diff --git a/pom.xml b/pom.xml
index a8156db..fe8de3a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>de.tilman</groupId>
 	<artifactId>next-transactions</artifactId>
-	<version>1.3.0</version>
+	<version>1.3.2</version>
 
 	<parent>
 		<groupId>org.springframework.boot</groupId>
diff --git a/src/main/java/de/tilman/transactions/SecurityConfiguration.java b/src/main/java/de/tilman/transactions/SecurityConfiguration.java
index a24373c..aa68ef8 100644
--- a/src/main/java/de/tilman/transactions/SecurityConfiguration.java
+++ b/src/main/java/de/tilman/transactions/SecurityConfiguration.java
@@ -11,6 +11,7 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.security.web.header.writers.CacheControlHeadersWriter;
 
 @Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
@@ -19,8 +20,9 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 
 	@Override
 	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-		auth.inMemoryAuthentication().withUser("adam").password("test").roles("USER", "ADMIN").and().withUser("betty")
-				.password("test").roles("USER");
+		auth.inMemoryAuthentication()
+		.withUser("adam").password("test").roles("USER", "ADMIN").and()
+		.withUser("betty").password("test").roles("USER");
 	}
 
 	@Override
@@ -41,17 +43,19 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 		http.headers().addHeaderWriter(new HeaderWriter() {
 			
 			// for dev
-//			CacheControlHeadersWriter originalWriter = new CacheControlHeadersWriter();
+			CacheControlHeadersWriter originalWriter = new CacheControlHeadersWriter();
 
 			@Override
 			public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
 				String requestUri = request.getRequestURI();
 				if (requestUri.startsWith("/public")) {
 					response.setHeader("Cache-Control", "public, max-age=10000000");
-				}
-				else {
-					response.setHeader("Cache-Control", "public, max-age=600000");
+//				} else if (requestUri.startsWith("/api")) {
+//					// TODO handle API resources under common path (see application.properties)
 //					originalWriter.writeHeaders(request, response);
+				} else {
+//					response.setHeader("Cache-Control", "public, max-age=600000");
+					originalWriter.writeHeaders(request, response);
 				}
 			}
 		});
diff --git a/src/main/java/de/tilman/transactions/repository/TransactionRepository.java b/src/main/java/de/tilman/transactions/repository/TransactionRepository.java
index d41df02..c94bd9c 100644
--- a/src/main/java/de/tilman/transactions/repository/TransactionRepository.java
+++ b/src/main/java/de/tilman/transactions/repository/TransactionRepository.java
@@ -44,7 +44,8 @@ public interface TransactionRepository extends PagingAndSortingRepository<Transa
 	// http://localhost:8080/transactions/search/outstandings?accountId=1&userId=1
 	@RestResource(path = "outstandings")
 //	@Query("SELECT t FROM Transaction t WHERE t.account.id = :accountId AND (t.creditor.id = :userId OR (t.category.id = (SELECT id FROM Category WHERE account_ID = :accountId AND position = (SELECT Max(position) FROM Category WHERE account_ID = :accountId)) AND t.creditor.id = :userId)) ORDER BY t.date DESC")
-	@Query("SELECT t FROM Transaction t WHERE t.account.id = :accountId AND (t.creditor.id = :userId OR (t.category.name = 'Private Entnahme' AND t.creditor.id = :userId)) ORDER BY t.date DESC")
+//	@Query("SELECT t FROM Transaction t WHERE t.account.id = :accountId AND (t.creditor.id = :userId OR (t.category.name = 'Private Entnahme' AND t.creditor.id = :userId)) ORDER BY t.date DESC")
+	@Query("SELECT t FROM Transaction t WHERE t.account.id = :accountId AND t.creditor.id = :userId ORDER BY t.date DESC")
 	Page<Transaction> getOutstandingsForUserByAccount(@Param("accountId") Long accountId, @Param("userId") Long userId, Pageable pageable);
 	
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 53d36d6..213b9c2 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -4,6 +4,8 @@ server.port=8084
 server.session.cookie.max-age=1200000
 server.session.timeout=1200000
 
+#spring.data.rest.base-path=api
+
 ## PRODUCTION SETTINGS
 #
 ## Prevent database schema reset
diff --git a/src/main/resources/static/js/controllers.js b/src/main/resources/static/js/controllers.js
index 024fe77..4b244e9 100644
--- a/src/main/resources/static/js/controllers.js
+++ b/src/main/resources/static/js/controllers.js
@@ -400,9 +400,6 @@ transactionControllers.controller('ImportCtrl', [ '$scope', '$resource', '$locat
 				});
 			});
 		});
-		
-		// XXX
-		$scope.csvInput = "\"30.07.2016\";\"30.07.2016\";\"Übertrag/Überweisung\";\"Empfänger: Tilman Liero Kto/IBAN: DE44200411330649163305 BLZ/BIC: COBADEHD001 Buchungstext: none End-to-End-Ref.: nicht angegeben Ref. JK21619010302362/2\";\"-40,00\";\n\"29.07.2016\";\"29.07.2016\";\"Lastschrift/Belast.\";\"Auftraggeber: DANKE, IHR LIDL Kto/IBAN: DE61300500000008000119 Buchungstext: Kartenzahlung DANKE, IHR LIDL//Berlin/DE 2016-06-25T09:47:08 KFN 2 VJ 1912 Ref. 6GL16179A2640086/6763\";\"-70,17\";\n\"28.07.2016\";\"28.07.2016\";\"Übertrag/Überweisung\";\"Auftraggeber: Tilman Liero Buchungstext: Uebertrag comdirect bank End-to-End-Ref.: nicht angegeben Ref. IX216176F0205292/1\";\"200,00\";\n\"28.07.2016\";\"28.07.2016\";\"Übertrag/Überweisung\";\"Auftraggeber: Wohnungsbau-Verein Neukölln eG Buchungstext: Mg.-Nr. 35823, Walther, Tilman - 4, Dividende 2015 End-to-End-Ref.: nicht angegeben Ref. H221617674648332/35629\";\"4,42\";";
 	}
 	
 	$scope.initPage();