diff --git a/src/main/resources/.DS_Store b/src/main/resources/.DS_Store
index 51b3007..0f6288e 100644
--- a/src/main/resources/.DS_Store
+++ b/src/main/resources/.DS_Store
Binary files differ
diff --git a/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql b/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql
index 5e9c968..227d660 100644
--- a/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql
+++ b/src/main/resources/db/mysql/V1.2__oauth2_tables_mysql.sql
@@ -9,37 +9,6 @@
 url VARCHAR(200) UNIQUE
 );
 
-create table oauth2_auth_codes (
-id INTEGER PRIMARY KEY AUTO_INCREMENT,
-client_id VARCHAR(100),
-auth_code VARCHAR(250),
-status INTEGER DEFAULT 1,
-scopes VARCHAR (150),
-created TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-);
-
--- define scopes?!
-create table oauth2_client_authorization (
-id INTEGER PRIMARY KEY AUTO_INCREMENT,
-fk_client_id VARCHAR(100),
-user_id INTEGER,
-FOREIGN KEY (fk_client_id)
-REFERENCES oauth2_client(client_id)
-ON DELETE CASCADE
-);
-
----- status 1 = valid, 0 = revoked
---create table oauth2_access_token (
---id INTEGER PRIMARY KEY AUTO_INCREMENT,
---access_token VARCHAR(300),
---auth_code VARCHAR(250),
---userID INTEGER,
---status INTEGER DEFAULT 1,
---expiration TIMESTAMP,
---scopes VARCHAR (150),
---FOREIGN KEY (userID)
---REFERENCES korap_users(id)
---);
 
 -- status 1 = valid, 0 = revoked, -1 = disabled
 create table oauth2_access_token (
@@ -61,3 +30,19 @@
 REFERENCES oauth2_client(client_id)
 ON DELETE CASCADE
 );
+
+
+-- also scopes?
+create table oauth2_refresh_token (
+id INTEGER PRIMARY KEY AUTO_INCREMENT,
+client_id VARCHAR(100),
+user_id INTEGER,
+expiration TIMESTAMP,
+scopes VARCHAR(350),
+FOREIGN KEY (user_id)
+REFERENCES korap_users(id)
+ON DELETE CASCADE,
+FOREIGN KEY (client_id)
+REFERENCES oauth2_client(client_id)
+ON DELETE CASCADE
+);
\ No newline at end of file
diff --git a/src/main/resources/db/sqlite/V1__Initial_version.sql b/src/main/resources/db/sqlite/V1__Initial_version.sql
index fbe252d..912e699 100644
--- a/src/main/resources/db/sqlite/V1__Initial_version.sql
+++ b/src/main/resources/db/sqlite/V1__Initial_version.sql
@@ -226,11 +226,17 @@
 url VARCHAR(200) UNIQUE
 );
 
+
+-- refresh token doesn't care about expiration.
+-- also narrower scopes for new access token with the refresh token are not supported
+-- otherwise i would require a comparison of all access_token to get the maximum scopes and compare to request
+
 -- status 1 = valid, 0 = revoked, -1 = disabled
 create table IF NOT EXISTS oauth2_access_token (
 id INTEGER PRIMARY KEY AUTOINCREMENT,
 access_token VARCHAR(300),
 auth_code VARCHAR(250),
+refresh_token VARCHAR(250),
 client_id VARCHAR(100),
 user_id INTEGER,
 -- make boolean --
@@ -240,10 +246,29 @@
 scopes VARCHAR(350),
 expiration TIMESTAMP,
 FOREIGN KEY (user_id)
-REFERENCES korap_users(id)
+REFERENCES korap_users(id),
+FOREIGN KEY (client_id)
+REFERENCES oauth2_client(client_id)
 );
 
 
+-- fixme: also scopes?
+create table oauth2_refresh_token (
+id INTEGER PRIMARY KEY AUTOINCREMENT,
+client_id VARCHAR(100),
+user_id INTEGER,
+expiration TIMESTAMP,
+scopes VARCHAR(350),
+FOREIGN KEY (user_id)
+REFERENCES korap_users(id)
+ON DELETE CASCADE,
+FOREIGN KEY (client_id)
+REFERENCES oauth2_client(client_id)
+ON DELETE CASCADE
+);
+
+
+
 -- a bit confusing. 1. creator is policy creator, 2. creator is resource creator --> different implications
 -- insert resource data from resource_store alltogether, so i dont have to retrieve anything from there?!
 create view if not exists policy_view as
diff --git a/src/main/resources/default-config.xml b/src/main/resources/default-config.xml
index 023f671..4f7d23b 100644
--- a/src/main/resources/default-config.xml
+++ b/src/main/resources/default-config.xml
@@ -64,29 +64,31 @@
     </bean>
 
     <bean id="kustvakt_db"
-          class="de.ids_mannheim.korap.ext.database.JDBCClient">
+          class="de.ids_mannheim.korap.handlers.JDBCClient">
         <constructor-arg index="0" ref="dataSource"/>
         <!-- deprecated property -->
         <property name="database" value="${jdbc.database}"/>
     </bean>
 
     <bean id="kustvakt_auditing"
-          class="de.ids_mannheim.korap.ext.database.JDBCAuditing">
+          class="de.ids_mannheim.korap.handlers.JDBCAuditing">
         <constructor-arg ref="kustvakt_db"/>
     </bean>
 
     <bean id="kustvakt_userdb"
-          class="de.ids_mannheim.korap.ext.database.EntityDao">
+          class="de.ids_mannheim.korap.handlers.EntityDao">
         <constructor-arg ref="kustvakt_db"/>
     </bean>
 
+    <!--fixme: change name according to convention -->
     <bean id="collectionProvider"
-          class="de.ids_mannheim.korap.ext.database.CollectionDao">
+          class="de.ids_mannheim.korap.handlers.CollectionDao">
         <constructor-arg ref="kustvakt_db"/>
     </bean>
 
+    <!--fixme: change name according to convention -->
     <bean id="resourceProvider"
-          class="de.ids_mannheim.korap.ext.database.ResourceDao">
+          class="de.ids_mannheim.korap.handlers.ResourceDao">
         <constructor-arg ref="kustvakt_db"/>
     </bean>
 
@@ -100,12 +102,7 @@
         <constructor-arg ref="kustvakt_config"/>
     </bean>
 
-    <bean id="resourceHandler"
-          class="de.ids_mannheim.korap.ext.security.accessControl.ResourceHandler"/>
-
-
     <!-- authentication providers to use -->
-
     <bean id="api_auth"
           class="de.ids_mannheim.korap.ext.security.authentication.APIAuthentication">
         <constructor-arg
@@ -160,14 +157,6 @@
         <property name="providers" ref="auth_providers"/>
     </bean>
 
-    <!--
-    <util:list id="providers"
-               value-type="de.ids_mannheim.korap.ext.interfaces.ResourceOperationIface">
-        <ref bean="resourceProvider"/>
-        <ref bean="collectionProvider"/>
-    </util:list>
--->
-
     <!-- todo: if db interfaces not loaded via spring, does transaction even work then? -->
     <!-- the transactional advice (i.e. what 'happens'; see the <aop:advisor/> bean below) -->
     <tx:advice id="txAdvice" transaction-manager="txManager">