diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
index 8c41ab0..7b7da01 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
@@ -22,7 +22,7 @@
  * 
  * Created by hanl on 5/23/14.
  */
-public abstract class APIAuthentication implements AuthenticationIface {
+public class APIAuthentication implements AuthenticationIface {
 
     private JWTSigner signedToken;
     private Cache invalided =
@@ -34,6 +34,13 @@
         this.signedToken = new JWTSigner(config.getSharedSecret(),
                 config.getIssuer(), config.getTokenTTL());
     }
+    
+    /** EM: for testing
+     * @param signedToken
+     */
+    public APIAuthentication (JWTSigner signedToken) {
+        this.signedToken = signedToken;
+    }
 
     @Override
     public TokenContext getTokenContext (String authToken)
diff --git a/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java b/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
index 0b98f76..528b8a1 100644
--- a/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
@@ -98,7 +98,7 @@
 	 * @throws KustvaktException
 	 */
 	@Override
-	public TokenContext getTokenStatus(TokenType type, String token, 
+	public TokenContext getTokenContext(TokenType type, String token, 
 	        String host, String useragent) throws KustvaktException {
 
 		AuthenticationIface provider = getProvider(type , null);
@@ -109,11 +109,6 @@
 			        "token type not defined or found", "token_type");
 
 		TokenContext context = provider.getTokenContext(token);
-		if (context != null && TimeUtils.isExpired(context.getExpirationTime()))
-			throw new KustvaktException(StatusCodes.EXPIRED);
-		else if (context == null)
-			throw new KustvaktException(StatusCodes.NO_RESULT_FOUND);
-
 		// if (!matchStatus(host, useragent, context))
 		// provider.removeUserSession(token);
 		return context;
diff --git a/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java b/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
index 2474a5a..4f6c541 100644
--- a/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
+++ b/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
@@ -1,18 +1,18 @@
 package de.ids_mannheim.korap.config;
 
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Properties;
 import java.util.regex.Pattern;
 
-import lombok.Getter;
-
 /** Configuration for Kustvakt full version including properties concerning
  *  authentication and licenses. 
  * 
  * @author margaretha
  *
  */
-@Getter
+
 public class FullConfiguration extends KustvaktConfiguration {
 
     private String ldapConfig;
@@ -21,6 +21,10 @@
     private String publicOnlyRegex;
     private String allOnlyRegex;
 
+    private List<String> freeRegexList;
+    private List<String> publicRegexList;
+    private List<String> allRegexList;
+
     private Pattern publicLicensePattern;
     private Pattern freeLicensePattern;
     private Pattern allLicensePattern;
@@ -45,18 +49,39 @@
     }
 
     private void setLicensePatterns (Properties properties) {
-        freeLicensePattern = compilePattern(freeOnlyRegex);
-        publicLicensePattern =
-                compilePattern(freeOnlyRegex + "|" + publicOnlyRegex);
-        allLicensePattern = compilePattern(
-                freeOnlyRegex + "|" + publicOnlyRegex + "|" + allOnlyRegex);
+        setFreeLicensePattern(compilePattern(freeOnlyRegex));
+        setPublicLicensePattern(
+                compilePattern(freeOnlyRegex + "|" + publicOnlyRegex));
+        setAllLicensePattern(compilePattern(
+                freeOnlyRegex + "|" + publicOnlyRegex + "|" + allOnlyRegex));
     }
 
     private void setLicenseRegex (Properties properties) {
         freeOnlyRegex = properties.getProperty("availability.regex.free", "");
+        freeRegexList = splitAndAddToList(freeOnlyRegex);
+
         publicOnlyRegex =
                 properties.getProperty("availability.regex.public", "");
+        publicRegexList = splitAndAddToList(publicOnlyRegex);
+
         allOnlyRegex = properties.getProperty("availability.regex.all", "");
+        allRegexList = splitAndAddToList(allOnlyRegex);
+    }
+
+    private List<String> splitAndAddToList (String regex) {
+        List<String> list;
+        if (regex.contains("|")) {
+            String[] regexes = regex.split("\\|");
+            list = new ArrayList<>(regexes.length);
+            for (String s : regexes) {
+                list.add(s.trim());
+            }
+        }
+        else{
+            list = new ArrayList<>(1);
+            list.add(regex);
+        }
+        return list;
     }
 
 
@@ -69,4 +94,64 @@
         }
     }
 
+    public String getLdapConfig () {
+        return ldapConfig;
+    }
+
+    public Pattern getPublicLicensePattern () {
+        return publicLicensePattern;
+    }
+
+    public void setPublicLicensePattern (Pattern publicLicensePattern) {
+        this.publicLicensePattern = publicLicensePattern;
+    }
+
+    public Pattern getFreeLicensePattern () {
+        return freeLicensePattern;
+    }
+
+    public void setFreeLicensePattern (Pattern freeLicensePattern) {
+        this.freeLicensePattern = freeLicensePattern;
+    }
+
+    public Pattern getAllLicensePattern () {
+        return allLicensePattern;
+    }
+
+    public void setAllLicensePattern (Pattern allLicensePattern) {
+        this.allLicensePattern = allLicensePattern;
+    }
+
+    public String getAuthenticationScheme () {
+        return authenticationScheme;
+    }
+
+    public void setAuthenticationScheme (String authenticationScheme) {
+        this.authenticationScheme = authenticationScheme;
+    }
+
+    public List<String> getFreeRegexList () {
+        return freeRegexList;
+    }
+
+    public void setFreeRegexList (List<String> freeRegexList) {
+        this.freeRegexList = freeRegexList;
+    }
+
+    public List<String> getPublicRegexList () {
+        return publicRegexList;
+    }
+
+    public void setPublicRegexList (List<String> publicRegexList) {
+        this.publicRegexList = publicRegexList;
+    }
+
+    public List<String> getAllRegexList () {
+        return allRegexList;
+    }
+
+    public void setAllRegexList (List<String> allRegexList) {
+        this.allRegexList = allRegexList;
+    }
+
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionRewrite.java b/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionRewrite.java
index 44388dd..2cc465c 100644
--- a/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionRewrite.java
+++ b/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionRewrite.java
@@ -116,16 +116,16 @@
         List<String> userAvailabilities = new ArrayList<String>();
         switch (user.getCorpusAccess()) {
             case PUB:
-                userAvailabilities.add(fullConfig.getFreeOnlyRegex());
-                userAvailabilities.add(fullConfig.getPublicOnlyRegex());
+                userAvailabilities.addAll(fullConfig.getFreeRegexList());
+                userAvailabilities.addAll(fullConfig.getPublicRegexList());
                 break;
             case ALL:
-                userAvailabilities.add(fullConfig.getFreeOnlyRegex());
-                userAvailabilities.add(fullConfig.getPublicOnlyRegex());
-                userAvailabilities.add(fullConfig.getAllOnlyRegex());
+                userAvailabilities.addAll(fullConfig.getFreeRegexList());
+                userAvailabilities.addAll(fullConfig.getPublicRegexList());
+                userAvailabilities.addAll(fullConfig.getAllRegexList());
                 break;
             case FREE:
-                userAvailabilities.add(fullConfig.getFreeOnlyRegex());
+                userAvailabilities.addAll(fullConfig.getFreeRegexList());
                 break;
         }
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java b/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java
index a6df6a8..75ef3cc 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/filter/AuthenticationFilter.java
@@ -17,13 +17,14 @@
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
 import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.utils.TimeUtils;
 import de.ids_mannheim.korap.web.FullResponseHandler;
 import de.ids_mannheim.korap.web.utils.KustvaktContext;
 
 /**
  * @author hanl, margaretha
  * @date 28/01/2014
- * @last update 7/12/2017
+ * @last update 12/2017
  */
 @Component
 @Provider
@@ -34,7 +35,7 @@
     private HttpAuthorizationHandler authorizationHandler;
 
     @Autowired
-    private AuthenticationManagerIface userController;
+    private AuthenticationManagerIface authenticationManager;
 
     @Autowired
     private FullResponseHandler kustvaktResponseHandler;
@@ -53,19 +54,21 @@
             try {
                 authData = authorizationHandler
                         .parseAuthorizationHeaderValue(authorization);
+
                 switch (authData.getAuthenticationScheme()) {
                     case BASIC:
-                        context = userController.getTokenStatus(TokenType.BASIC,
-                                authData.getToken(), host, ua);
+                        context = authenticationManager.getTokenContext(
+                                TokenType.BASIC, authData.getToken(), host, ua);
                         break;
                     case SESSION:
-                        context = userController.getTokenStatus(TokenType.SESSION,
-                                authData.getToken(), host, ua);
+                        context = authenticationManager.getTokenContext(
+                                TokenType.SESSION, authData.getToken(), host,
+                                ua);
                         break;
                     // EM: bearer or api
                     default:
-                        context = userController.getTokenStatus(TokenType.API,
-                                authData.getToken(), host, ua);
+                        context = authenticationManager.getTokenContext(
+                                TokenType.API, authData.getToken(), host, ua);
                         break;
                 }
                 checkContext(context, request);
@@ -94,6 +97,10 @@
             throw new KustvaktException(StatusCodes.AUTHENTICATION_FAILED,
                     "Request is not secure.");
         }
+        else if (TimeUtils.isExpired(context.getExpirationTime())) {
+            throw new KustvaktException(StatusCodes.EXPIRED,
+                    "Login is expired.");
+        }
     }
 
 
diff --git a/full/src/main/resources/kustvakt.conf b/full/src/main/resources/kustvakt.conf
index 8e8a59c..ee3bb7d 100644
--- a/full/src/main/resources/kustvakt.conf
+++ b/full/src/main/resources/kustvakt.conf
@@ -18,6 +18,7 @@
 default.layer.c = corenlp
 
 ## availability regex
+## only support |
 availability.regex.free = CC-BY.*
 availability.regex.public = ACA.* | QAO.NC
 availability.regex.all = QAO.*