diff --git a/dependency-reduced-pom.xml b/dependency-reduced-pom.xml
index 90437df..e2a1bce 100644
--- a/dependency-reduced-pom.xml
+++ b/dependency-reduced-pom.xml
@@ -70,7 +70,7 @@
             <exclude>**/*APITest.java</exclude>
           </excludes>
           <includes>
-            <include>de.ids_mannheim.korap.**/*.java</include>
+            <include>de/ids_mannheim/korap/**/*.java</include>
           </includes>
         </configuration>
       </plugin>
diff --git a/pom.xml b/pom.xml
index 4876e67..099aeeb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -337,7 +337,7 @@
         <dependency>
             <groupId>de.ids_mannheim.korap</groupId>
             <artifactId>Krill</artifactId>
-            <version>0.54</version>
+            <version>0.55</version>
             <exclusions>
                 <exclusion>
                     <groupId>org.xerial</groupId>
diff --git a/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java b/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java
index 7c24af2..2eb99bd 100644
--- a/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java
+++ b/src/main/java/de/ids_mannheim/korap/config/BeanConfiguration.java
@@ -10,7 +10,6 @@
 import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.context.support.FileSystemXmlApplicationContext;
 
-import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -83,17 +82,6 @@
 
     }
 
-    @Deprecated
-    private static void setManualBeans() {
-        if (getBeans().getPolicyDbProvider() != null
-                && getBeans().getEncryption() != null
-                && getBeans().getResourceProvider() != null)
-            de.ids_mannheim.korap.security.ac.SecurityManager
-                    .setProviders(getBeans().getPolicyDbProvider(),
-                            getBeans().getEncryption(),
-                            Arrays.asList(getBeans().getResourceProvider()));
-    }
-
     public static void loadFileContext(String filepath) {
         if (!hasContext()) {
             ApplicationContext context = new FileSystemXmlApplicationContext(
diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java
index f63a023..6016025 100644
--- a/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktClassLoader.java
@@ -1,13 +1,8 @@
 package de.ids_mannheim.korap.config;
 
-import de.ids_mannheim.korap.interfaces.db.PersistenceClient;
-import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
 import org.reflections.Reflections;
 
 import java.lang.annotation.Annotation;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.InvocationTargetException;
-import java.util.HashSet;
 import java.util.Set;
 
 /**
@@ -37,38 +32,4 @@
             Class<? extends Annotation> annotation) {
         return reflections.getTypesAnnotatedWith(annotation);
     }
-
-
-
-    @Deprecated
-    public static void registerResourceClasses() {
-        PersistenceClient cl = BeanConfiguration.getBeans()
-                .getPersistenceClient();
-        Set<ResourceOperationIface> set = new HashSet<>();
-        Set<Class<? extends ResourceOperationIface>> resource_prov = loadSubTypes(
-                ResourceOperationIface.class);
-        for (Class<? extends ResourceOperationIface> op : resource_prov) {
-            Constructor c;
-            try {
-                c = op.getConstructor(PersistenceClient.class);
-                set.add((ResourceOperationIface) c.newInstance(cl));
-            }catch (NoSuchMethodException | InvocationTargetException | InstantiationException | IllegalAccessException e) {
-                // do nothing;
-            }
-        }
-
-        if (BeanConfiguration.hasContext()) {
-            BeanConfiguration.BeanHolderHelper helper = BeanConfiguration
-                    .getBeans();
-            if (helper.getPolicyDbProvider() != null
-                    && helper.getEncryption() != null
-                    && helper.getResourceProvider() != null) {
-
-                de.ids_mannheim.korap.security.ac.SecurityManager
-                        .setProviders(helper.getPolicyDbProvider(),
-                                helper.getEncryption(), set);
-
-            }
-        }
-    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
index fcdca03..5cd0738 100755
--- a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
@@ -41,11 +41,6 @@
             throw new RuntimeException("provider not set!");
     }
 
-    @Deprecated
-    public static void setProviders(PolicyHandlerIface policyHandler) {
-        ResourceFinder.policydao = policyHandler;
-    }
-
     public static <T extends KustvaktResource> Set<T> search(String path,
             boolean asParent, User user, Class<T> clazz,
             Permissions.PERMISSIONS... perms) throws KustvaktException {
@@ -104,12 +99,8 @@
         Set<T> resources = new HashSet<>();
         if (this.containers != null) {
             for (KustvaktResource.Container c : this.containers) {
-                ResourceOperationIface<T> iface = SecurityManager.getHandlers()
-                        .get(c.getType());
-                if (iface == null)
-                    iface = SecurityManager.getHandlers()
-                            .get(KustvaktResource.class);
-
+                ResourceOperationIface<T> iface = BeanConfiguration.getBeans()
+                        .getResourceProvider();
                 try {
                     T resource = (T) iface
                             .findbyId(c.getPersistentID(), this.user);
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
index 50d22b9..d37385d 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
@@ -83,11 +83,6 @@
             handlers.put(iface.getType(), iface);
     }
 
-    @Deprecated
-    public static Map<Class<? extends KustvaktResource>, ResourceOperationIface> getHandlers() {
-        return handlers;
-    }
-
     /**
      * only allowed if the resource is uniquely identifiable by the name, if not, use path or id!
      * Shortcut so resource values do not need to be retrieved afterwards!
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 680f67d..b3fbbed 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -65,7 +65,8 @@
      */
     public TokenContext getTokenStatus(String token, String host,
             String useragent) throws KustvaktException {
-        jlog.info("getting session status of token '{}'", token);
+        jlog.info("getting session status of token type '{}'",
+                token.split(" ")[0]);
         AuthenticationIface provider = getProvider(
                 StringUtils.getTokenType(token), null);
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java b/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java
index 8004e31..34070b5 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java
@@ -133,12 +133,12 @@
      * TODO: persist userdata to database when session times out!
      */
     private void timeoutMaintenance() {
-        jlog.debug("running session cleanup thread");
+        jlog.trace("running session cleanup thread");
         Set<String> inactive = new HashSet<>();
         for (Entry<String, DateTime> entry : timeCheck.entrySet()) {
             if (!isUserSessionValid(entry.getKey())) {
                 TokenContext user = sessionsObject.get(entry.getKey());
-                jlog.debug("removing user session for user {}",
+                jlog.trace("removing user session for user {}",
                         user.getUsername());
                 inactive.add(user.getUsername());
                 removeSession(entry.getKey());
@@ -146,7 +146,7 @@
         }
         // fixme: not doing anything!
         if (inactive.size() > 0)
-            jlog.debug("removing inactive user session for users '{}' ",
+            jlog.trace("removing inactive user session for users '{}' ",
                     inactive);
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java
index 70670bb..ff15fe1 100644
--- a/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java
@@ -19,10 +19,11 @@
 
     @Override
     public ContainerRequest filter(ContainerRequest request) {
-        String authentication = request
-                .getHeaderValue(ContainerRequest.AUTHORIZATION);
-        if (authentication == null || authentication.isEmpty())
+        try {
+            request.getUserPrincipal();
+        }catch (UnsupportedOperationException e) {
             throw KustvaktResponseHandler.throwAuthenticationException();
+        }
         return request;
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/DefaultFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/DefaultFilter.java
index e28be03..07108a1 100644
--- a/src/main/java/de/ids_mannheim/korap/web/filter/DefaultFilter.java
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/DefaultFilter.java
@@ -31,9 +31,14 @@
                 .getHeaderValue(ContainerRequest.AUTHORIZATION);
 
         // means that this is the public service
-        if (authentication == null)
-            request.setSecurityContext(
-                    new KorAPContext(createShorterToken(host, ua)));
+        if (authentication == null || authentication.isEmpty()) {
+            try {
+                request.getUserPrincipal();
+            }catch (UnsupportedOperationException e) {
+                request.setSecurityContext(
+                        new KorAPContext(createShorterToken(host, ua)));
+            }
+        }
         return request;
     }
 
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java
index 2b3667a..0bed7ff 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/AuthServiceTest.java
@@ -1,6 +1,11 @@
 package de.ids_mannheim.korap.web.service.full;
 
+import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.TestHelper;
 import de.ids_mannheim.korap.web.service.FastJerseyTest;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
 
 /**
  * @author hanl
@@ -10,7 +15,35 @@
 
     //todo: test basicauth via secure connection
 
+    @BeforeClass
+    public static void setup() {
+        BeanConfiguration.loadClasspathContext("default-config.xml");
+        FastJerseyTest.setPackages("de.ids_mannheim.korap.web.service.full",
+                "de.ids_mannheim.korap.web.filter",
+                "de.ids_mannheim.korap.web.utils");
+        TestHelper.setupAccount();
+    }
 
+    @AfterClass
+    public static void close() {
+        TestHelper.dropUser();
+        BeanConfiguration.closeApplication();
+    }
+
+    @Test
+    public void testKustvaktAuth() {
+
+    }
+
+    @Test
+    public void testDemoAuth() {
+
+    }
+
+    @Test
+    public void testUnauthorizedAuth() {
+
+    }