diff --git a/Changes b/Changes
index e194067..6d71fec 100644
--- a/Changes
+++ b/Changes
@@ -1,3 +1,7 @@
+# version 0.78.1
+
+- Fix empty security context in statistics requests.
+
 # version 0.78
 
 - Renamed free resource to resource.
diff --git a/pom.xml b/pom.xml
index 112c211..be6c2a6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>de.ids-mannheim.korap.kustvakt</groupId>
 	<artifactId>Kustvakt</artifactId>
-	<version>0.78</version>
+	<version>0.78.1</version>
 	<properties>
 		<java.version>17</java.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
diff --git a/src/main/java/de/ids_mannheim/korap/core/web/controller/StatisticController.java b/src/main/java/de/ids_mannheim/korap/core/web/controller/StatisticController.java
index 398e947..998f48a 100644
--- a/src/main/java/de/ids_mannheim/korap/core/web/controller/StatisticController.java
+++ b/src/main/java/de/ids_mannheim/korap/core/web/controller/StatisticController.java
@@ -13,6 +13,7 @@
 import de.ids_mannheim.korap.security.context.TokenContext;
 import de.ids_mannheim.korap.web.CoreResponseHandler;
 import de.ids_mannheim.korap.web.filter.APIVersionFilter;
+import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
 import de.ids_mannheim.korap.web.filter.DemoUserFilter;
 import de.ids_mannheim.korap.web.utils.ResourceFilters;
 import jakarta.ws.rs.Consumes;
@@ -38,7 +39,8 @@
  */
 @Controller
 @Path("{version}/statistics/")
-@ResourceFilters({ APIVersionFilter.class, DemoUserFilter.class })
+@ResourceFilters({ APIVersionFilter.class, AuthenticationFilter.class,
+	DemoUserFilter.class })
 @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
 public class StatisticController {
 
diff --git a/src/test/java/de/ids_mannheim/korap/web/controller/StatisticsControllerTest.java b/src/test/java/de/ids_mannheim/korap/web/controller/StatisticsControllerTest.java
index 6c68ce6..c7b1fef 100644
--- a/src/test/java/de/ids_mannheim/korap/web/controller/StatisticsControllerTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/controller/StatisticsControllerTest.java
@@ -5,25 +5,25 @@
 
 import java.io.IOException;
 
-import jakarta.ws.rs.client.Entity;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response.Status;
-
 import org.junit.jupiter.api.Test;
-import com.fasterxml.jackson.databind.JsonNode;
-import jakarta.ws.rs.core.Response;
 
-import de.ids_mannheim.korap.config.SpringJerseyTest;
+import com.fasterxml.jackson.databind.JsonNode;
+
+import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.utils.JsonUtils;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
 
 /**
  * @author margaretha, diewald
  */
-public class StatisticsControllerTest extends SpringJerseyTest {
-
+public class StatisticsControllerTest extends OAuth2TestBase {
+	
     @Test
     public void testGetStatisticsNoResource ()
             throws IOException, KustvaktException {
@@ -38,6 +38,26 @@
         assertEquals(0,node.get("documents").asInt());
         assertEquals(0,node.get("tokens").asInt());
     }
+    
+    @Test
+    public void testGetStatisticsWithLogin () throws KustvaktException {
+    	Response response = requestTokenWithDoryPassword(superClientId,
+                clientSecret);
+        JsonNode node = JsonUtils.readTree(response.readEntity(String.class));
+        assertEquals(node.at("/scope").asText(), "all");
+        String accessToken = node.at("/access_token").asText();
+        
+    	String corpusQuery = "corpusSigle=GOE";
+        response = target().path(API_VERSION).path("statistics")
+                .queryParam("cq", corpusQuery).request()
+                .header(Attributes.AUTHORIZATION, "Bearer " + accessToken)
+                .get();
+        assert Status.OK.getStatusCode() == response.getStatus();
+        
+        String ent = response.readEntity(String.class);
+        node = JsonUtils.readTree(ent);
+        assertEquals(11,node.get("documents").asInt());
+	}
 
     @Test
     public void testStatisticsWithCq () throws KustvaktException {