diff --git a/full/src/main/java/de/ids_mannheim/korap/cache/ResourceCache.java b/full/src/main/java/de/ids_mannheim/korap/cache/ResourceCache.java
new file mode 100644
index 0000000..da3e40f
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/cache/ResourceCache.java
@@ -0,0 +1,56 @@
+package de.ids_mannheim.korap.cache;
+
+import de.ids_mannheim.korap.config.KustvaktCacheable;
+import de.ids_mannheim.korap.exceptions.EmptyResultException;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.NotAuthorizedException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.resources.KustvaktResource;
+import de.ids_mannheim.korap.resources.Permissions;
+import de.ids_mannheim.korap.resources.ResourceFactory;
+import de.ids_mannheim.korap.user.User;
+import net.sf.ehcache.CacheManager;
+import net.sf.ehcache.Element;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Collection;
+
+/**
+ * @author hanl
+ * @date 23/03/2014
+ * 
+ * @author margaretha
+ * @date 01/03/2018
+ * 
+ * EM: removed resource related code, keep cache
+ */
+
+//todo: use interface (maybe a cachable interface?) and bean instanceing
+// todo: if cachable, data integrity needs to be checked! either remove caching or check integrity!
+@SuppressWarnings("all")
+public class ResourceCache extends KustvaktCacheable {
+
+    private static Logger jlog = LoggerFactory.getLogger(ResourceCache.class);
+
+    public ResourceCache () {
+        super("resources", "key:resources");
+    }
+
+
+    @Deprecated
+    public <T extends KustvaktResource> T getCache (Object id, Class<T> cz) {
+        Element e = CacheManager.getInstance().getCache("resources").get(id);
+        if (e != null)
+            return (T) e.getObjectValue();
+        else
+            return null;
+    }
+
+
+    @Deprecated
+    public <R extends KustvaktResource> void cache (R resource) {
+        CacheManager.getInstance().getCache("resources")
+                .put(new Element(resource.getPersistentID(), resource));
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/config/AuthenticationMethod.java b/full/src/main/java/de/ids_mannheim/korap/config/AuthenticationMethod.java
new file mode 100644
index 0000000..afd81ed
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/config/AuthenticationMethod.java
@@ -0,0 +1,5 @@
+package de.ids_mannheim.korap.config;
+
+public enum AuthenticationMethod {
+    LDAP, SHIBBOLETH, DATABASE; 
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/config/AuthenticationScheme.java b/full/src/main/java/de/ids_mannheim/korap/config/AuthenticationScheme.java
new file mode 100644
index 0000000..6d9c58e
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/config/AuthenticationScheme.java
@@ -0,0 +1,14 @@
+package de.ids_mannheim.korap.config;
+
+import org.apache.commons.lang.WordUtils;
+
+public enum AuthenticationScheme {
+    // standard http
+    BASIC, BEARER,
+    // custom
+    SESSION, API;
+    
+    public String displayName () {
+        return WordUtils.capitalizeFully(name());
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationIface.java b/full/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationIface.java
new file mode 100644
index 0000000..8d715a7
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationIface.java
@@ -0,0 +1,27 @@
+package de.ids_mannheim.korap.interfaces;
+
+import java.util.Map;
+
+import de.ids_mannheim.korap.config.TokenType;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+
+public interface AuthenticationIface {
+
+    public TokenContext getTokenContext(String authToken) throws KustvaktException;
+
+
+    public TokenContext createTokenContext(User user, Map<String, Object> attr)
+            throws KustvaktException;
+
+
+    void removeUserSession (String token) throws KustvaktException;
+
+
+    public TokenContext refresh (TokenContext context) throws KustvaktException;
+
+
+    public TokenType getTokenType ();
+
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java b/full/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java
new file mode 100644
index 0000000..f968b61
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/interfaces/AuthenticationManagerIface.java
@@ -0,0 +1,131 @@
+package de.ids_mannheim.korap.interfaces;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+import javax.ws.rs.core.HttpHeaders;
+
+import de.ids_mannheim.korap.config.TokenType;
+import de.ids_mannheim.korap.config.AuthenticationMethod;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
+import de.ids_mannheim.korap.config.KustvaktCacheable;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.user.Userdata;
+
+/**
+ * @author hanl
+ * @date 15/06/2015
+ */
+public abstract class AuthenticationManagerIface extends KustvaktCacheable {
+
+    private Map<TokenType, AuthenticationIface> providers;
+
+
+    public AuthenticationManagerIface () {
+        super("id_tokens", "key:id_tokens");
+        this.providers = new HashMap<>();
+    }
+
+
+    public void setProviders (Set<AuthenticationIface> providers) {
+        for (AuthenticationIface i : providers){
+            this.providers.put(i.getTokenType(), i);
+        }
+    }
+
+
+    protected AuthenticationIface getProvider (TokenType scheme, TokenType default_iface) {
+    	
+    	// Debug FB: loop a Map
+    	
+    	 /*for (Map.Entry<String, AuthenticationIface> entry : this.providers.entrySet()) 
+    		{
+    		System.out.println("Debug: provider: Key : " + entry.getKey() + " Value : " + entry.getValue());
+    		}
+    		*/
+     // todo: configurable authentication schema
+        if (scheme == null){ 
+            return this.providers.get(default_iface);
+        }
+        else{
+            return this.providers.get(scheme);
+        }
+    }
+
+
+    public abstract TokenContext getTokenContext (TokenType type,
+            String token, String host, String useragent)
+            throws KustvaktException;
+
+
+    public abstract User getUser (String username) throws KustvaktException;
+
+    public abstract boolean isRegistered (String id);
+
+
+    public abstract User authenticate (AuthenticationMethod method, String username,
+            String password, Map<String, Object> attributes)
+            throws KustvaktException;
+
+    //    public abstract User authenticate (int type, String username,
+    //            String password, Map<String, Object> attributes)
+    //            throws KustvaktException;
+
+
+    public abstract TokenContext createTokenContext (User user,
+            Map<String, Object> attr, TokenType type)
+            throws KustvaktException;
+    
+//    public abstract TokenContext createTokenContext (User user,
+//            Map<String, Object> attr, String provider_key)
+//            throws KustvaktException;
+
+    public abstract void setAccessAndLocation (User user, HttpHeaders headers);
+
+    public abstract void logout (TokenContext context) throws KustvaktException;
+
+
+    public abstract void lockAccount (User user) throws KustvaktException;
+
+
+    public abstract User createUserAccount (Map<String, Object> attributes,
+            boolean confirmation_required) throws KustvaktException;
+
+
+    //    public abstract boolean updateAccount(User user) throws KustvaktException;
+
+    public abstract boolean deleteAccount (User user) throws KustvaktException;
+
+
+    public abstract <T extends Userdata> T getUserData (User user,
+            Class<T> clazz) throws KustvaktException;
+
+
+    public abstract void updateUserData (Userdata data)
+            throws KustvaktException;
+
+
+    public abstract Object[] validateResetPasswordRequest (String username,
+            String email) throws KustvaktException;
+
+
+    public abstract void resetPassword (String uriFragment, String username,
+            String newPassphrase) throws KustvaktException;
+
+
+    public abstract void confirmRegistration (String uriFragment,
+            String username) throws KustvaktException;
+
+
+    public String providerList () {
+        return "provider list: " + this.providers.toString();
+    }
+
+
+    public abstract User getUser (String username, String method)
+            throws KustvaktException;
+
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionConstraint.java b/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionConstraint.java
new file mode 100644
index 0000000..5d212dd
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/rewrite/CollectionConstraint.java
@@ -0,0 +1,74 @@
+package de.ids_mannheim.korap.rewrite;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.resource.rewrite.KoralNode;
+import de.ids_mannheim.korap.resource.rewrite.RewriteTask;
+import de.ids_mannheim.korap.resource.rewrite.KoralNode.RewriteIdentifier;
+import de.ids_mannheim.korap.resource.rewrite.RewriteTask.IterableRewritePath;
+import de.ids_mannheim.korap.resources.Corpus;
+import de.ids_mannheim.korap.resources.KustvaktResource;
+import de.ids_mannheim.korap.user.User;
+
+/**
+ * @author hanl
+ * @date 03/07/2015
+ */
+public class CollectionConstraint implements RewriteTask.IterableRewritePath {
+
+
+
+    @Override
+    public JsonNode rewriteQuery (KoralNode node, KustvaktConfiguration config,
+            User user) {
+        if (node.get("@type").equals("koral:doc")) {
+            if (node.get("key").equals(Attributes.CORPUS_SIGLE)) {
+                String id = node.get("value");
+                // EM: MH checks if user has access to corpus
+//                KustvaktResource corpus = check(id, user);
+//                if (corpus == null)
+                    node.removeNode(new KoralNode.RewriteIdentifier(
+                            Attributes.CORPUS_SIGLE, id));
+            }
+        }
+        return node.rawNode();
+    }
+
+
+    /**
+     * @param id
+     * @param user
+     * @return boolean if true access granted
+     */
+//    @Deprecated
+//    private KustvaktResource check (String id, User user) {
+//        // todo: can be used to circumvent access control if public filter not applied
+//        if (user == null)
+//            return null;
+//
+//        KustvaktResource corpus;
+//        try {
+//            SecurityManager m = SecurityManager
+//                    .findbyId(id, user, Corpus.class);
+//            corpus = m.getResource();
+//        }
+//        catch (RuntimeException | KustvaktException e) {
+//            return null;
+//        }
+//        return corpus;
+//    }
+
+
+    @Override
+    public JsonNode rewriteResult (KoralNode node) {
+        return null;
+    }
+
+
+    @Override
+    public String path () {
+        return "collection";
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java
index fb641d5..f85016a 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/AdminController.java
@@ -1,10 +1,8 @@
 package de.ids_mannheim.korap.web.controller;
 
-import java.util.List;
 import java.util.Locale;
 
 import javax.ws.rs.GET;
-import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
@@ -19,20 +17,13 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;
 
-import com.sun.jersey.api.core.HttpContext;
 import com.sun.jersey.spi.container.ResourceFilters;
 
 import de.ids_mannheim.korap.auditing.AuditRecord;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.db.AuditingIface;
-import de.ids_mannheim.korap.resources.KustvaktResource;
-import de.ids_mannheim.korap.resources.Permissions;
-import de.ids_mannheim.korap.resources.ResourceFactory;
-import de.ids_mannheim.korap.security.PolicyCondition;
-import de.ids_mannheim.korap.security.ac.PolicyBuilder;
 import de.ids_mannheim.korap.server.KustvaktServer;
-import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import de.ids_mannheim.korap.utils.TimeUtils;
 import de.ids_mannheim.korap.web.CoreResponseHandler;
@@ -100,80 +91,81 @@
     }
 
 
-    @POST
-    @Path("createPolicies/{id}")
-    public Response addResourcePolicy (@PathParam("id") String persistentid,
-            @QueryParam("type") String type, @QueryParam("name") String name,
-            @QueryParam("description") String description,
-            @QueryParam("group") String group,
-            @QueryParam("perm") List<String> permissions,
-            @QueryParam("loc") String loc,
-            @QueryParam("expire") String duration, @Context HttpContext context)
-            throws KustvaktException {
-
-        if (type == null | type.isEmpty()) {
-            KustvaktException e = new KustvaktException(
-                    StatusCodes.MISSING_ARGUMENT,
-                    "The value of parameter type is missing.");
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        else if (name == null | name.isEmpty()) {
-            KustvaktException e = new KustvaktException(
-                    StatusCodes.MISSING_ARGUMENT,
-                    "The value of parameter name is missing.");
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        else if (description == null | description.isEmpty()) {
-            KustvaktException e = new KustvaktException(
-                    StatusCodes.MISSING_ARGUMENT,
-                    "The value of parameter description is missing.");
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        else if (group == null | group.isEmpty()) {
-            KustvaktException e = new KustvaktException(
-                    StatusCodes.MISSING_ARGUMENT,
-                    "The value of parameter group is missing.");
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        else if (permissions == null | permissions.isEmpty()) {
-            KustvaktException e = new KustvaktException(
-                    StatusCodes.MISSING_ARGUMENT,
-                    "The value of parameter permissions is missing.");
-            throw kustvaktResponseHandler.throwit(e);
-        }
-
-
-        try {
-            KustvaktResource resource = ResourceFactory.getResource(type);
-            resource.setPersistentID(persistentid);
-            resource.setDescription(description);
-            resource.setName(name);
-
-            Permissions.Permission[] p = Permissions
-                    .read(permissions.toArray(new String[0]));
-
-            User user = (User) context.getProperties().get("user");
-
-            PolicyBuilder pb = new PolicyBuilder(user)
-                    .setConditions(new PolicyCondition(group))
-                    .setResources(resource);
-
-            if (loc != null && !loc.isEmpty()){
-                pb.setLocation(loc);
-            }
-            if (duration != null && !duration.isEmpty()){
-                long now = TimeUtils.getNow().getMillis();
-                pb.setContext(now,
-                        now + TimeUtils.convertTimeToSeconds(duration));
-            }
-            pb.setPermissions(p);
-            pb.create();
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-
-        return Response.ok().build();
-    }
+//    @Deprecated
+//    @POST
+//    @Path("createPolicies/{id}")
+//    public Response addResourcePolicy (@PathParam("id") String persistentid,
+//            @QueryParam("type") String type, @QueryParam("name") String name,
+//            @QueryParam("description") String description,
+//            @QueryParam("group") String group,
+//            @QueryParam("perm") List<String> permissions,
+//            @QueryParam("loc") String loc,
+//            @QueryParam("expire") String duration, @Context HttpContext context)
+//            throws KustvaktException {
+//
+//        if (type == null | type.isEmpty()) {
+//            KustvaktException e = new KustvaktException(
+//                    StatusCodes.MISSING_ARGUMENT,
+//                    "The value of parameter type is missing.");
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//        else if (name == null | name.isEmpty()) {
+//            KustvaktException e = new KustvaktException(
+//                    StatusCodes.MISSING_ARGUMENT,
+//                    "The value of parameter name is missing.");
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//        else if (description == null | description.isEmpty()) {
+//            KustvaktException e = new KustvaktException(
+//                    StatusCodes.MISSING_ARGUMENT,
+//                    "The value of parameter description is missing.");
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//        else if (group == null | group.isEmpty()) {
+//            KustvaktException e = new KustvaktException(
+//                    StatusCodes.MISSING_ARGUMENT,
+//                    "The value of parameter group is missing.");
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//        else if (permissions == null | permissions.isEmpty()) {
+//            KustvaktException e = new KustvaktException(
+//                    StatusCodes.MISSING_ARGUMENT,
+//                    "The value of parameter permissions is missing.");
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//
+//
+//        try {
+//            KustvaktResource resource = ResourceFactory.getResource(type);
+//            resource.setPersistentID(persistentid);
+//            resource.setDescription(description);
+//            resource.setName(name);
+//
+//            Permissions.Permission[] p = Permissions
+//                    .read(permissions.toArray(new String[0]));
+//
+//            User user = (User) context.getProperties().get("user");
+//
+//            PolicyBuilder pb = new PolicyBuilder(user)
+//                    .setConditions(new PolicyCondition(group))
+//                    .setResources(resource);
+//
+//            if (loc != null && !loc.isEmpty()){
+//                pb.setLocation(loc);
+//            }
+//            if (duration != null && !duration.isEmpty()){
+//                long now = TimeUtils.getNow().getMillis();
+//                pb.setContext(now,
+//                        now + TimeUtils.convertTimeToSeconds(duration));
+//            }
+//            pb.setPermissions(p);
+//            pb.create();
+//        }
+//        catch (KustvaktException e) {
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//
+//        return Response.ok().build();
+//    }
 
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
index a1cd54d..b43893b 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
@@ -44,7 +44,6 @@
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.config.AuthCodeInfo;
 import de.ids_mannheim.korap.config.AuthenticationMethod;
-import de.ids_mannheim.korap.config.AuthenticationScheme;
 import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.ClientInfo;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
@@ -91,8 +90,8 @@
     public OAuthController () {
         this.handler = new OAuth2Handler(BeansFactory.getKustvaktContext()
                 .getPersistenceClient());
-        this.controller = BeansFactory.getKustvaktContext()
-                .getAuthenticationManager();
+//        this.controller = BeansFactory.getKustvaktContext()
+//                .getAuthenticationManager();
         this.crypto = BeansFactory.getKustvaktContext().getEncryption();
         this.config = BeansFactory.getKustvaktContext().getConfiguration();
     }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/SearchController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/SearchController.java
index 857dfbf..27b17e1 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/SearchController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/SearchController.java
@@ -10,7 +10,6 @@
 import java.util.regex.Pattern;
 
 import javax.annotation.PostConstruct;
-import javax.ws.rs.DELETE;
 import javax.ws.rs.GET;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
@@ -35,6 +34,7 @@
 import com.sun.jersey.core.util.MultivaluedMapImpl;
 import com.sun.jersey.spi.container.ResourceFilters;
 
+import de.ids_mannheim.korap.cache.ResourceCache;
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.config.FullConfiguration;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
@@ -49,9 +49,6 @@
 import de.ids_mannheim.korap.resources.ResourceFactory;
 import de.ids_mannheim.korap.resources.VirtualCollection;
 import de.ids_mannheim.korap.rewrite.FullRewriteHandler;
-import de.ids_mannheim.korap.security.ac.ResourceFinder;
-import de.ids_mannheim.korap.security.ac.ResourceHandler;
-import de.ids_mannheim.korap.user.DemoUser;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.user.User.CorpusAccess;
@@ -67,12 +64,12 @@
 import de.ids_mannheim.korap.web.filter.PiwikFilter;
 
 /**
- * EM: To Do: restructure codes regarding service and controller
- * layers
  * 
  * @author hanl, margaretha
  * @date 29/01/2014
- * @lastUpdate 06/2017
+ * @lastUpdate 01/2018
+ * 
+ * removed deprecated codes
  */
 @Controller
 @Path("/")
@@ -85,10 +82,10 @@
             LoggerFactory.getLogger(SearchController.class);
 
     @Autowired
-    CoreResponseHandler responseHandler;
+    private CoreResponseHandler responseHandler;
     @Autowired
     private SearchKrill searchKrill;
-    private ResourceHandler resourceHandler;
+    private ResourceCache resourceHandler;
     @Autowired
     private AuthenticationManagerIface controller;
     private ClientsHandler graphDBhandler;
@@ -99,7 +96,7 @@
 
 
     public SearchController () {
-        this.resourceHandler = new ResourceHandler();
+        this.resourceHandler = new ResourceCache();
         UriBuilder builder = UriBuilder.fromUri("http://10.0.10.13").port(9997);
         this.graphDBhandler = new ClientsHandler(builder.build());
     }
@@ -224,7 +221,6 @@
     }
 
 
-    /* EM: potentially an unused service! */
     /** Builds a json query serialization from the given parameters.
      * 
      * @param locale
@@ -519,65 +515,6 @@
 
     }
 
-    @Deprecated
-    private String createQuery (User user, String type, String id,
-            KoralCollectionQueryBuilder builder) {
-        KustvaktResource resource = null;
-        try {
-            // EM: this doesn't look like very useful since the id is :
-            // 1. auto-generated 
-            // 2. random
-            // 3. not really known.
-            if (user instanceof DemoUser) {
-                Set<KustvaktResource> set = null;
-                if (StringUtils.isInteger(id)) {
-                    set = ResourceFinder.searchPublicFilteredIntId(
-                            ResourceFactory.getResourceClass(type),
-                            Integer.parseInt(id));
-                }
-                else {
-                    set = ResourceFinder.searchPublicFiltered(
-                            ResourceFactory.getResourceClass(type), id);
-                }
-                resource = (KustvaktResource) set.toArray()[0];
-            }
-            else if (StringUtils.isInteger(id)) {
-                resource = this.resourceHandler.findbyIntId(Integer.valueOf(id),
-                        user);
-            }
-            else {
-                resource = this.resourceHandler.findbyStrId(id, user,
-                        ResourceFactory.getResourceClass(type));
-            }
-        }
-        catch (KustvaktException e) {
-            jlog.error("Failed retrieving resource: {}", e.string());
-            throw responseHandler.throwit(e);
-        }
-        try {
-            if (resource instanceof VirtualCollection) {
-                // test this
-                //builder.setBaseQuery(resource.getData());
-                return JsonUtils
-                        .toJSON(builder.and().mergeWith(resource.getData()));
-            }
-            else if (resource instanceof Corpus) {
-                builder.and().with(Attributes.CORPUS_SIGLE, "=",
-                        resource.getPersistentID());
-
-                return builder.toJSON();
-            }
-
-
-            else {
-                throw responseHandler.throwit(StatusCodes.ILLEGAL_ARGUMENT,
-                        "Type parameter not supported", type);
-            }
-        }
-        catch (KustvaktException e) {
-            throw responseHandler.throwit(e);
-        }
-    }
 
     /**
      * @param context
@@ -630,298 +567,6 @@
     }
 
 
-    // EM: this handles layer id containing a slash. 
-    // Probably better to restrict the id not to contain any slash instead.
-    @Deprecated
-    @POST
-    @Path("{type}/{id}/{child}")
-    public Response updateResource (@Context SecurityContext context,
-            @Context Locale locale, @PathParam("type") String type,
-            @PathParam("id") String id, @PathParam("child") String child,
-            @QueryParam("name") String name,
-            @QueryParam("description") String description) {
-        return updateResource(context, locale, type,
-                StringUtils.joinResources(id, child), name, description);
-    }
-
-
-    @Deprecated
-    @POST
-    @Path("{type}/{id}")
-    public Response updateResource (@Context SecurityContext context,
-            @Context Locale locale, @PathParam("type") String type,
-            @PathParam("id") String id, @QueryParam("name") String name,
-            @QueryParam("description") String description) {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        User user;
-        try {
-            user = controller.getUser(ctx.getUsername());
-            KustvaktResource resource = this.resourceHandler.findbyStrId(id,
-                    user, ResourceFactory.getResourceClass(type));
-
-            if (name != null && !name.isEmpty()) {
-                if (description == null) {
-                    if (name.equals(resource.getName())) {
-                        throw new KustvaktException(StatusCodes.NOTHING_CHANGED,
-                                "No change has found.");
-                    }
-                    resource.setName(name);
-                }
-                else if (name.equals(resource.getName())
-                        && description.equals(resource.getDescription())) {
-                    throw new KustvaktException(StatusCodes.NOTHING_CHANGED,
-                            "No change has found.");
-                }
-                else {
-                    resource.setName(name);
-                    resource.setDescription(description);
-                }
-            }
-            else if (description != null && !description.isEmpty()) {
-                resource.setDescription(description);
-            }
-            else {
-                throw new KustvaktException(StatusCodes.NOTHING_CHANGED,
-                        "The given resource name and description are the same as already stored.");
-            }
-
-
-            this.resourceHandler.updateResources(user, resource);
-        }
-        catch (KustvaktException e) {
-            jlog.error("Exception encountered: {}", e.string());
-            throw responseHandler.throwit(e);
-        }
-        return Response.ok().build();
-    }
-
-    @Deprecated
-    // todo: change or deprecate
-    @POST
-    @Path("nv/{type}")
-    public Response storeResource (@Context SecurityContext context,
-            @Context Locale locale, @PathParam("type") String type,
-            @QueryParam("name") String name,
-            @QueryParam("description") String description,
-            // deprecate -> if you want to store a resource based on another,
-            // build the query first yourself or via a function
-            @QueryParam("ref") String reference,
-            @QueryParam("cache") Boolean cache,
-            @QueryParam("query") String query) {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        cache = cache != null ? cache : false;
-        type = StringUtils.normalize(type);
-        reference = StringUtils.decodeHTML(reference);
-        Map vals = new HashMap();
-        User user;
-        Class ctype;
-        try {
-            ctype = ResourceFactory.getResourceClass(type);
-            user = controller.getUser(ctx.getUsername());
-        }
-        catch (KustvaktException e) {
-            jlog.error("Exception encountered: {}", e.string());
-            throw responseHandler.throwit(e);
-        }
-        if (VirtualCollection.class.equals(ctype)) {
-            VirtualCollection cachetmp, collection;
-
-            JsonNode base = null;
-            if (reference != null && !reference.equals("null")) {
-                try {
-                    base = resourceHandler.findbyStrId(reference, user,
-                            VirtualCollection.class).getData();
-                }
-                catch (KustvaktException e) {
-                    throw responseHandler.throwit(e);
-                }
-
-            }
-            else if (query != null)
-                try {
-                    base = JsonUtils.readTree(query);
-                }
-                catch (KustvaktException e) {
-                    responseHandler.throwit(e);
-                }
-            else
-                // todo: throw exception response for no resource to save!
-                return null;
-
-            KoralCollectionQueryBuilder cquery =
-                    new KoralCollectionQueryBuilder();
-            cquery.setBaseQuery(base);
-
-            try {
-                cachetmp = ResourceFactory.getCachedCollection(cquery.toJSON());
-
-                // see if collection was cached!
-                VirtualCollection tmp = resourceHandler
-                        .getCache(cachetmp.getId(), VirtualCollection.class);
-                // if not cached, fill with stats values
-                if (tmp == null) {
-                    String stats = searchKrill.getStatistics(cquery.toJSON());
-                    cachetmp.setStats(
-                            JsonUtils.convertToClass(stats, Map.class));
-                }
-
-                if (!cache) {
-                    collection = ResourceFactory.getPermanentCollection(
-                            cachetmp, name, description);
-                    vals = collection.toMap();
-                    resourceHandler.storeResources(user, collection);
-                }
-                else {
-                    resourceHandler.cache(cachetmp);
-                    vals = cachetmp.toMap();
-                }
-
-            }
-            catch (KustvaktException e) {
-                throw responseHandler.throwit(e);
-            }
-        }
-        try {
-            return Response.ok(JsonUtils.toJSON(vals)).build();
-        }
-        catch (KustvaktException e) {
-            throw responseHandler.throwit(e);
-        }
-    }
-
-
-    /**
-     * EM: store a virtual collection in resource_store, but
-     * not in the policy_store table as well.
-     * 
-     * Retrieve cached entry first and then store collection
-     * 
-     * @param context
-     * @param locale
-     * @param query
-     * @return
-     * @throws KustvaktException
-     */
-    @Deprecated
-    @POST
-    @Path("{type}")
-    public Response storeResource (@Context SecurityContext context,
-            @Context Locale locale, @PathParam("type") String type,
-            @QueryParam("filter") Boolean filter,
-            @QueryParam("name") String name,
-            @QueryParam("description") String description,
-            @QueryParam("ref") String reference,
-            @QueryParam("cache") Boolean cache,
-            @QueryParam("query") String query) throws KustvaktException {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        filter = filter != null ? filter : false;
-        cache = cache != null ? cache : false;
-        type = StringUtils.normalize(type);
-        reference = StringUtils.decodeHTML(reference);
-        Map vals = new HashMap();
-        User user;
-        Class<KustvaktResource> ctype;
-        try {
-            ctype = ResourceFactory.getResourceClass(type);
-
-            user = controller.getUser(ctx.getUsername());
-        }
-        catch (KustvaktException e) {
-            jlog.error("Exception encountered: {}", e.string());
-            throw responseHandler.throwit(e);
-        }
-
-        if (VirtualCollection.class.equals(ctype)) {
-            VirtualCollection cachetmp, collection;
-
-            KoralCollectionQueryBuilder cquery =
-                    new KoralCollectionQueryBuilder();
-            if (reference != null && !reference.equals("null")) {
-                try {
-                    cquery.setBaseQuery(resourceHandler.findbyStrId(reference,
-                            user, VirtualCollection.class).getData());
-
-                }
-                catch (KustvaktException e) {
-                    throw responseHandler.throwit(e);
-                }
-            }
-            if (query != null && !query.isEmpty()) cquery.with(query);
-
-            cachetmp = ResourceFactory.getCachedCollection(cquery.toJSON());
-
-            // see if vc was cached!
-            VirtualCollection tmp = resourceHandler.getCache(cachetmp.getId(),
-                    VirtualCollection.class);
-
-            // if not cached, fill with stats values
-            if (tmp == null) {
-                String stats = searchKrill.getStatistics(cquery.toJSON());
-                cachetmp.setStats(JsonUtils.convertToClass(stats, Map.class));
-                if (query != null && !query.isEmpty())
-                    cachetmp.setFields(cquery.toJSON());
-            }
-
-            if (!cache && !User.UserFactory.isDemo(ctx.getUsername())) {
-                collection = ResourceFactory.getPermanentCollection(cachetmp,
-                        name, description);
-                vals = collection.toMap();
-                try {
-                    resourceHandler.storeResources(user, collection);
-                }
-                catch (KustvaktException e) {
-                    jlog.error("Exception encountered: {}", e.string());
-                    throw responseHandler.throwit(e);
-                }
-            }
-            else {
-                resourceHandler.cache(cachetmp);
-                vals = cachetmp.toMap();
-            }
-        }
-        else {
-            throw responseHandler.throwit(
-                    new KustvaktException(StatusCodes.UNSUPPORTED_RESOURCE,
-                            "Unsupported operation for the given resource type.",
-                            type));
-        }
-        return Response.ok(JsonUtils.toJSON(vals)).build();
-    }
-
-
-    @DELETE
-    @Path("{type}/{id}/{child}")
-    public Response deleteResourceChild (@Context SecurityContext context,
-            @Context Locale locale, @PathParam("type") String type,
-            @PathParam("id") String id, @PathParam("child") String child) {
-        return deleteResource(context, locale, type,
-                StringUtils.joinResources(id, child));
-    }
-
-    @Deprecated
-    @DELETE
-    @Path("{type}/{id}")
-    public Response deleteResource (@Context SecurityContext context,
-            @Context Locale locale, @PathParam("type") String type,
-            @PathParam("id") String id) {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        type = StringUtils.normalizeHTML(type);
-        id = StringUtils.decodeHTML(id);
-        try {
-            User user = controller.getUser(ctx.getUsername());
-            KustvaktResource r = ResourceFactory.getResource(type);
-            r.setPersistentID(id);
-            // todo: eliminate the need to find the resource first!
-            resourceHandler.deleteResources(user, r);
-        }
-        catch (KustvaktException e) {
-            jlog.error("Exception encountered: {}", e.string());
-            throw responseHandler.throwit(e);
-        }
-
-        return Response.ok().build();
-    }
-
     @GET
     @Path("/corpus/{corpusId}/{docId}/{textId}/{matchId}/matchInfo")
     public Response getMatchInfo (@Context SecurityContext ctx,
@@ -1026,59 +671,4 @@
         return Response.ok(results).build();
     }
 
-
-    // todo:?!
-    @POST
-    @Path("match/{id}")
-    @Deprecated
-    public Response save (@PathParam("{id}") String id,
-            @QueryParam("d") String description,
-            @Context SecurityContext context) {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        // save match for user and later retrieval!
-
-        // KustvaktResource match = new QueryMatch(id);
-        // match.setDescription(description);
-        // match.setCreated(TimeUtils.getNow().getMillis());
-        // try {
-        // this.resourceHandler.storeResources(controller.getUser(ctx), match);
-        // } catch (KustvaktException | NotAuthorizedException e) {
-        // throw MappedHTTPResponse.throwit(e);
-        // }
-
-        return Response.ok().build();
-    }
-
-
-    @GET
-    @Path("matches")
-    @Deprecated
-    public Response get (@Context SecurityContext context) {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        // todo save match for user and later retrieval!
-        // todo: retrieve matches in range! --choices: date, document, id
-        // (matchid)
-        return Response.ok().build();
-    }
-
-
-    @DELETE
-    @Path("match/{id}")
-    @Deprecated
-    public Response remove (@PathParam("{id}") String id,
-            @Context SecurityContext context) {
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        // save match for user and later retrieval!
-        try {
-            this.resourceHandler.deleteResources(
-                    this.controller.getUser(ctx.getUsername()), id);
-        }
-        catch (KustvaktException e) {
-            jlog.error("Exception encountered: {}", e.string());
-            throw responseHandler.throwit(e);
-        }
-
-        return Response.ok().build();
-    }
-
 }
diff --git a/full/src/main/resources/default-config.xml b/full/src/main/resources/default-config.xml
index 5d3f9e9..594084a 100644
--- a/full/src/main/resources/default-config.xml
+++ b/full/src/main/resources/default-config.xml
@@ -199,10 +199,6 @@
 		<constructor-arg ref="kustvakt_db" />
 	</bean>
 
-	<bean id="kustvakt_policies" class="de.ids_mannheim.korap.security.ac.PolicyDao">
-		<constructor-arg ref="kustvakt_db" />
-	</bean>
-
 	<bean name="kustvakt_encryption"
 		class="de.ids_mannheim.korap.interfaces.defaults.KustvaktEncryption">
 		<constructor-arg ref="kustvakt_config" />