diff --git a/src/main/java/caosdb/datetime/UTCDateTime.java b/src/main/java/caosdb/datetime/UTCDateTime.java
index 4da38a4f4ca93635533b305d608811494a657bff..846c8f9f266d4b834314b95e00973993d9031224 100644
--- a/src/main/java/caosdb/datetime/UTCDateTime.java
+++ b/src/main/java/caosdb/datetime/UTCDateTime.java
@@ -213,6 +213,9 @@ public class UTCDateTime implements Interval {
 
     // june 2015
     addLeapSecond(2015, 06, 30);
+
+    // dec 2016
+    addLeapSecond(2016, 12, 31);
   }
 
   public long getUTCSeconds() {
diff --git a/src/main/java/caosdb/server/CaosAuthenticator.java b/src/main/java/caosdb/server/CaosAuthenticator.java
index 87290564a0d6bc26d5d976d528e006f87ed34fd5..f2b616cf1ce5d13732c88d4f89d6959f33aab4f6 100644
--- a/src/main/java/caosdb/server/CaosAuthenticator.java
+++ b/src/main/java/caosdb/server/CaosAuthenticator.java
@@ -29,9 +29,7 @@ import caosdb.server.resource.DefaultResource;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.apache.shiro.SecurityUtils;
-import org.apache.shiro.authc.AccountException;
 import org.apache.shiro.authc.AuthenticationException;
-import org.apache.shiro.authc.CredentialsException;
 import org.apache.shiro.subject.Subject;
 import org.restlet.Context;
 import org.restlet.Request;
@@ -62,11 +60,14 @@ public class CaosAuthenticator extends Authenticator {
       if (sessionToken != null) {
         subject.login(sessionToken);
       }
-    } catch (final CredentialsException e) {
-      logger.log(Level.INFO, "LOGIN_FAILED", e);
-    } catch (final AccountException e) {
-      logger.log(Level.INFO, "LOGIN_FAILED", e);
-    } catch (final AuthenticationException e) {
+
+      // anonymous users
+      if (!subject.isAuthenticated()
+          && CaosDBServer.getServerProperty(ServerProperties.KEY_AUTH_OPTIONAL)
+              .equalsIgnoreCase("TRUE")) {
+        subject.login(AuthenticationUtils.ANONYMOUS_USER);
+      }
+    } catch (AuthenticationException e) {
       logger.log(Level.INFO, "LOGIN_FAILED", e);
     }
     return subject.isAuthenticated();
@@ -91,10 +92,6 @@ public class CaosAuthenticator extends Authenticator {
       if (oneTimeToken != null) {
         subject.login(oneTimeToken);
       }
-    } catch (final CredentialsException e) {
-      logger.log(Level.INFO, "LOGIN_FAILED", e);
-    } catch (final AccountException e) {
-      logger.log(Level.INFO, "LOGIN_FAILED", e);
     } catch (final AuthenticationException e) {
       logger.log(Level.INFO, "LOGIN_FAILED", e);
     }
diff --git a/src/main/java/caosdb/server/CaosDBServer.java b/src/main/java/caosdb/server/CaosDBServer.java
index 811137780cee9c83e787af92d0d9f50b67272ed0..8c67d51405f23f4f8b6f64a3c26b9413a6c5d80b 100644
--- a/src/main/java/caosdb/server/CaosDBServer.java
+++ b/src/main/java/caosdb/server/CaosDBServer.java
@@ -19,6 +19,7 @@
  */
 package caosdb.server;
 
+import caosdb.server.accessControl.AnonymousRealm;
 import caosdb.server.accessControl.AuthenticationUtils;
 import caosdb.server.accessControl.CaosDBAuthorizingRealm;
 import caosdb.server.accessControl.CaosDBDefaultRealm;
@@ -152,9 +153,10 @@ public class CaosDBServer extends Application {
     mainSec.put("SessionTokenValidator", SessionTokenRealm.class.getCanonicalName());
     mainSec.put("OneTimeTokenValidator", OneTimeTokenRealm.class.getCanonicalName());
     mainSec.put("CaosDBAuthorizingRealm", CaosDBAuthorizingRealm.class.getCanonicalName());
+    mainSec.put("AnonymousRealm", AnonymousRealm.class.getCanonicalName());
     mainSec.put(
         "securityManager.realms",
-        "$CaosDB, $SessionTokenValidator, $OneTimeTokenValidator, $CaosDBAuthorizingRealm");
+        "$CaosDB, $SessionTokenValidator, $OneTimeTokenValidator, $CaosDBAuthorizingRealm, $AnonymousRealm");
 
     // disable shiro's default session management. We have quasi-stateless
     // sessions
@@ -433,7 +435,8 @@ public class CaosDBServer extends Application {
           private void setSessionCookies(final Response response) {
 
             final Subject subject = SecurityUtils.getSubject();
-            if (subject.isAuthenticated()) {
+            if (subject.isAuthenticated()
+                && subject.getPrincipal() != AuthenticationUtils.ANONYMOUS_USER.getPrincipal()) {
               final SessionToken sessionToken =
                   SessionToken.generate((Principal) subject.getPrincipal(), null);
 
diff --git a/src/main/java/caosdb/server/ServerProperties.java b/src/main/java/caosdb/server/ServerProperties.java
index 011c9a6f599b596895298b2b11b54f9d7351665c..a4f93ec1c1207e21b0d282974fbf23c1a028053e 100644
--- a/src/main/java/caosdb/server/ServerProperties.java
+++ b/src/main/java/caosdb/server/ServerProperties.java
@@ -137,6 +137,7 @@ public class ServerProperties extends Properties {
     serverProperties.setProperty(KEY_USER_SOURCES_INI_FILE, basepath + "/conf/usersources.ini");
     serverProperties.setProperty(KEY_USER_FOLDERS, "FALSE");
     serverProperties.setProperty(KEY_NEW_USER_DEFAULT_ACTIVITY, "INACTIVE");
+    serverProperties.setProperty(KEY_AUTH_OPTIONAL, "FALSE");
 
     serverProperties.setProperty(KEY_MYSQL_HOST, "localhost");
     serverProperties.setProperty(KEY_MYSQL_PORT, "3306");
@@ -144,7 +145,7 @@ public class ServerProperties extends Properties {
     serverProperties.setProperty(KEY_MYSQL_USER_NAME, "CaosDB");
     serverProperties.setProperty(KEY_MYSQL_USER_PASSWORD, "CaosDB");
 
-    serverProperties.setProperty(KEY_MYSQL_SCHEMA_VERSION, "v2.0.30");
+    serverProperties.setProperty(KEY_MYSQL_SCHEMA_VERSION, "v2.1.0");
 
     serverProperties.setProperty(KEY_BASE_PATH, basepath);
     serverProperties.setProperty(KEY_CONTEXT_ROOT, "");
diff --git a/src/main/java/caosdb/server/accessControl/AnonymousAuthenticationToken.java b/src/main/java/caosdb/server/accessControl/AnonymousAuthenticationToken.java
new file mode 100644
index 0000000000000000000000000000000000000000..cd3f86f61eb66759b3eb7d0c91c29dc23637000b
--- /dev/null
+++ b/src/main/java/caosdb/server/accessControl/AnonymousAuthenticationToken.java
@@ -0,0 +1,53 @@
+/*
+ * ** header v3.0
+ * This file is a part of the CaosDB Project.
+ *
+ * Copyright (C) 2018 Research Group Biomedical Physics,
+ * Max-Planck-Institute for Dynamics and Self-Organization Göttingen
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ** end header
+ */
+package caosdb.server.accessControl;
+
+import org.apache.shiro.authc.AuthenticationToken;
+
+public class AnonymousAuthenticationToken implements AuthenticationToken {
+
+  private static final long serialVersionUID = 1424325396819592888L;
+  private static final AnonymousAuthenticationToken INSTANCE = new AnonymousAuthenticationToken();
+  public static final Object PRINCIPAL = new Object();
+
+  private AnonymousAuthenticationToken() {}
+
+  public static AnonymousAuthenticationToken getInstance() {
+    return INSTANCE;
+  }
+
+  @Override
+  public Object getPrincipal() {
+    return PRINCIPAL;
+  }
+
+  @Override
+  public Object getCredentials() {
+    return null;
+  }
+
+  @Override
+  public boolean equals(Object obj) {
+    return obj == this;
+  }
+}
diff --git a/src/main/java/caosdb/server/accessControl/AnonymousRealm.java b/src/main/java/caosdb/server/accessControl/AnonymousRealm.java
new file mode 100644
index 0000000000000000000000000000000000000000..831d45a727c95277c9d64624e136b2a2e120b3b4
--- /dev/null
+++ b/src/main/java/caosdb/server/accessControl/AnonymousRealm.java
@@ -0,0 +1,44 @@
+/*
+ * ** header v3.0
+ * This file is a part of the CaosDB Project.
+ *
+ * Copyright (C) 2018 Research Group Biomedical Physics,
+ * Max-Planck-Institute for Dynamics and Self-Organization Göttingen
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ** end header
+ */
+package caosdb.server.accessControl;
+
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.SimpleAuthenticationInfo;
+import org.apache.shiro.authc.credential.AllowAllCredentialsMatcher;
+import org.apache.shiro.realm.AuthenticatingRealm;
+
+public class AnonymousRealm extends AuthenticatingRealm {
+
+  @Override
+  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
+    return new SimpleAuthenticationInfo(token.getPrincipal(), null, getName());
+  }
+
+  public AnonymousRealm() {
+    setAuthenticationTokenClass(AnonymousAuthenticationToken.class);
+    setCredentialsMatcher(new AllowAllCredentialsMatcher());
+    setCachingEnabled(false);
+    setAuthenticationCachingEnabled(false);
+  }
+}
diff --git a/src/main/java/caosdb/server/accessControl/AuthenticationUtils.java b/src/main/java/caosdb/server/accessControl/AuthenticationUtils.java
index 78aeda064ba413328f9e10d40e507e3fe132c441..31d180a452aafad393fe9d1619705e0e2b49dd9f 100644
--- a/src/main/java/caosdb/server/accessControl/AuthenticationUtils.java
+++ b/src/main/java/caosdb/server/accessControl/AuthenticationUtils.java
@@ -36,6 +36,7 @@ import java.util.Collection;
 import java.util.LinkedList;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import org.apache.shiro.authc.AuthenticationToken;
 import org.restlet.data.Cookie;
 import org.restlet.data.CookieSetting;
 
@@ -55,6 +56,9 @@ public class AuthenticationUtils {
   public static final String SESSION_TOKEN_COOKIE = "SessionToken";
   public static final String SESSION_TIMEOUT_COOKIE = "SessionTimeOut";
 
+  public static final AuthenticationToken ANONYMOUS_USER =
+      AnonymousAuthenticationToken.getInstance();
+
   /**
    * Create a cookie for a {@link SelfValidatingAuthenticationToken}. Returns null if the parameter
    * is null or the token is invalid. The cookie will have the httpOnly and secure flags enabled.
diff --git a/src/main/java/caosdb/server/accessControl/CaosDBAuthorizingRealm.java b/src/main/java/caosdb/server/accessControl/CaosDBAuthorizingRealm.java
index a166d723654f1089734f42d405027ad297464e7c..5cfa425ac235405a0c861e54c9d97ae8ffab58f5 100644
--- a/src/main/java/caosdb/server/accessControl/CaosDBAuthorizingRealm.java
+++ b/src/main/java/caosdb/server/accessControl/CaosDBAuthorizingRealm.java
@@ -26,7 +26,6 @@ import com.google.common.base.Objects;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Set;
-import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authz.AuthorizationInfo;
@@ -98,6 +97,11 @@ public class CaosDBAuthorizingRealm extends AuthorizingRealm {
         return false;
       }
     }
+
+    @Override
+    public int hashCode() {
+      return this.principalCollection.hashCode();
+    }
   }
 
   private static final CaosDBRolePermissionResolver role_permission_resolver =
@@ -116,7 +120,7 @@ public class CaosDBAuthorizingRealm extends AuthorizingRealm {
 
     // find all roles which are associated with this principal in this
     // realm.
-    final Set<String> roles = UserSources.resolve((Principal) principals.getPrimaryPrincipal());
+    final Set<String> roles = UserSources.resolve(principals);
     if (roles != null) {
       authzInfo.setRoles(roles);
 
@@ -139,8 +143,7 @@ public class CaosDBAuthorizingRealm extends AuthorizingRealm {
   }
 
   @Override
-  protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token)
-      throws AuthenticationException {
+  protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token) {
     return null;
   }
 }
diff --git a/src/main/java/caosdb/server/accessControl/CaosDBDefaultRealm.java b/src/main/java/caosdb/server/accessControl/CaosDBDefaultRealm.java
index 7eebee4244eb9d59f86ce7a4263503a91ec12c9a..209487b751c0b73b5fd9085827295d5eb2ce831d 100644
--- a/src/main/java/caosdb/server/accessControl/CaosDBDefaultRealm.java
+++ b/src/main/java/caosdb/server/accessControl/CaosDBDefaultRealm.java
@@ -22,7 +22,6 @@
  */
 package caosdb.server.accessControl;
 
-import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.SimpleAuthenticationInfo;
@@ -32,8 +31,7 @@ import org.apache.shiro.realm.AuthenticatingRealm;
 public class CaosDBDefaultRealm extends AuthenticatingRealm {
 
   @Override
-  protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token)
-      throws AuthenticationException {
+  protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token) {
     final String realm = ((RealmUsernamePasswordToken) token).getRealm();
     final String username = ((RealmUsernamePasswordToken) token).getUsername();
     final String password = new String(((RealmUsernamePasswordToken) token).getCredentials());
@@ -50,7 +48,6 @@ public class CaosDBDefaultRealm extends AuthenticatingRealm {
 
     setCachingEnabled(false);
     setAuthenticationCachingEnabled(false);
-    // setAuthorizationCachingEnabled(false);
     setAuthenticationTokenClass(RealmUsernamePasswordToken.class);
   }
 }
diff --git a/src/main/java/caosdb/server/accessControl/SessionTokenRealm.java b/src/main/java/caosdb/server/accessControl/SessionTokenRealm.java
index 95c3642ddbac498be414b3293b8161beb580d4a5..6ee72d0295153051e5ad31a6fd0fa092ab53d6e3 100644
--- a/src/main/java/caosdb/server/accessControl/SessionTokenRealm.java
+++ b/src/main/java/caosdb/server/accessControl/SessionTokenRealm.java
@@ -22,7 +22,6 @@
  */
 package caosdb.server.accessControl;
 
-import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.SimpleAuthenticationInfo;
@@ -32,18 +31,13 @@ import org.apache.shiro.realm.AuthenticatingRealm;
 public class SessionTokenRealm extends AuthenticatingRealm {
 
   @Override
-  protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token)
-      throws AuthenticationException {
-    try {
+  protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token) {
 
-      final SelfValidatingAuthenticationToken sessionToken =
-          (SelfValidatingAuthenticationToken) token;
+    final SelfValidatingAuthenticationToken sessionToken =
+        (SelfValidatingAuthenticationToken) token;
 
-      if (sessionToken.isValid()) {
-        return new SimpleAuthenticationInfo(sessionToken.getPrincipal(), null, getName());
-      }
-    } catch (final Exception e) {
-      e.printStackTrace();
+    if (sessionToken.isValid()) {
+      return new SimpleAuthenticationInfo(sessionToken.getPrincipal(), null, getName());
     }
     return null;
   }
@@ -53,6 +47,5 @@ public class SessionTokenRealm extends AuthenticatingRealm {
     setCredentialsMatcher(new AllowAllCredentialsMatcher());
     setCachingEnabled(false);
     setAuthenticationCachingEnabled(false);
-    // setAuthorizationCachingEnabled(false);
   }
 }
diff --git a/src/main/java/caosdb/server/accessControl/UserSources.java b/src/main/java/caosdb/server/accessControl/UserSources.java
index 55b76c4653f7a7339b33bf98cd5f13c7fc6e574a..44a540da0cb58dadc17ddec7ab596389bf45b3e0 100644
--- a/src/main/java/caosdb/server/accessControl/UserSources.java
+++ b/src/main/java/caosdb/server/accessControl/UserSources.java
@@ -34,11 +34,13 @@ import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Set;
 import java.util.logging.LogManager;
 import java.util.logging.Logger;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.config.Ini;
+import org.apache.shiro.subject.PrincipalCollection;
 
 public class UserSources extends HashMap<String, UserSource> {
 
@@ -158,8 +160,16 @@ public class UserSources extends HashMap<String, UserSource> {
     return instance.map.getSectionProperty(Ini.DEFAULT_SECTION_NAME, KEY_DEAULT_REALM);
   }
 
-  public static Set<String> resolve(final Principal p) {
-    return resolve(p.getRealm(), p.getUsername());
+  public static Set<String> resolve(final PrincipalCollection principals) {
+    if (principals.getPrimaryPrincipal() == AuthenticationUtils.ANONYMOUS_USER.getPrincipal()) {
+      // anymous has one role
+      Set<String> roles = new HashSet<>();
+      roles.add("anonymous");
+      return roles;
+    }
+
+    Principal primaryPrincipal = (Principal) principals.getPrimaryPrincipal();
+    return resolve(primaryPrincipal.getRealm(), primaryPrincipal.getUsername());
   }
 
   public static boolean isRoleExisting(final String role) {
diff --git a/src/main/java/caosdb/server/entity/FileProperties.java b/src/main/java/caosdb/server/entity/FileProperties.java
index 7263b9b2b5e14f51988fa13dd969cf47f941478c..fbf8031f56566ea5a6df263d97611812bab113d0 100644
--- a/src/main/java/caosdb/server/entity/FileProperties.java
+++ b/src/main/java/caosdb/server/entity/FileProperties.java
@@ -216,8 +216,7 @@ public class FileProperties {
     };
   }
 
-  private static Undoable delete(final File file)
-      throws IOException, InterruptedException {
+  private static Undoable delete(final File file) throws IOException, InterruptedException {
     if (file.getAbsolutePath().startsWith(FileSystem.getBasepath())) {
       final Undoable d;
       final File parent = file.getParentFile();
diff --git a/src/main/java/caosdb/server/permissions/EntityACL.java b/src/main/java/caosdb/server/permissions/EntityACL.java
index d389a2163aeb46c013f8845abda104779a67d8eb..79008947823e9625283c03e1dd539328a58fef7f 100644
--- a/src/main/java/caosdb/server/permissions/EntityACL.java
+++ b/src/main/java/caosdb/server/permissions/EntityACL.java
@@ -25,6 +25,7 @@ package caosdb.server.permissions;
 import static caosdb.server.permissions.Role.OTHER_ROLE;
 import static caosdb.server.permissions.Role.OWNER_ROLE;
 
+import caosdb.server.accessControl.AuthenticationUtils;
 import caosdb.server.accessControl.Principal;
 import caosdb.server.database.exceptions.TransactionException;
 import java.util.ArrayList;
@@ -74,6 +75,9 @@ public class EntityACL {
   }
 
   public static final EntityACL getOwnerACLFor(final Subject subject) {
+    if (subject.getPrincipal() == AuthenticationUtils.ANONYMOUS_USER.getPrincipal()) {
+      return new EntityACLFactory().create();
+    }
     return getOwnerACLFor((Principal) subject.getPrincipal());
   }
 
diff --git a/src/main/java/caosdb/server/resource/AbstractCaosDBServerResource.java b/src/main/java/caosdb/server/resource/AbstractCaosDBServerResource.java
index e390d3c55576e774a78e89f17de73ed950b78cf4..27d81e72f34a48f50253d23b8e22c35781bce037 100644
--- a/src/main/java/caosdb/server/resource/AbstractCaosDBServerResource.java
+++ b/src/main/java/caosdb/server/resource/AbstractCaosDBServerResource.java
@@ -26,6 +26,7 @@ import static caosdb.server.utils.Utils.isNonNullInteger;
 import static java.net.URLDecoder.decode;
 
 import caosdb.server.CaosDBException;
+import caosdb.server.accessControl.AuthenticationUtils;
 import caosdb.server.accessControl.Principal;
 import caosdb.server.database.backend.implementation.MySQL.ConnectionException;
 import caosdb.server.entity.Message;
@@ -156,7 +157,9 @@ public abstract class AbstractCaosDBServerResource extends ServerResource {
   protected Element generateRootElement() {
     final Element retRoot = new Element("Response");
 
-    if (getUser() != null && getUser().isAuthenticated()) {
+    if (getUser() != null
+        && getUser().isAuthenticated()
+        && !getUser().getPrincipal().equals(AuthenticationUtils.ANONYMOUS_USER.getPrincipal())) {
       retRoot.setAttribute("username", ((Principal) getUser().getPrincipal()).getUsername());
       retRoot.setAttribute("realm", ((Principal) getUser().getPrincipal()).getRealm());
     }
diff --git a/src/main/java/caosdb/server/resource/ScriptingResource.java b/src/main/java/caosdb/server/resource/ScriptingResource.java
index 4687b2c5ad241baddc6662c5fb043ac955839ff6..b5a82ef33d9a50da0568defd614d6c86048c8cd9 100644
--- a/src/main/java/caosdb/server/resource/ScriptingResource.java
+++ b/src/main/java/caosdb/server/resource/ScriptingResource.java
@@ -96,10 +96,12 @@ public class ScriptingResource extends AbstractCaosDBServerResource {
   private void deleteTmpFiles() {
     for (FileProperties p : deleteFiles) {
       try {
-      p.getFile().delete();
+        p.getFile().delete();
       } catch (Exception t) {
         if (getLogger().isLoggable(Level.WARNING)) {
-          getLogger().warning("Could not delete tmp file: " + p.getPath() + "\nException: " + t.toString());
+          getLogger()
+              .warning(
+                  "Could not delete tmp file: " + p.getPath() + "\nException: " + t.toString());
         }
       }
     }
diff --git a/src/main/java/caosdb/server/scripting/CallerSerializer.java b/src/main/java/caosdb/server/scripting/CallerSerializer.java
index 1bd265650bed0d5de865cc91b29db3327b56174b..1ab96ca0ab1a3f2dfefa14175d8423fea9bd4109 100644
--- a/src/main/java/caosdb/server/scripting/CallerSerializer.java
+++ b/src/main/java/caosdb/server/scripting/CallerSerializer.java
@@ -1,3 +1,25 @@
+/*
+ * ** header v3.0
+ * This file is a part of the CaosDB Project.
+ *
+ * Copyright (C) 2018 Research Group Biomedical Physics,
+ * Max-Planck-Institute for Dynamics and Self-Organization Göttingen
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ** end header
+ */
 package caosdb.server.scripting;
 
 import caosdb.server.CaosDBException;
diff --git a/src/main/java/caosdb/server/transaction/Transaction.java b/src/main/java/caosdb/server/transaction/Transaction.java
index 2a7562c146aaca1edabb85127d488ffd2994233e..347e806e059edd124e9efde065c5509de3658c4c 100644
--- a/src/main/java/caosdb/server/transaction/Transaction.java
+++ b/src/main/java/caosdb/server/transaction/Transaction.java
@@ -23,6 +23,7 @@
 package caosdb.server.transaction;
 
 import caosdb.datetime.UTCDateTime;
+import caosdb.server.accessControl.AuthenticationUtils;
 import caosdb.server.accessControl.Principal;
 import caosdb.server.database.Database;
 import caosdb.server.database.DatabaseMonitor;
@@ -222,13 +223,17 @@ public abstract class Transaction<C extends TransactionContainer> extends Abstra
   // TODO move to post-transaction job
   private void writeHistory() throws TransactionException, Message {
     if (logHistory()) {
+      String realm =
+          getTransactor().getPrincipal() == AuthenticationUtils.ANONYMOUS_USER.getPrincipal()
+              ? ""
+              : ((Principal) getTransactor().getPrincipal()).getRealm();
+      String username =
+          getTransactor().getPrincipal() == AuthenticationUtils.ANONYMOUS_USER.getPrincipal()
+              ? "anonymous"
+              : ((Principal) getTransactor().getPrincipal()).getUsername();
       Database.execute(
           new InsertTransactionHistory(
-              getContainer(),
-              this.getClass().getSimpleName(),
-              ((Principal) getTransactor().getPrincipal()).getRealm(),
-              ((Principal) getTransactor().getPrincipal()).getUsername(),
-              getTimestamp()),
+              getContainer(), this.getClass().getSimpleName(), realm, username, getTimestamp()),
           getAccess());
     }
   }
diff --git a/src/main/java/caosdb/server/utils/Serializer.java b/src/main/java/caosdb/server/utils/Serializer.java
index 5508e99388a9e4191fd524ccbfc3e30007f6759a..26cd970c54d2bc4efcb7742ab9405a717e3ef112 100644
--- a/src/main/java/caosdb/server/utils/Serializer.java
+++ b/src/main/java/caosdb/server/utils/Serializer.java
@@ -1,3 +1,25 @@
+/*
+ * ** header v3.0
+ * This file is a part of the CaosDB Project.
+ *
+ * Copyright (C) 2018 Research Group Biomedical Physics,
+ * Max-Planck-Institute for Dynamics and Self-Organization Göttingen
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ** end header
+ */
 package caosdb.server.utils;
 
 public interface Serializer<T, S> {
diff --git a/src/test/java/caosdb/datetime/DateTimeTest.java b/src/test/java/caosdb/datetime/DateTimeTest.java
index 2c66bcb14729514c7812ab6a64b388df652cff63..6366dccd5910c972e68201e7314275825f0f84b6 100644
--- a/src/test/java/caosdb/datetime/DateTimeTest.java
+++ b/src/test/java/caosdb/datetime/DateTimeTest.java
@@ -408,7 +408,7 @@ public class DateTimeTest {
   public void testUTCRange() {
     Interval d = (Interval) DateTimeFactory2.valueOf("9999-01-01T23:59:59UTC");
     assertTrue(d instanceof UTCDateTime);
-    assertEquals("253370851225UTC", d.getILB_NF1());
+    assertEquals("253370851226UTC", d.getILB_NF1());
     Interval d2 = UTCDateTime.UTCSeconds(253370851225L, null);
     assertTrue(d instanceof UTCDateTime);
     assertEquals("253370851225UTC", d2.getILB_NF1());
@@ -418,7 +418,7 @@ public class DateTimeTest {
 
     d = (Interval) DateTimeFactory2.valueOf("9999-01-01T23:59:59.999999999UTC");
     assertTrue(d instanceof UTCDateTime);
-    assertEquals("253370851225UTC999999999", d.getILB_NF1());
+    assertEquals("253370851226UTC999999999", d.getILB_NF1());
     d2 = UTCDateTime.UTCSeconds(253370851225L, 999999999);
     assertTrue(d instanceof UTCDateTime);
     assertEquals("253370851225UTC999999999", d2.getILB_NF1());