diff --git a/docker/README.md b/docker/README.md
index da8299413287a703b38d12c233e8abb0c32babfa..361c5ae5687777bf385c3f7a0b5a70bd8820770c 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -74,4 +74,5 @@ To use this image, you need a running instance of PostgreSQL and to configure th
 * DATA_CENTER_LOCATION: Location of the datacenter, used when reporting errors to Bugsnag
 
 
-# TODO Refactor variables
\ No newline at end of file
+# TODO Refactor variables
+# TODO Refactor variables on mip-deployent as well
\ No newline at end of file
diff --git a/src/main/java/eu/hbp/mip/configurations/SecurityConfiguration.java b/src/main/java/eu/hbp/mip/configurations/SecurityConfiguration.java
index dfc5d4e475634dfc3bf8754bb3ea6584953313c7..21a494b88faaed146d14de2dc4526d71db11c640 100644
--- a/src/main/java/eu/hbp/mip/configurations/SecurityConfiguration.java
+++ b/src/main/java/eu/hbp/mip/configurations/SecurityConfiguration.java
@@ -25,7 +25,7 @@ import javax.servlet.http.HttpServletRequest;
 @KeycloakConfiguration
 public class SecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter {
 
-    // Redirect to login page url
+    // Upon logout, redirect to login page url
     private static final String logoutRedirectURL = "/sso/login";
 
     @Value("#{'${authentication.enabled}'}")
@@ -36,6 +36,11 @@ public class SecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter
         super.configure(http);
 
         if (authenticationEnabled) {
+
+            // Used for development with authentication turned on.
+            // Should not be enabled on production.
+            http.csrf().disable();
+
             http.authorizeRequests()
                     .antMatchers(
                             "/sso/login",
diff --git a/src/main/java/eu/hbp/mip/services/ActiveUserService.java b/src/main/java/eu/hbp/mip/services/ActiveUserService.java
index 5004e1f7f92dfc96e7f4decbf007c7dc442ae370..61bad973c94cc04da2adccf5952949378030ce92 100644
--- a/src/main/java/eu/hbp/mip/services/ActiveUserService.java
+++ b/src/main/java/eu/hbp/mip/services/ActiveUserService.java
@@ -46,19 +46,15 @@ public class ActiveUserService {
             return user;
         }
 
-
-        // TODO Update user if new values are providedTO
         // If authentication is ON get user info from Token
         KeycloakPrincipal keycloakPrincipal =
                 (KeycloakPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
         IDToken idToken = keycloakPrincipal.getKeycloakSecurityContext().getIdToken();
-        UserDAO userInDatabase = userRepository.findByUsername(idToken.getPreferredUsername());
-        if (userInDatabase != null) {
-            user = userInDatabase;
-        } else {
-            UserDAO newUser = new UserDAO(idToken.getPreferredUsername(), idToken.getName(), idToken.getEmail());
-            userRepository.save(newUser);
-            user = newUser;
+        user = new UserDAO(idToken.getPreferredUsername(), idToken.getName(), idToken.getEmail());
+
+        UserDAO userInDatabase = userRepository.findByUsername(user.getUsername());
+        if (userInDatabase == null || !userInDatabase.equals(user)) {
+            userRepository.save(user);
         }
         return user;
     }