "Wikipedia subcorpus from Asdert")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -303,7 +303,7 @@
                 .queryParam("name", "Goethe")
                 .queryParam("description", "Goethe corpus")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -333,7 +333,7 @@
         response = resource().path(getAPIVersion()).path("virtualcollection")
                 .path(id).queryParam("name", "Goethe")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatus());
@@ -346,7 +346,7 @@
         response = resource().path(getAPIVersion()).path("virtualcollection")
                 .path(id).queryParam("name", "Goethe collection")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -361,7 +361,7 @@
         response = resource().path(getAPIVersion()).path("virtualcollection")
                 .path(id)
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .delete(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java
index 468522d..de7e93d 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java
@@ -20,7 +20,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.config.ContextHolder;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.db.EntityHandlerIface;
@@ -143,7 +143,7 @@
                 .path("search").queryParam("q", "[orth=die]")
                 .queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -169,7 +169,7 @@
                 .path("search").queryParam("q", "[orth=die]")
                 .queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "172.27.0.32")
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -201,7 +201,7 @@
                 .queryParam("ql", "poliqarp")
                 .queryParam("cq", "textClass=politik & corpusSigle=BRZ10")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
@@ -230,7 +230,7 @@
                 .path("search").queryParam("q", "[orth=die]")
                 .queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
@@ -364,7 +364,7 @@
                 .path("corpus").path("GOE").path("search")
                 .queryParam("q", "[orth=das]").queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
@@ -406,7 +406,7 @@
                 .path("corpus").path(id).path("search")
                 .queryParam("q", "[orth=das]").queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchWithAvailabilityTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchWithAvailabilityTest.java
index 811f99d..5bc1ac4 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchWithAvailabilityTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/SearchWithAvailabilityTest.java
@@ -14,7 +14,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
+import de.ids_mannheim.korap.config.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import de.ids_mannheim.korap.web.service.FastJerseyTest;
@@ -182,7 +182,7 @@
         return resource().path("search").queryParam("q", "[orth=das]")
                 .queryParam("ql", "poliqarp").queryParam("cq", collectionQuery)
                 .header(Attributes.AUTHORIZATION,
-                        handler.createAuthorizationHeader(AuthenticationType.BASIC,"kustvakt", "kustvakt2015"))
+                        handler.createBasicAuthorizationHeaderValue("kustvakt", "kustvakt2015"))
                 .header(HttpHeaders.X_FORWARDED_FOR, ip)
                 .get(ClientResponse.class);
     }
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/UserServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/UserServiceTest.java
index b787ff4..9fbf0be 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/UserServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/UserServiceTest.java
@@ -27,7 +27,6 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
 import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.JWTSigner;
 import de.ids_mannheim.korap.config.TestHelper;
@@ -84,7 +83,7 @@
 
 		// map.putSingle("address", "Mannheim");
 
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,"testuser", "testPassword1234");
+		String enc = handler.createBasicAuthorizationHeaderValue("testuser", "testPassword1234");
 		response = resource().path("user").path("info")
 				.header("Content-Type", MediaType.APPLICATION_JSON).header(Attributes.AUTHORIZATION, enc)
 				.get(ClientResponse.class);
@@ -109,7 +108,7 @@
 
 		// run login/ status --> exception or information about locked account
 		// should appear
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,"testuser2", "testPassword1234");
+		String enc = handler.createBasicAuthorizationHeaderValue("testuser2", "testPassword1234");
 		response = resource().path("user").path("info").header(Attributes.AUTHORIZATION, enc)
 				.get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
@@ -142,7 +141,7 @@
 		response = resource().uri(URI.create(conf_uri)).get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
 
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,"testuser", "testPassword1234");
+		String enc = handler.createBasicAuthorizationHeaderValue("testuser", "testPassword1234");
 		response = resource().path("user").path("info").header(Attributes.AUTHORIZATION, enc)
 				.get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
@@ -150,7 +149,7 @@
 
 	@Test
 	public void loginHTTP() throws KustvaktException {
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		ClientResponse response = resource().path("user").path("info")
 				.header(Attributes.AUTHORIZATION, enc).get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
@@ -160,7 +159,7 @@
 	@Test
 	@Ignore
 	public void loginJWT() throws KustvaktException{
-		String en = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String en = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		/* lauffähige Version von Hanl: */
 		ClientResponse response = resource().path("auth").path("apiToken")
 				.header(Attributes.AUTHORIZATION, en).get(ClientResponse.class);
@@ -190,7 +189,7 @@
 
 		assertTrue(BeansFactory.getKustvaktContext().getConfiguration().getTokenTTL() < 10);
 
-		String en = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String en = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		ClientResponse response = resource().path("auth").path("apiToken")
 				.header(Attributes.AUTHORIZATION, en).get(ClientResponse.class);
 
@@ -218,7 +217,7 @@
 
 	@Test
 	public void testGetUserDetails() throws KustvaktException {
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		ClientResponse response = resource().path("user").path("details")
 				.header(Attributes.AUTHORIZATION, enc).get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
@@ -226,7 +225,7 @@
 
 	@Test
 	public void testGetUserDetailsEmbeddedPointer() throws KustvaktException {
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		Map m = new LinkedMap();
 		m.put("test", "[100, \"error message\", true, \"another message\"]");
 
@@ -244,7 +243,7 @@
 
 	@Test
 	public void testUpdateUserDetailsMerge() throws KustvaktException{
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		Map m = new LinkedMap();
 		m.put("test", "test value 1");
 
@@ -266,7 +265,7 @@
 
 	@Test
 	public void testGetUserDetailsPointer() throws KustvaktException {
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		ClientResponse response = resource().path("user").path("details")
 				.queryParam("pointer", "email").header(Attributes.AUTHORIZATION, enc).get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
@@ -278,7 +277,7 @@
 	public void testGetUserDetailsNonExistent() throws KustvaktException {
 		helper().setupSimpleAccount("userservicetest", "servicepass");
 
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,"userservicetest", "servicepass");
+		String enc = handler.createBasicAuthorizationHeaderValue("userservicetest", "servicepass");
 		ClientResponse response = resource().path("user").path("details")
 				.header(Attributes.AUTHORIZATION, enc).get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
@@ -292,7 +291,7 @@
 
 	@Test
 	public void testGetUserSettings() throws KustvaktException {
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		ClientResponse response = resource().path("user").path("settings")
 				.header(Attributes.AUTHORIZATION, enc).get(ClientResponse.class);
 		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatus());
@@ -300,7 +299,7 @@
 
 	@Test
 	public void testUpdateUserDetailsJson() throws KustvaktException{
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		Map m = new LinkedMap();
 		m.put("firstName", "newName");
 		m.put("lastName", "newLastName");
@@ -335,7 +334,7 @@
 	@Test
 	@Ignore
 	public void testUpdateUserSettingsForm() throws IOException, KustvaktException{
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		MultivaluedMap m = new MultivaluedMapImpl();
 		m.putSingle("queryLanguage", "poliqarp_test");
 		m.putSingle("pageLength", "200");
@@ -373,7 +372,7 @@
 
 	@Test
 	public void testUpdateUserSettingsJson() throws IOException, KustvaktException {
-		String enc = handler.createAuthorizationHeader(AuthenticationType.BASIC,credentials[0], credentials[1]);
+		String enc = handler.createBasicAuthorizationHeaderValue(credentials[0], credentials[1]);
 		Map m = new HashMap<>();
 		m.put("queryLanguage", "poliqarp_test");
 		m.put("pageLength", "200");
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java
index 2c7a8f7..e174d02 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java
@@ -18,7 +18,6 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.AuthenticationType;
 import de.ids_mannheim.korap.config.SpringJerseyTest;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
@@ -36,10 +35,10 @@
                 "{\"name\": \"new vc\",\"type\": \"PRIVATE\",\"createdBy\": "
                         + "\"test class\",\"collectionQuery\": \"corpusSigle=GOE\"}";
 
-        ClientResponse response = resource().path("vc").path("store").header(
-                Attributes.AUTHORIZATION,
-                handler.createAuthorizationHeader(AuthenticationType.BASIC,
-                        "kustvakt", "kustvakt2015"))
+        ClientResponse response = resource().path("vc").path("store")
+                .header(Attributes.AUTHORIZATION,
+                        handler.createBasicAuthorizationHeaderValue(
+                                "user","pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(json)
                 .post(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -56,14 +55,20 @@
                 .entity(json).post(ClientResponse.class);
 
         assertEquals(HttpStatus.UNAUTHORIZED.value(), response.getStatus());
-        
+
         Set<Entry<String, List<String>>> headers =
                 response.getHeaders().entrySet();
 
         for (Entry<String, List<String>> header : headers) {
             if (header.getKey().equals(ContainerRequest.WWW_AUTHENTICATE)) {
-                assertEquals("ldap realm=\"Kustvakt\"",
+                assertEquals("Api realm=\"Kustvakt\"",
                         header.getValue().get(0));
+                assertEquals("Session realm=\"Kustvakt\"",
+                        header.getValue().get(1));
+                assertEquals("Bearer realm=\"Kustvakt\"",
+                        header.getValue().get(2));
+                assertEquals("Basic realm=\"Kustvakt\"",
+                        header.getValue().get(3));
             }
         }
 
@@ -84,7 +89,7 @@
         ClientResponse response = resource().path("vc").path("store")
                 .entity(json).post(ClientResponse.class);
         String entity = response.getEntity(String.class);
-//        System.out.println(entity);
+        //        System.out.println(entity);
 
         JsonNode node = JsonUtils.readTree(entity);
         assertEquals(StatusCodes.DESERIALIZATION_FAILED,
diff --git a/full/src/test/resources/kustvakt-test.conf b/full/src/test/resources/kustvakt-test.conf
index bfb35ee..04e00b8 100644
--- a/full/src/test/resources/kustvakt-test.conf
+++ b/full/src/test/resources/kustvakt-test.conf
@@ -27,9 +27,6 @@
 availability.regex.public = ACA.*
 availability.regex.all = QAO.*
 
-## authentication
-authentication.scheme = ldap
-
 kustvakt.management.registration=enable
 
 ## options referring to the security module!
diff --git a/full/src/test/resources/policy-test.conf b/full/src/test/resources/policy-test.conf
deleted file mode 100644
index 9fd87d1..0000000
--- a/full/src/test/resources/policy-test.conf
+++ /dev/null
@@ -1,61 +0,0 @@
-# type	id	name	description	condition	permissions	collectionQuery
-
-#virtualcollection	free-corpora	License-free collection	Corpora with free license	public	read	availablity = /CC-BY.*/
-#virtualcollection	public-corpora	Public collection	Corpora available for logged-in users outside IDS intranet	public-logged-in	read	availablity = /CC-BY.*/ | availablity = /ACA.*/
-#virtualcollection	ids-corpora	IDS collection	Corpora available for logged-in users in IDS intranet	ids	read	availablity = /QAO.*/ | availablity = /ACA.*/ |  availablity = /CC-BY.*/
-virtualcollection	WPD15-VC	Wikipedia Virtual Collection	German Wikipedia 2015	ids	read	corpusSigle=WPD15 & creationDate since 2014-04-01	
-virtualcollection	GOE-VC	Goethe Virtual Collection	Goethe works from 1810	public	read	corpusSigle=GOE & creationDate since 1810-01-01
-virtualcollection	BRZ10-PC	Braunschweiger Collection	Selected Braunschweiger Zeitung	ids	read	corpusSigle=BRZ10 & foundries ~ Connexor
-corpus	WPD13	Wikipedia 2013	Public German Wikipedia 2013	public	read
-corpus	WPD15	Wikipedia 2015	IDS German Wikipedia 2015	ids	read
-corpus	GOE	Goethe	Goethe corpus	public	read
-corpus	BRZ10	Braunschweiger	Braunschweiger Zeitung 2010	ids	read
-foundry	base	base	Base foundry	public	read
-foundry	dereko	dereko	DeReKo foundry	public	read
-foundry	corenlp	corenlp	CoreNLP parser	public	read
-foundry	opennlp	opennlp	OpenNLP parser	public	read
-foundry	malt	malt	MALT parser	public	read
-foundry	mdp	mdp	MD parser	public	read
-foundry	tt	tt	Tree Tagger parser	public	read
-foundry	sgbr	sgbr	Schreibgebrauch	ids	read
-foundry	cnx	cnx	Connexor parser	ids	read
-foundry	drukola	drukola	DruKoLa parser	drukola	read
-foundry	glemm	glemm	Glemm	public	read
-foundry	marmot	marmot	MarMoT parser	public	read
-foundry	mate	mate	Mate parser	public	read
-foundry	xip	xip	Xerox Incremental Parser	ids	read
-layer	cnx/c	cnx/c	Connexor constituency layer	ids	read
-layer	cnx/syn	cnx/syn	Connexor syntax	ids	read
-layer	cnx/p	cnx/p	Connexor part of speech	ids	read
-layer	cnx/l	cnx/l	Connexor lemma	ids	read
-layer	cnx/m	cnx/m	Connexor morphology	ids	read
-layer	corenlp/c	corenlp/c	CoreNLP constituency	public	read
-layer	corenlp/p	corenlp/p	CoreNLP part of speech	public	read
-layer	corenlp/s	corenlp/s	CoreNLP structure	public	read
-layer	corenlp/ne	corenlp/ne	CoreNLP named entities	public	read
-layer	dereko/s	dereko/s	DeReKo structure	public	read
-layer	drukola/l	drukola/l	Drukola lemma	drukola	read
-layer	drukola/p	drukola/p	Drukola part of speech	drukola	read
-layer	drukola/m	drukola/m	Drukola morphology	drukola	read
-layer	glemm/l	glemm/l	GLEMM lemma	public	read
-layer	malt/d	malt/d	MALT dependency	public	read
-layer	marmot/p	marmot/p	Marmot part of speech	public	read
-layer	marmot/m	marmot/m	Marmot morphology	public	read
-layer	mate/d	mate/d	MATE dependency	public	read
-layer	mate/l	mate/l	MATE lemma	public	read
-layer	mate/p	mate/p	MATE part of speech	public	read
-layer	mate/m	mate/m	MATE morphology	public	read
-layer	mdp/d	mdp/d	MDP dependency	public	read
-layer	opennlp/p	opennlp/p	OpenNLP part of speech	public	read
-layer	opennlp/s	opennlp/s	OpenNLP part of speech	public	read
-layer	sgbr/p	sgbr/p	Schreibgebrauchp part of peech	ids	read
-layer	sgbr/l	sgbr/l	Schreibgebrauch lemma	ids	read
-layer	sgbr/lv	sgbr/lv	Schreibgebrauch lemmav ariant	ids	read
-layer	tt/p	tt/p	Tree Tagger part of speech	public	read
-layer	tt/l	tt/l	Tree Tagger lemma	public	read
-layer	tt/s	tt/s	Tree Tagger structure	public	read
-layer	xip/c	xip/c	XIP constituency	ids	read
-layer	xip/d	xip/d	XIP dependency	ids	read
-layer	xip/l	xip/l	XIP lemma	ids	read
-layer	xip/p	xip/p	XIP part of speech	ids	read
-layer	xip/s	xip/s	XIP structure	ids	read