diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
index 1ad51dd..f6e85af 100644
--- a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
@@ -93,6 +93,8 @@
     // deprec?!
     private final BACKENDS DEFAULT_ENGINE = BACKENDS.LUCENE;
 
+	private String ldapConfig;
+
 
     /**
      * loading of the properties and mapping to parameter variables
@@ -163,6 +165,8 @@
         passcodeSaltField = properties.getProperty("security.passcode.salt",
                 "accountCreation");
         
+        ldapConfig = properties.getProperty("ldap.config");
+        
 //        freeLicenses = Arrays.asList(license.split("|"));
 //        publicLicenses = Arrays.asList(properties.getProperty("kustvakt.availability.public","").split("|"));
 //        allLicenses = Arrays.asList(properties.getProperty("kustvakt.availability.all","").split("|"));
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
index 82e2fb3..0da09f1 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
@@ -86,7 +86,7 @@
         if (values != null) {
             TokenContext c = new TokenContext();
             User user = dao.getAccount(values[0]);
-            if (user instanceof KorAPUser) {
+            if (user instanceof KorAPUser && ((KorAPUser) user).getPassword() != null) {
                 boolean check = crypto.checkHash(values[1],
                         ((KorAPUser) user).getPassword());
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 7a87776..3fc69d1 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -404,7 +404,7 @@
 		// LDAP Access:
 		try {
 			// todo: unknown = ...
-			int ret = LdapAuth3.login(username, password);
+			int ret = LdapAuth3.login(username, password, config.getLdapConfig());
 			System.out.printf("Debug: autenticationIdM: Ldap.login(%s) returns: %d.\n", username, ret);
 			if (ret != LdapAuth3.LDAP_AUTH_ROK) {
 				jlog.error("LdapAuth3.login(username='{}') returns '{}'='{}'!", username, ret,
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java b/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
index c7f69fd..fe8e055 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
@@ -114,11 +114,10 @@
 	 *  17.02.17/FB
 	 */
 	
-	static String loadProp() throws IOException
+	static String loadProp(String sConfFile) throws IOException
 	
 	{
 		String sPwd = null;
-		String sConfFile = System.getProperty("user.home") + "/.config/ldap.conf";
 		FileInputStream in;
 		Properties prop;
 		
@@ -188,7 +187,7 @@
 	 *  idsStatus = 3 -> Nutzer ist LDAP-weit gesperrt
 	 */
 
-	public static int login(String sUserDN, String sUserPwd) throws LDAPException
+	public static int login(String sUserDN, String sUserPwd, String ldapConfig) throws LDAPException
 
 	{
 
@@ -200,7 +199,7 @@
 	SearchResult srchRes = null;
 
 	try{
-		sPwd = loadProp();
+		sPwd = loadProp(ldapConfig);
 		}
 	catch( IOException e )
 		{
diff --git a/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java b/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
index 41c89ff..3953323 100644
--- a/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
+++ b/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
@@ -150,10 +150,10 @@
                         layers, includeSpans, includeHighlights,
                         sentenceExpansion);
             	String availability = km.getAvailability();
-//            	String availability = "QAO-NC";
             	if (availability != null){
             		Matcher m = licensePattern.matcher(availability);
             		if (!m.matches()){
+            			km = new Match();
             			km.addError(StatusCodes.ACCESS_DENIED, 
             					"Retrieving match info with ID "+id+" is not allowed.");
             		}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
index 575e4d2..11169d8 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
@@ -503,7 +503,7 @@
         serializer.setQuery(q, ql, v);
         if (cq != null)
             serializer.setCollection(cq);
-
+        	// combine cq with availability CQ according to corpusAccess 
         MetaQueryBuilder meta = createMetaQuery(pageIndex, pageInteger, ctx,
                 pageLength, cutoff);
         serializer.setMeta(meta.raw());