diff --git a/app/rest/api/middleware.go b/app/rest/api/middleware.go
index 9d19420b..fe4bbd42 100644
--- a/app/rest/api/middleware.go
+++ b/app/rest/api/middleware.go
@@ -87,58 +87,17 @@ var reMultWhtsp = regexp.MustCompile(`[\s\p{Zs}]{2,}`)
 // Logger middleware prints http log. Customized by set of LoggerFlag
 func Logger(flags ...LoggerFlag) func(http.Handler) http.Handler {
 
-	inFlags := func(f LoggerFlag) bool {
-		for _, flg := range flags {
-			if (flg == LogAll && f != LogNone) || flg == f {
-				return true
-			}
-		}
-		return false
-	}
-
 	f := func(h http.Handler) http.Handler {
 
 		fn := func(w http.ResponseWriter, r *http.Request) {
 
-			if inFlags(LogNone) { // skip logging
+			if inLogFlags(LogNone, flags) { // skip logging
 				h.ServeHTTP(w, r)
 				return
 			}
 
 			ww := middleware.NewWrapResponseWriter(w, 1)
-
-			body, user := func() (body string, user string) {
-				ctx := r.Context()
-				if ctx == nil {
-					return "", ""
-				}
-
-				if inFlags(LogBody) {
-					if content, err := ioutil.ReadAll(r.Body); err == nil {
-						body = string(content)
-						r.Body = ioutil.NopCloser(bytes.NewReader(content))
-
-						if len(body) > 0 {
-							body = strings.Replace(body, "\n", " ", -1)
-							body = reMultWhtsp.ReplaceAllString(body, " ")
-						}
-
-						if len(body) > maxBody {
-							body = body[:maxBody] + "..."
-						}
-					}
-				}
-
-				if inFlags(LogUser) {
-					u, err := rest.GetUserInfo(r)
-					if err == nil && u.Name != "" {
-						user = fmt.Sprintf(" - %s %q", u.ID, u.Name)
-					}
-				}
-
-				return body, user
-			}()
-
+			body, user := getBodyAndUser(r, flags)
 			t1 := time.Now()
 			defer func() {
 				t2 := time.Now()
@@ -164,3 +123,44 @@ func Logger(flags ...LoggerFlag) func(http.Handler) http.Handler {
 
 	return f
 }
+
+func getBodyAndUser(r *http.Request, flags []LoggerFlag) (body string, user string) {
+	ctx := r.Context()
+	if ctx == nil {
+		return "", ""
+	}
+
+	if inLogFlags(LogBody, flags) {
+		if content, err := ioutil.ReadAll(r.Body); err == nil {
+			body = string(content)
+			r.Body = ioutil.NopCloser(bytes.NewReader(content))
+
+			if len(body) > 0 {
+				body = strings.Replace(body, "\n", " ", -1)
+				body = reMultWhtsp.ReplaceAllString(body, " ")
+			}
+
+			if len(body) > maxBody {
+				body = body[:maxBody] + "..."
+			}
+		}
+	}
+
+	if inLogFlags(LogUser, flags) {
+		u, err := rest.GetUserInfo(r)
+		if err == nil && u.Name != "" {
+			user = fmt.Sprintf(" - %s %q", u.ID, u.Name)
+		}
+	}
+
+	return body, user
+}
+
+func inLogFlags(f LoggerFlag, flags []LoggerFlag) bool {
+	for _, flg := range flags {
+		if (flg == LogAll && f != LogNone) || flg == f {
+			return true
+		}
+	}
+	return false
+}
diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go
index ad62de2b..fc7dc8ac 100644
--- a/app/rest/auth/auth.go
+++ b/app/rest/auth/auth.go
@@ -61,7 +61,7 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 				return
 			}
 
-			if xsrfError := a.checkXsrf(r, session); xsrfError != nil {
+			if xsrfError := a.checkXSRF(r, session); xsrfError != nil {
 				if reqAuth {
 					log.Printf("[WARN] %s", xsrfError.Error())
 					http.Error(w, "Unauthorized", http.StatusUnauthorized)
@@ -89,7 +89,7 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 	return f
 }
 
-func (a *Authenticator) checkXsrf(r *http.Request, session *sessions.Session) error {
+func (a *Authenticator) checkXSRF(r *http.Request, session *sessions.Session) error {
 	xsrfToken := r.Header.Get("X-XSRF-TOKEN")
 	sessionToken, headerOk := session.Values["xsrf_token"]
 	if !headerOk || xsrfToken == "" || sessionToken == nil {