diff --git a/frontend-js/src/main/js/ServerConnector.js b/frontend-js/src/main/js/ServerConnector.js
index 42b9de84cfa888331ac8d264070da35058e18ef8..e987b7bf184d891d072aaa3641595b5b6adcc5e6 100644
--- a/frontend-js/src/main/js/ServerConnector.js
+++ b/frontend-js/src/main/js/ServerConnector.js
@@ -545,9 +545,7 @@ ServerConnector.getConfiguration = function(params) {
   }
   var self = this;
   if (this._configuration === undefined) {
-    return self.getToken(params.token).then(function(token) {
-      return self.readFile(self.getConfigurationUrl());
-    }).then(function(content) {
+    return self.readFile(self.getConfigurationUrl()).then(function(content) {
       self._configuration = new Configuration(JSON.parse(content));
       return Promise.resolve(self._configuration);
     });
@@ -933,9 +931,6 @@ ServerConnector.getOverlaySourceDownloadUrl = function(params) {
   var filterParams = {};
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.getOverlaySourceUrl(queryParams, filterParams);
   });
 };
@@ -957,9 +952,6 @@ ServerConnector.getImageDownloadUrl = function(params) {
 
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.getImageUrl(queryParams, filterParams);
   });
 };
@@ -980,9 +972,6 @@ ServerConnector.getModelDownloadUrl = function(params) {
   };
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.getModelPartUrl(queryParams, filterParams);
   });
 };
@@ -1009,9 +998,6 @@ ServerConnector.getProjectSourceDownloadUrl = function(params) {
   var self = this;
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.getProjectSourceUrl(queryParams, filterParams);
   });
 };
@@ -1095,9 +1081,6 @@ ServerConnector.addComment = function(params) {
   delete filterParams.modelId;
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.sendPostRequest(self.addCommentUrl(queryParams), filterParams);
   }).then(function(content) {
     var response = JSON.parse(content);
@@ -1110,9 +1093,6 @@ ServerConnector.addOverlay = function(params) {
   var queryParams = {};
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    params.token = token;
     return self.sendPostRequest(self.addOverlayUrl(queryParams), params);
   }).then(function(content) {
     var response = JSON.parse(content);
@@ -1140,9 +1120,6 @@ ServerConnector.updateOverlay = function(params) {
   }
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.sendPatchRequest(self.updateOverlayUrl(queryParams), filterParams);
   });
 };
@@ -1155,9 +1132,6 @@ ServerConnector.removeOverlay = function(params) {
   var filterParams = {};
   return self.getProjectId(params.projectId).then(function(result) {
     queryParams.projectId = result;
-    return self.getToken();
-  }).then(function(token) {
-    filterParams.token = token;
     return self.sendDeleteRequest(self.deleteOverlayUrl(queryParams), filterParams);
   });
 };
diff --git a/frontend-js/src/test/js/ServerConnector-mock.js b/frontend-js/src/test/js/ServerConnector-mock.js
index b045a42a6b1cfb3d00c647db62e919e159ee16c5..03cbb59db4fe6ddde598cfaaafb4d86ec0fc248c 100644
--- a/frontend-js/src/test/js/ServerConnector-mock.js
+++ b/frontend-js/src/test/js/ServerConnector-mock.js
@@ -30,7 +30,7 @@ function urlToFileName(url) {
   var result = url;
   var token = OriginalServerConnector.getSessionData().getToken();
   if (token!==undefined && url.startsWith("./testFiles/apiCalls")) {
-    if (!result.endsWith("&")) {
+    if (!result.endsWith("&") &&!result.endsWith("_") ) {
       result +="/";
     }
     result+="token=" +token+"&";
@@ -92,7 +92,7 @@ ServerConnectorMock.sendPostRequest = function(url, params) {
         }
       });
     } else {
-      var mockUrl = replaceAsterisk(url + "/POST_" + self.createGetParams(encodeParams(params)));
+      var mockUrl = urlToFileName(url + "/POST_" + self.createGetParams(encodeParams(params)));
       fs.readFile(mockUrl, 'utf8', function(err, content) {
         if (err) {
           reject(err);
@@ -122,7 +122,7 @@ ServerConnectorMock.sendPutRequest = function(url, params) {
         }
       });
     } else {
-      var mockUrl = url + "/PUT_" + self.createGetParams(encodeParams(params));
+      var mockUrl = urlToFileName(url + "/PUT_" + self.createGetParams(encodeParams(params)));
       fs.readFile(mockUrl, 'utf8', function(err, content) {
         if (err) {
           reject(err);
@@ -152,7 +152,7 @@ ServerConnectorMock.sendDeleteRequest = function(url, params) {
         }
       });
     } else {
-      var mockUrl = url + "/DELETE_" + self.createGetParams(encodeParams(params));
+      var mockUrl = urlToFileName(url + "/DELETE_" + self.createGetParams(encodeParams(params)));
       fs.readFile(mockUrl, 'utf8', function(err, content) {
         if (err) {
           reject(err);
@@ -182,7 +182,7 @@ ServerConnectorMock.sendPatchRequest = function(url, params) {
         }
       });
     } else {
-      var mockUrl = url + "/PATCH_" + self.createGetParams(params);
+      var mockUrl = urlToFileName(url + "/PATCH_" + self.createGetParams(params));
       fs.readFile(mockUrl, 'utf8', function(err, content) {
         if (err) {
           reject(err);
diff --git a/frontend-js/src/test/js/ServerConnector-test.js b/frontend-js/src/test/js/ServerConnector-test.js
index 0ee2386c66781748a41bba1661fb1ee360d9f533..8972e450c8a93799f84a46167a881c18e56bb894 100644
--- a/frontend-js/src/test/js/ServerConnector-test.js
+++ b/frontend-js/src/test/js/ServerConnector-test.js
@@ -83,15 +83,50 @@ describe('ServerConnector', function() {
   });
 
   it('getOverlaySourceDownloadUrl', function() {
-    var id = 123;
+    var id = 17296;
     return ServerConnector.getOverlaySourceDownloadUrl({
       overlayId : id
     }).then(function(url) {
       assert.ok(url);
       assert.ok(url.indexOf(id) >= 0);
+      return ServerConnector.readFile(url);
     });
   });
 
+  it('getImageDownloadUrl', function() {
+    var modelId = 15781;
+    return ServerConnector.getImageDownloadUrl({
+      modelId : modelId,
+      handlerClass : "lcsb.mapviewer.converter.graphics.PngImageGenerator",
+    }).then(function(url) {
+      assert.ok(url);
+      assert.ok(url.indexOf(modelId) >= 0);
+      return ServerConnector.readFile(url);
+    });
+  });
+  
+  it('getModelDownloadUrl', function() {
+    var modelId = 15781;
+    return ServerConnector.getModelDownloadUrl({
+      modelId : modelId,
+      handlerClass : "lcsb.mapviewer.converter.model.celldesigner.CellDesignerXmlParser",
+    }).then(function(url) {
+      assert.ok(url);
+      assert.ok(url.indexOf(modelId) >= 0);
+      return ServerConnector.readFile(url);
+    });
+  });
+  
+  it('getProjectSourceDownloadUrl', function() {
+    return ServerConnector.getProjectSourceDownloadUrl().then(function(url) {
+      assert.ok(url);
+      return ServerConnector.readFile(url);
+    });
+  });
+  
+  
+  
+
   it('addOverlay', function() {
     return ServerConnector.addOverlay({
       name : "test nam",
@@ -130,13 +165,12 @@ describe('ServerConnector', function() {
       assert.ok(url);
     });
   });
-  
+
   it('getOverlayById', function() {
     return ServerConnector.getOverlayById(18083, "complex_model_with_submaps").then(function(overlay) {
       assert.ok(overlay);
     });
   });
-  
 
   it('getConfiguration', function() {
     return ServerConnector.getConfiguration().then(function(configuration) {
@@ -144,5 +178,4 @@ describe('ServerConnector', function() {
     });
   });
 
-
 });
diff --git a/frontend-js/testFiles/apiCalls/doLogin/POST_ b/frontend-js/testFiles/apiCalls/doLogin/POST_token=MOCK_TOKEN_ID&
similarity index 100%
rename from frontend-js/testFiles/apiCalls/doLogin/POST_
rename to frontend-js/testFiles/apiCalls/doLogin/POST_token=MOCK_TOKEN_ID&
diff --git a/frontend-js/testFiles/apiCalls/projects/sample.downloadSource/token=MOCK_TOKEN_ID& b/frontend-js/testFiles/apiCalls/projects/sample.downloadSource/token=MOCK_TOKEN_ID&
new file mode 100644
index 0000000000000000000000000000000000000000..6489f980dd3a0e267379cc39ab9b1b2e9fe72f85
--- /dev/null
+++ b/frontend-js/testFiles/apiCalls/projects/sample.downloadSource/token=MOCK_TOKEN_ID&
@@ -0,0 +1 @@
+{"info":"dummy resposne"}
\ No newline at end of file
diff --git a/frontend-js/testFiles/apiCalls/projects/sample/models/15781.downloadImage/handlerClass=lcsb.mapviewer.converter.graphics.PngImageGenerator&token=MOCK_TOKEN_ID& b/frontend-js/testFiles/apiCalls/projects/sample/models/15781.downloadImage/handlerClass=lcsb.mapviewer.converter.graphics.PngImageGenerator&token=MOCK_TOKEN_ID&
new file mode 100644
index 0000000000000000000000000000000000000000..6489f980dd3a0e267379cc39ab9b1b2e9fe72f85
--- /dev/null
+++ b/frontend-js/testFiles/apiCalls/projects/sample/models/15781.downloadImage/handlerClass=lcsb.mapviewer.converter.graphics.PngImageGenerator&token=MOCK_TOKEN_ID&
@@ -0,0 +1 @@
+{"info":"dummy resposne"}
\ No newline at end of file
diff --git a/frontend-js/testFiles/apiCalls/projects/sample/models/15781.downloadModel/handlerClass=lcsb.mapviewer.converter.model.celldesigner.CellDesignerXmlParser&token=MOCK_TOKEN_ID& b/frontend-js/testFiles/apiCalls/projects/sample/models/15781.downloadModel/handlerClass=lcsb.mapviewer.converter.model.celldesigner.CellDesignerXmlParser&token=MOCK_TOKEN_ID&
new file mode 100644
index 0000000000000000000000000000000000000000..6489f980dd3a0e267379cc39ab9b1b2e9fe72f85
--- /dev/null
+++ b/frontend-js/testFiles/apiCalls/projects/sample/models/15781.downloadModel/handlerClass=lcsb.mapviewer.converter.model.celldesigner.CellDesignerXmlParser&token=MOCK_TOKEN_ID&
@@ -0,0 +1 @@
+{"info":"dummy resposne"}
\ No newline at end of file
diff --git a/frontend-js/testFiles/apiCalls/projects/sample/overlays/17296.downloadSource/token=MOCK_TOKEN_ID& b/frontend-js/testFiles/apiCalls/projects/sample/overlays/17296.downloadSource/token=MOCK_TOKEN_ID&
new file mode 100644
index 0000000000000000000000000000000000000000..6489f980dd3a0e267379cc39ab9b1b2e9fe72f85
--- /dev/null
+++ b/frontend-js/testFiles/apiCalls/projects/sample/overlays/17296.downloadSource/token=MOCK_TOKEN_ID&
@@ -0,0 +1 @@
+{"info":"dummy resposne"}
\ No newline at end of file
diff --git a/rest-api/src/main/java/lcsb/mapviewer/api/users/UserController.java b/rest-api/src/main/java/lcsb/mapviewer/api/users/UserController.java
index 8e28369560228166e47eb6484acf85c032c43764..e2b76912f442b2ce78961090c8699046dfcaa440 100644
--- a/rest-api/src/main/java/lcsb/mapviewer/api/users/UserController.java
+++ b/rest-api/src/main/java/lcsb/mapviewer/api/users/UserController.java
@@ -11,6 +11,7 @@ import javax.servlet.http.HttpServletResponse;
 import org.apache.log4j.Logger;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.CookieValue;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
@@ -67,7 +68,7 @@ public class UserController extends BaseController {
 
 	@RequestMapping(value = "/users/{login}", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
 	public Map<String, Object> getUser(//
-			@RequestParam(value = "token", required = false) String token, //
+			@CookieValue(value = Configuration.AUTH_TOKEN) String token, //
 			@PathVariable(value = "login") String login, //
 			@RequestParam(value = "columns", defaultValue = "") String columns//
 	) throws SecurityException, ObjectNotFoundException {
@@ -75,7 +76,7 @@ public class UserController extends BaseController {
 	}
 
 	@RequestMapping(value = "/doLogout", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
-	public Map<String, String> logout(@RequestParam(value = "token", required = false) String token) throws SecurityException {
+	public Map<String, String> logout(@CookieValue(value = Configuration.AUTH_TOKEN) String token) throws SecurityException {
 		userService.logout(token);
 		Map<String, String> response = new HashMap<>();
 		response.put("status", "OK");