Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/Helpers.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/Helpers.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/Helpers.java	(revision 4207)
@@ -71,5 +71,4 @@
         Document document = element.getOwnerDocument();
         DOMImplementationLS domImplLS = (DOMImplementationLS) document.getImplementation();
-        String encoding=document.getInputEncoding();
         LSSerializer serializer = domImplLS.createLSSerializer();
         String result = serializer.writeToString(element);
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/AnnotationDao.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/AnnotationDao.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/AnnotationDao.java	(revision 4207)
@@ -114,5 +114,5 @@
     public Permission  getPermission(Number annotationID, Number userID);
     
-    public List<Number> getAnnotationIDsForUserWithPermission(Number userID, String permissionString);
+    public List<Number> getAnnotationIDsForUserWithPermission(Number userID, String[] permissionStrings);
     
     
@@ -164,13 +164,6 @@
     /////// UPDATERS //////////////////
     
-    int updateAnnotationBodyText(Number annotationID, String text);
-    
-    /**
-     * 
-     * @param annotationID
-     * @param annotationBody
-     * @return # of updated rows in "annotation" table after updating the annotation's body text with "newBodyText". Should return 1.
-     */
-    public int updateAnnotationBody(Number annotationID, AnnotationBody annotationBody);
+   
+    public int updateAnnotationBody(Number annotationID, String text, String mimeType, Boolean isXml);
     
    
@@ -229,4 +222,10 @@
     */
     public int deleteAnnotationPrincipalPermissions(Number annotationID);
+    
+    /*
+     * HELPERS 
+     */
+    
+    public String[] retrieveBodyComponents(AnnotationBody annotationBody);
 
 }
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/DBIntegrityService.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/DBIntegrityService.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/DBIntegrityService.java	(revision 4207)
@@ -88,5 +88,5 @@
     * -- created after time-samp "after and before time-stamp "before".
     */
-    List<Number> getFilteredAnnotationIDs(String link, String text, Number inloggedUserID, String access, String namespace, UUID
+    List<Number> getFilteredAnnotationIDs(String link, String text, Number inloggedUserID, String[] accessModes, String namespace, UUID
             owner, Timestamp after, Timestamp before);
     
@@ -110,5 +110,5 @@
     * -- created after time-samp "after and before time-stamp "before".
      */
-    AnnotationInfoList getFilteredAnnotationInfos(String word, String text, Number inloggedUserID, String access, String namespace, UUID
+    AnnotationInfoList getFilteredAnnotationInfos(String word, String text, Number inloggedUserID, String[] accessModes, String namespace, UUID
             ownerID, Timestamp after, Timestamp before);
 
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/DBIntegrityServiceImlp.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/DBIntegrityServiceImlp.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/DBIntegrityServiceImlp.java	(revision 4207)
@@ -40,6 +40,8 @@
 import eu.dasish.annotation.schema.User;
 import eu.dasish.annotation.schema.UserWithPermission;
+import java.io.IOException;
 import java.io.InputStream;
 import java.lang.Number;
+import java.sql.SQLException;
 import java.sql.Timestamp;
 import java.util.ArrayList;
@@ -48,7 +50,9 @@
 import java.util.Map;
 import java.util.UUID;
+import javax.xml.parsers.ParserConfigurationException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -94,5 +98,5 @@
     }
 
-    ///////////// GETTERS //////////////////////////
+    
     @Override
     public Number getTargetInternalIdentifier(UUID externalID) {
@@ -189,11 +193,11 @@
     ////////////////////////////////////////////////////////////////////////
     @Override
-    public List<Number> getFilteredAnnotationIDs(String link, String text, Number inloggedUserID, String access, String namespace, UUID owner, Timestamp after, Timestamp before) {
-
-        if (access == null) {
-            return null;
-        }
-
-        List<Number> annotationIDs = annotationDao.getAnnotationIDsForUserWithPermission(inloggedUserID, access);
+    public List<Number> getFilteredAnnotationIDs(String link, String text, Number inloggedUserID, String[] accessModes, String namespace, UUID owner, Timestamp after, Timestamp before) {
+
+        if (accessModes == null) {
+            return null;
+        }
+
+        List<Number> annotationIDs = annotationDao.getAnnotationIDsForUserWithPermission(inloggedUserID, accessModes);
 
         if (link != null) {
@@ -258,6 +262,6 @@
 
     @Override
-    public AnnotationInfoList getFilteredAnnotationInfos(String word, String text, Number inloggedUserID, String access, String namespace, UUID owner, Timestamp after, Timestamp before) {
-        List<Number> annotationIDs = getFilteredAnnotationIDs(word, text, inloggedUserID, access, namespace, owner, after, before);
+    public AnnotationInfoList getFilteredAnnotationInfos(String word, String text, Number inloggedUserID, String[] accessModes, String namespace, UUID owner, Timestamp after, Timestamp before) {
+        List<Number> annotationIDs = getFilteredAnnotationIDs(word, text, inloggedUserID, accessModes, namespace, owner, after, before);
         if (annotationIDs != null) {
             AnnotationInfoList result = new AnnotationInfoList();
@@ -388,5 +392,6 @@
     @Override
     public int updateAnnotationBody(Number internalID, AnnotationBody annotationBody) {
-        return annotationDao.updateAnnotationBody(internalID, annotationBody);
+        String[] body = annotationDao.retrieveBodyComponents(annotationBody);
+        return annotationDao.updateAnnotationBody(internalID, body[0], body[1], annotationBody.getXmlBody()!=null);
     }
     
@@ -518,10 +523,12 @@
         String bodyText;
         String newBodyText;
+        String mimeType;
         if (annotationBody.getXmlBody() != null) {
             bodyText = Helpers.elementToString(annotation.getBody().getXmlBody().getAny());
+            mimeType = annotationBody.getXmlBody().getMimeType();
         } else {
             if (annotation.getBody().getTextBody() != null) {
                 bodyText = annotation.getBody().getTextBody().getValue();
-
+                mimeType = annotationBody.getTextBody().getMimeType();
             } else {
                 logger.error("The client has sent ill-formed annotation body.");
@@ -530,5 +537,5 @@
         }
         newBodyText = Helpers.replace(bodyText, targetIdPairs);
-        return annotationDao.updateAnnotationBodyText(annotationID, newBodyText);
+        return annotationDao.updateAnnotationBody(annotationID, newBodyText, mimeType, annotationBody.getXmlBody() != null);
     }
 
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/JdbcAnnotationDao.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/JdbcAnnotationDao.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/JdbcAnnotationDao.java	(revision 4207)
@@ -26,4 +26,5 @@
 import eu.dasish.annotation.schema.AnnotationInfo;
 import eu.dasish.annotation.schema.Permission;
+import java.io.IOException;
 import java.lang.String;
 import java.sql.ResultSet;
@@ -37,5 +38,7 @@
 import javax.sql.DataSource;
 import javax.xml.datatype.DatatypeConfigurationException;
+import javax.xml.parsers.ParserConfigurationException;
 import org.springframework.jdbc.core.RowMapper;
+import org.xml.sax.SAXException;
 
 /**
@@ -115,13 +118,33 @@
 
     @Override
-    public List<Number> getAnnotationIDsForUserWithPermission(Number userID, String permissionString) {
-        if (userID == null || permissionString == null) {
-            return null;
-        }
+    public List<Number> getAnnotationIDsForUserWithPermission(Number userID, String[] permissionStrings) {
+        if (userID == null || permissionStrings == null) {
+            return null;
+        }
+
+        String values = stringsToValuesString(permissionStrings);
+
         StringBuilder sql = new StringBuilder("SELECT ");
         sql.append(annotation_id).append(" FROM ").append(permissionsTableName).append(" WHERE ").
                 append(principal_id).append("  = ").append(userID.toString()).append(" AND ").
-                append(permission).append("  = ?");;
-        return getSimpleJdbcTemplate().query(sql.toString(), internalIDRowMapper, permissionString);
+                append(permission).append("  IN ").append(values);
+        return getSimpleJdbcTemplate().query(sql.toString(), internalIDRowMapper);
+    }
+
+    private String stringsToValuesString(String[] strings) {
+        if (strings == null) {
+            return null;
+        }
+
+        int length = strings.length;
+        if (length == 0) {
+            return null;
+        }
+        String result = "(";
+        for (int i = 0; i < length - 1; i++) {
+            result = result + "'"+strings[i] + "', ";
+        }
+        result = result + "'"+strings[length - 1] + "')";
+        return result;
     }
 
@@ -312,23 +335,13 @@
 
     //////////// UPDATERS /////////////
-    @Override
-    public int updateAnnotationBodyText(Number annotationID, String text) {
-        StringBuilder sql = new StringBuilder("UPDATE ");
-        sql.append(annotationTableName).append(" SET ").
-                append(last_modified).append("=  default,").
-                append(body_text).append("= '").append(text).
-                append("' WHERE ").append(annotation_id).append("= ?");
-        int affectedRows = getSimpleJdbcTemplate().update(sql.toString(), annotationID);
-        return affectedRows;
-    }
-
-    @Override
-    public int updateAnnotationBody(Number annotationID, AnnotationBody annotationBody) {
-        String[] body = retrieveBodyComponents(annotationBody);
+   
+
+    @Override
+    public int updateAnnotationBody(Number annotationID, String text, String mimeType, Boolean isXml) {
         Map<String, Object> params = new HashMap<String, Object>();
-        params.put("annotationID", annotation_id);
-        params.put("bodyText", body[0]);
-        params.put("bodyMimeType", body[1]);
-        params.put("isXml", annotationBody.getXmlBody() != null);
+        params.put("annotationID", annotationID);
+        params.put("bodyText", text);
+        params.put("bodyMimeType", mimeType);
+        params.put("isXml", isXml);
 
         StringBuilder sql = new StringBuilder("UPDATE ");
@@ -338,6 +351,6 @@
                 append(body_mimetype).append("= :bodyMimeType, ").
                 append(is_xml).append("= :isXml").
-                append("' WHERE ").append(annotation_id).append("= :annotationID");
-        int affectedRows = getSimpleJdbcTemplate().update(sql.toString(), annotationID);
+                append(" WHERE ").append(annotation_id).append("= :annotationID");
+        int affectedRows = getSimpleJdbcTemplate().update(sql.toString(), params);
         return affectedRows;
     }
@@ -374,11 +387,11 @@
         Map<String, Object> params = new HashMap<String, Object>();
         params.put("permission", permission.value());
-        params.put("annotationID", annotation_id);
-        params.put("principalID", principal_id);
+        params.put("annotationID", annotationID);
+        params.put("principalID", userID);
 
         StringBuilder sql = new StringBuilder("UPDATE ");
         sql.append(permissionsTableName).append(" SET ").
                 append(this.permission).append("= :permission").
-                append(" WHERE ").append(annotation_id).append("= : annotationID").
+                append(" WHERE ").append(annotation_id).append("= :annotationID").
                 append(" AND ").append(principal_id).append("= :principalID");
         return getSimpleJdbcTemplate().update(sql.toString(), params);
@@ -474,5 +487,5 @@
 
     /////////////// helpers //////////////////
-    private String[] retrieveBodyComponents(AnnotationBody annotationBody) {
+    public String[] retrieveBodyComponents(AnnotationBody annotationBody) {
         boolean body_is_xml = annotationBody.getXmlBody() != null;
         String[] result = new String[2];
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/AnnotationResource.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/AnnotationResource.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/AnnotationResource.java	(revision 4207)
@@ -34,5 +34,4 @@
 import java.io.IOException;
 import java.net.URI;
-import java.security.Principal;
 import java.sql.Timestamp;
 import java.util.ArrayList;
@@ -52,5 +51,4 @@
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.SecurityContext;
 import javax.ws.rs.core.UriInfo;
 import javax.ws.rs.ext.Providers;
@@ -61,4 +59,5 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -68,4 +67,5 @@
 @Component
 @Path("/annotations")
+@Transactional(rollbackFor = {Exception.class})
 public class AnnotationResource {
 
@@ -110,5 +110,6 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}")
     @Secured("ROLE_USER")
-    public JAXBElement<Annotation> getAnnotation(@PathParam("annotationid") String ExternalIdentifier) {
+    @Transactional(readOnly = true)
+    public JAXBElement<Annotation> getAnnotation(@PathParam("annotationid") String ExternalIdentifier) throws IOException {
         URI baseURI = uriInfo.getBaseUri();
         String baseURIstr = baseURI.toString();
@@ -123,10 +124,5 @@
             return rootElement;
         } else {
-            try {
-                logger.error("FORBIDDEN-access attempt");
-                httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
             return null;
         }
@@ -139,5 +135,6 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}/targets")
     @Secured("ROLE_USER")
-    public JAXBElement<ReferenceList> getAnnotationTargets(@PathParam("annotationid") String ExternalIdentifier) {
+    @Transactional(readOnly = true)
+    public JAXBElement<ReferenceList> getAnnotationTargets(@PathParam("annotationid") String ExternalIdentifier) throws IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
         final Number annotationID = dbIntegrityService.getAnnotationInternalIdentifier(UUID.fromString(ExternalIdentifier));
@@ -148,10 +145,5 @@
             return new ObjectFactory().createTargetList(TargetList);
         } else {
-            try {
-                logger.error("FORBIDDEN-access attempt");
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
             return null;
         }
@@ -163,4 +155,5 @@
     @Path("")
     @Secured("ROLE_USER")
+    @Transactional(readOnly = true)
     public JAXBElement<AnnotationInfoList> getFilteredAnnotations(@QueryParam("link") String link,
             @QueryParam("text") String text,
@@ -175,5 +168,5 @@
         UUID ownerExternalUUID = (ownerExternalId != null) ? UUID.fromString(ownerExternalId) : null;
         String access = (permission != null) ? permission : default_permission;
-        final AnnotationInfoList annotationInfoList = dbIntegrityService.getFilteredAnnotationInfos(link, text, userID, access, namespace, ownerExternalUUID, after, before);
+        final AnnotationInfoList annotationInfoList = dbIntegrityService.getFilteredAnnotationInfos(link, text, userID, makeAccessModeChain(access), namespace, ownerExternalUUID, after, before);
         logger.info("getFilteredAnnotations method: OK");
         return new ObjectFactory().createAnnotationInfoList(annotationInfoList);
@@ -185,5 +178,6 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}/permissions")
     @Secured("ROLE_USER")
-    public JAXBElement<UserWithPermissionList> getAnnotationPermissions(@PathParam("annotationid") String ExternalIdentifier) {
+    @Transactional(readOnly = true)
+    public JAXBElement<UserWithPermissionList> getAnnotationPermissions(@PathParam("annotationid") String ExternalIdentifier) throws IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
         final Number annotationID = dbIntegrityService.getAnnotationInternalIdentifier(UUID.fromString(ExternalIdentifier));
@@ -194,10 +188,5 @@
             return new ObjectFactory().createPermissionList(permissionList);
         } else {
-            try {
-                logger.error("FORBIDDEN-access attempt");
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
             return null;
         }
@@ -210,5 +199,5 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}")
     @Secured("ROLE_USER")
-    public String deleteAnnotation(@PathParam("annotationid") String externalIdentifier) {
+    public String deleteAnnotation(@PathParam("annotationid") String externalIdentifier) throws IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
         final Number annotationID = dbIntegrityService.getAnnotationInternalIdentifier(UUID.fromString(externalIdentifier));
@@ -220,10 +209,5 @@
             return result + " annotation(s) deleted.";
         } else {
-            logger.error("FORBIDDEN-access attempt. Only the owner can delete an annotation.");
-            try {
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
             return null;
         }
@@ -237,5 +221,5 @@
     @Path("")
     @Secured("ROLE_USER")
-    public JAXBElement<ResponseBody> createAnnotation(Annotation annotation) {
+    public JAXBElement<ResponseBody> createAnnotation(Annotation annotation) throws IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
         final Number userID = dbIntegrityService.getUserInternalIDFromRemoteID(httpServletRequest.getRemoteUser());
@@ -252,5 +236,5 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}")
     @Secured("ROLE_USER")
-    public JAXBElement<ResponseBody> updateAnnotation(@PathParam("annotationid") String externalIdentifier, Annotation annotation) {
+    public JAXBElement<ResponseBody> updateAnnotation(@PathParam("annotationid") String externalIdentifier, Annotation annotation) throws IOException {
         String path = uriInfo.getBaseUri().toString();
         dbIntegrityService.setServiceURI(path);
@@ -269,16 +253,10 @@
 
         } else {
-            logger.error("FORBIDDEN-access attempt.");
-            logger.error("The logged-in user is not authorised to alter this annotation. ");
-            try {
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
-            return null;
-        }
-
-    }
-    
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+            return null;
+        }
+
+    }
+
     @PUT
     @Consumes(MediaType.APPLICATION_XML)
@@ -286,8 +264,8 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}/body")
     @Secured("ROLE_USER")
-    public JAXBElement<ResponseBody> updateAnnotationBody(@PathParam("annotationid") String externalIdentifier, AnnotationBody annotationBody) {
+    public JAXBElement<ResponseBody> updateAnnotationBody(@PathParam("annotationid") String externalIdentifier, AnnotationBody annotationBody) throws IOException {
         String path = uriInfo.getBaseUri().toString();
         dbIntegrityService.setServiceURI(path);
-        
+
         final Number annotationID = dbIntegrityService.getAnnotationInternalIdentifier(UUID.fromString(externalIdentifier));
         final Number userID = dbIntegrityService.getUserInternalIDFromRemoteID(httpServletRequest.getRemoteUser());
@@ -296,13 +274,6 @@
             logger.info("updateAnnotationBody method: OK");
             return new ObjectFactory().createResponseBody(makeAnnotationResponseEnvelope(annotationID));
-
-        } else {
-            logger.error("FORBIDDEN-access attempt.");
-            logger.error("The logged-in user is not authorised to alter this annotation. ");
-            try {
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+        } else {
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
             return null;
         }
@@ -315,5 +286,5 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}/permissions/{userid: " + BackendConstants.regExpIdentifier + "}")
     @Secured("ROLE_USER")
-    public String updatePermission(@PathParam("annotationid") String annotationExternalId, @PathParam("userid") String userExternalId, Permission permission) {
+    public String updatePermission(@PathParam("annotationid") String annotationExternalId, @PathParam("userid") String userExternalId, Permission permission) throws IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
         final Number annotationID = dbIntegrityService.getAnnotationInternalIdentifier(UUID.fromString(annotationExternalId));
@@ -328,11 +299,5 @@
 
         } else {
-            logger.error("FORBIDDEN-access attempt");
-            logger.error("The logged-in user is not authorised to alter this annotation. ");
-            try {
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
             return null;
         }
@@ -344,5 +309,5 @@
     @Path("{annotationid: " + BackendConstants.regExpIdentifier + "}/permissions/")
     @Secured("ROLE_USER")
-    public JAXBElement<ResponseBody> updatePermissions(@PathParam("annotationid") String annotationExternalId, UserWithPermissionList permissions) {
+    public JAXBElement<ResponseBody> updatePermissions(@PathParam("annotationid") String annotationExternalId, UserWithPermissionList permissions) throws IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
         final Number annotationID = dbIntegrityService.getAnnotationInternalIdentifier(UUID.fromString(annotationExternalId));
@@ -353,11 +318,5 @@
             return new ObjectFactory().createResponseBody(makePermissionResponseEnvelope(annotationID));
         } else {
-            logger.error("FORBIDDEN-access attempt");
-            logger.error("The logged-in user is not authorised to alter this annotation. ");
-            try {
-                httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-            } catch (IOException ioe) {
-                logger.error("IOException: Cannot send server respond about unaithorized access.");
-            }
+            httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
             return null;
         }
@@ -390,4 +349,5 @@
     }
 
+    // REFACTOR : move to the integrity service all te methods below  
     private List<Action> makeActionList(List<String> resourceURIs, String message) {
         if (resourceURIs != null) {
@@ -435,3 +395,35 @@
         }
     }
+
+    private String[] makeAccessModeChain(String accessMode) {
+        if (accessMode != null) {
+            if (accessMode == Permission.OWNER.value()) {
+                String[] result = new String[1];
+                result[0] = accessMode;
+                return result;
+            } else {
+                if (accessMode == Permission.WRITER.value()) {
+                    String[] result = new String[2];
+                    result[0] = Permission.WRITER.value();
+                    result[1] = Permission.OWNER.value();
+                    return result;
+                } else {
+                    if (accessMode == Permission.READER.value()) {
+                        String[] result = new String[3];
+                        result[0] = Permission.READER.value();
+                        result[1] = Permission.WRITER.value();
+                        result[2] = Permission.OWNER.value();
+                        return result;
+                    } else {
+                        logger.error("Invalide access " + accessMode);
+                        return null;
+                    }
+
+                }
+            }
+
+        } else {
+            return null;
+        }
+    }
 }
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/CachedRepresentationResource.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/CachedRepresentationResource.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/CachedRepresentationResource.java	(revision 4207)
@@ -37,7 +37,9 @@
 import javax.ws.rs.core.UriInfo;
 import javax.xml.bind.JAXBElement;
+import javax.xml.parsers.ParserConfigurationException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -47,4 +49,5 @@
 @Component
 @Path("/cached")
+@Transactional(rollbackFor={Exception.class, SQLException.class, IOException.class, ParserConfigurationException.class})
 public class CachedRepresentationResource {
 
@@ -65,5 +68,6 @@
     @Produces(MediaType.TEXT_XML)
     @Path("{cachedid: " + BackendConstants.regExpIdentifier + "}/metadata")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public JAXBElement<CachedRepresentationInfo> getCachedRepresentationInfo(@PathParam("cachedid") String externalId) throws SQLException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
@@ -76,5 +80,6 @@
     @Produces({"image/jpeg", "image/png"})
     @Path("{cachedid: " + BackendConstants.regExpIdentifier + "}/content")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public BufferedImage getCachedRepresentationContent(@PathParam("cachedid") String externalId) throws SQLException, IOException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/NotebookResource.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/NotebookResource.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/NotebookResource.java	(revision 4207)
@@ -19,4 +19,6 @@
 
 import eu.dasish.annotation.backend.dao.DBIntegrityService;
+import java.io.IOException;
+import java.sql.SQLException;
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.Path;
@@ -24,6 +26,8 @@
 import javax.ws.rs.core.UriInfo;
 import javax.ws.rs.ext.Providers;
+import javax.xml.parsers.ParserConfigurationException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -34,4 +38,5 @@
 @Component
 @Path("/notebooks")
+@Transactional(rollbackFor={Exception.class, SQLException.class, IOException.class, ParserConfigurationException.class})
 public class NotebookResource {
 
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/TargetResource.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/TargetResource.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/TargetResource.java	(revision 4207)
@@ -26,4 +26,5 @@
 import eu.dasish.annotation.schema.ReferenceList;
 import eu.dasish.annotation.schema.Target;
+import java.io.IOException;
 import java.io.InputStream;
 import java.sql.SQLException;
@@ -41,7 +42,9 @@
 import javax.ws.rs.core.UriInfo;
 import javax.xml.bind.JAXBElement;
+import javax.xml.parsers.ParserConfigurationException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -55,4 +58,5 @@
 @Component
 @Path("/targets")
+@Transactional(rollbackFor={Exception.class, SQLException.class, IOException.class, ParserConfigurationException.class})
 public class TargetResource {
 
@@ -75,5 +79,6 @@
     @Produces(MediaType.TEXT_XML)
     @Path("{targetid: " + BackendConstants.regExpIdentifier + "}")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public JAXBElement<Target> getTarget(@PathParam("targetid") String ExternalIdentifier) throws SQLException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
@@ -87,5 +92,6 @@
     @Produces(MediaType.TEXT_XML)
     @Path("{targetid: " + BackendConstants.regExpIdentifier + "}/versions")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public JAXBElement<ReferenceList> getSiblingTargets(@PathParam("targetid") String ExternalIdentifier) throws SQLException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/UserResource.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/UserResource.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/UserResource.java	(revision 4207)
@@ -23,4 +23,5 @@
 import eu.dasish.annotation.schema.ObjectFactory;
 import eu.dasish.annotation.schema.User;
+import java.io.IOException;
 import java.sql.SQLException;
 import java.util.UUID;
@@ -38,7 +39,9 @@
 import javax.ws.rs.core.UriInfo;
 import javax.xml.bind.JAXBElement;
+import javax.xml.parsers.ParserConfigurationException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -48,4 +51,5 @@
 @Component
 @Path("/users")
+@Transactional(rollbackFor={Exception.class, SQLException.class, IOException.class, ParserConfigurationException.class})
 public class UserResource {
     @Autowired
@@ -66,5 +70,6 @@
     @Produces(MediaType.TEXT_XML)
     @Path("{userid: " + BackendConstants.regExpIdentifier + "}")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public JAXBElement<User> getUser(@PathParam("userid") String ExternalIdentifier) throws SQLException {
          dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
@@ -77,5 +82,6 @@
     @Produces(MediaType.TEXT_XML)
     @Path("/info")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public JAXBElement<User> getUserByInfo(@QueryParam("email") String email) throws SQLException {
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
@@ -87,5 +93,6 @@
     @Produces(MediaType.TEXT_XML)
     @Path("{userid: " + BackendConstants.regExpIdentifier + "}/current")
-    @Secured("ROLE_USER")
+    @Secured("ROLE_USER")    
+    @Transactional(readOnly=true)
     public JAXBElement<CurrentUserInfo> getCurrentUserInfo(@PathParam("userid") String ExternalIdentifier){
         dbIntegrityService.setServiceURI(uriInfo.getBaseUri().toString());
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/DBIntegrityServiceTest.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/DBIntegrityServiceTest.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/DBIntegrityServiceTest.java	(revision 4207)
@@ -295,4 +295,5 @@
         mockAnnotationIDs1.add(3);
         mockAnnotationIDs1.add(4);
+        mockAnnotationIDs1.add(5);
         
         final List<Number> mockAnnotationIDs2 = new ArrayList<Number>();
@@ -300,5 +301,5 @@
         mockAnnotationIDs2.add(3);
 
-        final String text = "some html";
+        
         final UUID owner = UUID.fromString(TestBackendConstants._TEST_USER_4_EXT_ID);
         final Timestamp after = new Timestamp(0);
@@ -306,7 +307,9 @@
 
         final List<Number> mockRetval = new ArrayList<Number>();
-        mockRetval.add(2);
-        
-        
+        mockRetval.add(3);
+        
+        final String[] accessModes = new String[2];
+        accessModes[0] = "reader";
+        accessModes[1] = "writer";
 
         mockeryDao.checking(new Expectations() {
@@ -315,5 +318,5 @@
                 will(returnValue(mockTargetIDs));
 
-                oneOf(annotationDao).getAnnotationIDsForUserWithPermission(3, "reader");
+                oneOf(annotationDao).getAnnotationIDsForUserWithPermission(3, accessModes);
                 will(returnValue(mockAnnotationIDs1));
 
@@ -326,5 +329,5 @@
                 
                
-                oneOf(annotationDao).getFilteredAnnotationIDs(mockAnnotationIDs1, text, null, 4, after, before);
+                oneOf(annotationDao).getFilteredAnnotationIDs(mockAnnotationIDs1, "some html", null, 4, after, before);
                 will(returnValue(mockRetval));
 
@@ -333,7 +336,7 @@
 
 
-        List result = dbIntegrityService.getFilteredAnnotationIDs(word, text, 3, "reader", null, owner, after, before);
+        List result = dbIntegrityService.getFilteredAnnotationIDs(word, "some html", 3, accessModes, null, owner, after, before);
         assertEquals(1, result.size());
-        assertEquals(2, result.get(0));
+        assertEquals(3, result.get(0));
     }
 
@@ -388,7 +391,8 @@
         mockTargetIDs.add(2);
 
-         final List<Number> mockAnnotationIDs1 = new ArrayList<Number>();
+        final List<Number> mockAnnotationIDs1 = new ArrayList<Number>();
         mockAnnotationIDs1.add(3);
         mockAnnotationIDs1.add(4);
+        mockAnnotationIDs1.add(5);
         
         final List<Number> mockAnnotationIDs2 = new ArrayList<Number>();
@@ -403,21 +407,24 @@
 
         final List<Number> mockAnnotIDs = new ArrayList<Number>();
-        mockAnnotIDs.add(2);
+        mockAnnotIDs.add(3);
         
         final AnnotationInfo mockAnnotInfo = new AnnotationInfo();
         
-        mockAnnotInfo.setHeadline(TestBackendConstants._TEST_ANNOT_2_HEADLINE);        
-        mockAnnotInfo.setRef(TestBackendConstants._TEST_SERVLET_URI_annotations + TestBackendConstants._TEST_ANNOT_2_EXT);
+        mockAnnotInfo.setHeadline(TestBackendConstants._TEST_ANNOT_3_HEADLINE);        
+        mockAnnotInfo.setRef(TestBackendConstants._TEST_SERVLET_URI_annotations + TestBackendConstants._TEST_ANNOT_3_EXT);
         
         final List<Number> TargetIDs = new ArrayList<Number>();
-        TargetIDs.add(1);
         TargetIDs.add(2);
         
-        final Map<AnnotationInfo,Number> mockPair = new HashMap<AnnotationInfo, Number>();
-        mockPair.put(mockAnnotInfo, 3);
-        
-        mockeryDao.checking(new Expectations() {
-            {
-                oneOf(annotationDao).getAnnotationIDsForUserWithPermission(3, "reader");
+        final Map<AnnotationInfo,Number> mockPair = new HashMap<AnnotationInfo, Number>(); // annotationInfo-ownerID
+        mockPair.put(mockAnnotInfo, 4);
+        
+        final String[] accessModes = new String[2];
+        accessModes[0] = "reader";
+        accessModes[1] = "writer";
+        
+        mockeryDao.checking(new Expectations() {
+            {
+                oneOf(annotationDao).getAnnotationIDsForUserWithPermission(3, accessModes);
                 will(returnValue(mockAnnotationIDs1));
 
@@ -439,13 +446,11 @@
 //                ///////////////////////////////////
 //                
-                oneOf(annotationDao).getAnnotationInfoWithoutTargets(2);
+                oneOf(annotationDao).getAnnotationInfoWithoutTargets(3);
                 will(returnValue(mockPair));
                 
                 ////
-                oneOf(annotationDao).retrieveTargetIDs(2);
+                oneOf(annotationDao).retrieveTargetIDs(3);
                 will(returnValue(TargetIDs));
                 
-                oneOf(targetDao).getURIFromInternalID(1);
-                will(returnValue(TestBackendConstants._TEST_SERVLET_URI_Targets +TestBackendConstants._TEST_Target_1_EXT_ID));
                 
                 oneOf(targetDao).getURIFromInternalID(2);
@@ -453,6 +458,6 @@
                 ////
                 
-                oneOf(userDao).getURIFromInternalID(3);
-                will(returnValue(TestBackendConstants._TEST_SERVLET_URI_users +TestBackendConstants._TEST_USER_3_EXT_ID)); 
+                oneOf(userDao).getURIFromInternalID(4);
+                will(returnValue(TestBackendConstants._TEST_SERVLET_URI_users +TestBackendConstants._TEST_USER_4_EXT_ID)); 
              
                
@@ -461,12 +466,11 @@
        
       
-        AnnotationInfoList result = dbIntegrityService.getFilteredAnnotationInfos(word, text, 3, "reader", null, ownerUUID, after, before);
+        AnnotationInfoList result = dbIntegrityService.getFilteredAnnotationInfos(word, text, 3, accessModes, null, ownerUUID, after, before);
         assertEquals(1, result.getAnnotationInfo().size()); 
         AnnotationInfo resultAnnotInfo = result.getAnnotationInfo().get(0);
         assertEquals(mockAnnotInfo.getHeadline(), resultAnnotInfo.getHeadline());
-        assertEquals(TestBackendConstants._TEST_SERVLET_URI_users +TestBackendConstants._TEST_USER_3_EXT_ID, resultAnnotInfo.getOwnerRef());
+        assertEquals(TestBackendConstants._TEST_SERVLET_URI_users +TestBackendConstants._TEST_USER_4_EXT_ID, resultAnnotInfo.getOwnerRef());
         assertEquals(mockAnnotInfo.getRef(),result.getAnnotationInfo().get(0).getRef() );
-        assertEquals(TestBackendConstants._TEST_SERVLET_URI_Targets +TestBackendConstants._TEST_Target_1_EXT_ID, resultAnnotInfo.getTargets().getRef().get(0));
-        assertEquals(TestBackendConstants._TEST_SERVLET_URI_Targets +TestBackendConstants._TEST_Target_2_EXT_ID, resultAnnotInfo.getTargets().getRef().get(1));
+        assertEquals(TestBackendConstants._TEST_SERVLET_URI_Targets +TestBackendConstants._TEST_Target_2_EXT_ID, resultAnnotInfo.getTargets().getRef().get(0));
           
     }
@@ -690,5 +694,5 @@
                 ///////////
 
-                oneOf(annotationDao).updateAnnotationBodyText(6, testAnnotation.getBody().getTextBody().getValue());
+                oneOf(annotationDao).updateAnnotationBody(6, testAnnotation.getBody().getTextBody().getValue(), testAnnotation.getBody().getTextBody().getMimeType(), false);
                 will(returnValue(1)); // the DB update will be called at perform anyway, even if the body is not changed (can be optimized)
 
Index: /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/JdbcAnnotationDaoTest.java
===================================================================
--- /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/JdbcAnnotationDaoTest.java	(revision 4206)
+++ /DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/JdbcAnnotationDaoTest.java	(revision 4207)
@@ -376,17 +376,5 @@
     
     //////////////////////////////////
-    @Test 
-    public void testUpdateBodyText() throws SQLException{
-        System.out.println("test updateBodyText");
-        String newBodyText = "new body";
-        int result = jdbcAnnotationDao.updateAnnotationBodyText(2, newBodyText);
-        assertEquals(1, result);
-        Map<Annotation,Number> getResult= jdbcAnnotationDao.getAnnotationWithoutTargetsAndPermissions(2);
-        Annotation[] annotations = new Annotation[1];
-        getResult.keySet().toArray(annotations);
-        assertEquals(newBodyText, annotations[0].getBody().getTextBody().getValue());
-        System.out.println("update time "+annotations[0].getLastModified());
-    }
-
+   
   
     
