diff --git a/services/utils-service/properties.file b/services/utils-service/properties.file
index 9c99417d..0fe8bc25 100644
--- a/services/utils-service/properties.file
+++ b/services/utils-service/properties.file
@@ -1,4 +1,4 @@
-userInfoUrl = http://scoobydoo.di.uoa.gr:8080/dnet-openaire-users-1.0.0-SNAPSHOT/api/users/getUserInfo?accessToken=
+userInfoUrl = http://dl170.madgik.di.uoa.gr:8180/dnet-openaire-users-1.0.0-SNAPSHOT/api/users/getUserInfo?accessToken=
 originServer = .di.uoa.gr
 post.allowed = /upload,/upload/
 ssl = false
diff --git a/services/utils-service/uploadService.js b/services/utils-service/uploadService.js
index 5b1d00b8..1da44ac2 100644
--- a/services/utils-service/uploadService.js
+++ b/services/utils-service/uploadService.js
@@ -8,7 +8,7 @@ var TinyURL = require('tinyurl');
 var app = express();
 var http = null;
 
-if(properties.get('ssl')) {
+if (properties.get('ssl')) {
     http = require("https");
 } else {
     http = require("http");
@@ -20,14 +20,14 @@ var auth = properties.get('userInfoUrl');
 var originServer = properties.get('originServer');
 var allowPostRequests = properties.get('post.allowed').split(',');
 var localPath = properties.get('localPath');
-var maxsize = properties.get('photo.size')*1024;
+var maxsize = properties.get('photo.size') * 1024;
 
 var storage = multer.diskStorage({
     destination: function (req, file, cb) {
         cb(null, 'uploads')
     },
     filename: function (req, file, cb) {
-        if(req.params.id) {
+        if (req.params.id) {
             cb(null, req.params.id + '-' + new Date().getTime() + '.' + file.originalname.split('.').pop());
         } else {
             cb(null, file.originalname);
@@ -35,7 +35,7 @@ var storage = multer.diskStorage({
     }
 });
 
-var upload = multer({ storage: storage })
+var upload = multer({storage: storage})
 
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({extended: true}));
@@ -69,7 +69,7 @@ app.use(function (req, res, next) {
 });
 
 app.post("/upload", upload.array("uploads[]", 12), function (req, res) {
-    var filepath = (localPath?".":__dirname)+"/" + req.files[0].path;
+    var filepath = (localPath ? "." : __dirname) + "/" + req.files[0].path;
     let type = req.query.type;
 	console.log(type);
     if(type == 'json' && req.files[0].mimetype !== 'application/json'){
@@ -80,66 +80,35 @@ app.post("/upload", upload.array("uploads[]", 12), function (req, res) {
         res.status(500).send(getResponse(500, "No proper file type"));
     } else {
         res.download(filepath);
-	setTimeout(function() {
-		 deleteFile(filepath);
-	}, 3000);
+        setTimeout(function () {
+            deleteFile(filepath);
+        }, 3000);
 //        deleteFile(filepath);
     }
 
 });
 
-app.post('/upload/:id', upload.single('photo'), (req, res) => {
-    const token = req.headers['x-xsrf-token'];
-    const file = req.file;
-    var filepath = (localPath?".":__dirname)+"/" + file.path;
-    console.log(filepath);
-    if(!token) {
-        res.status(401).send(getResponse(401, "Unauthorized"));
-        deleteFile(filepath);
-    }
-    else if (!file || (file.mimetype !== 'image/jpeg' && file.mimetype !== 'image/png')) {
-        res.status(500).send(getResponse(500, "No image file type"));
-        deleteFile(filepath);
-    }
-    else if (file.size > maxsize) {
-        res.status(500).send(getResponse(500, "Exceeds file size limit"));
-        deleteFile(filepath);
-    }
-    else {
-        http.get(auth+token, function (resp) {
-            var responseString = "";
-            resp.on("data", function (data) {
-                responseString += data;
-            });
-            resp.on("end", function () {
-                var result = JSON.parse(responseString);
-                if(result.error) {
-                    res.status(401).send(getResponse(401, "Unauthorized"));
-                    deleteFile(filepath);
-                } else {
-                    // if user id contains id param or is Admin or Curator keep file and send information, else delete it.
-                    if(result.sub.indexOf(req.params.id) !== -1 || isAdminOrCurator(result.edu_person_entitlements)) {
-                        res.send(file);
-                    } else {
-                        res.status(401).send(getResponse(401, "Unauthorized"));
-                        deleteFile(filepath);
-                    }
-                }
-            });
-        });
-    }
+app.post('/upload/stakeholder/:id', upload.single('photo'), (req, res) => {
+    sendFile(req, res,  (result) => {
+        return isAdminOrCurator(result.edu_person_entitlements);
+    });
+});
 
+app.post('/upload/:id', upload.single('photo'), (req, res) => {
+    sendFile(req, res,  (result) => {
+        return result.sub.indexOf(req.params.id) !== -1 || isAdminOrCurator(result.edu_person_entitlements);
+    });
 });
 
 app.get('/download/:filename', function (req, res) {
-   res.download('./uploads/' + req.params.filename);
+    res.download('./uploads/' + req.params.filename);
 });
 
 app.get('/tiny', function (req, res) {
-    TinyURL.shorten(req.query.url, function(res1, err) {
+    TinyURL.shorten(req.query.url, function (res1, err) {
         if (err)
             console.log(err)
-        if(res1 !== 'Error') {
+        if (res1 !== 'Error') {
             res.send(res1);
         } else {
             res.send(req.query.url);
@@ -148,22 +117,22 @@ app.get('/tiny', function (req, res) {
 });
 
 app.delete('/delete/:filename', function (req, res) {
-    const token = req.headers['x-xsrf-token'];
-    if(!token) {
+    const token = req.cookies['AccessToken'];
+    if (!token) {
         res.status(401).send(getResponse(401, "Unauthorized"));
     } else {
-        http.get(auth+token, function (resp) {
+        http.get(auth + token, function (resp) {
             var responseString = "";
             resp.on("data", function (data) {
                 responseString += data;
             });
             resp.on("end", function () {
                 var result = JSON.parse(responseString);
-                if(result.error) {
+                if (result.error) {
                     res.status(401).send(getResponse(401, "Unauthorized"));
                 } else {
                     // if user id is on filename or is Admin delete file else unauthorized.
-                    if(result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isAdminOrCurator(result.edu_person_entitlements)) {
+                    if (result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isAdminOrCurator(result.edu_person_entitlements)) {
                         deleteFile('./uploads/' + req.params.filename);
                         return res.status(200).send(getResponse(200, "File Deleted Successfully"));
                     } else {
@@ -179,6 +148,43 @@ const server = app.listen(8000, function () {
     console.log("Listening on port %s...", server.address().port);
 });
 
+function sendFile(req, res, authorized) {
+    const token = req.cookies['AccessToken'];
+    const file = req.file;
+    var filepath = (localPath ? "." : __dirname) + "/" + file.path;
+    if (!token) {
+        res.status(401).send(getResponse(401, "Unauthorized"));
+        deleteFile(filepath);
+    } else if (!file || (file.mimetype !== 'image/jpeg' && file.mimetype !== 'image/png')) {
+        res.status(500).send(getResponse(500, "No image file type"));
+        deleteFile(filepath);
+    } else if (file.size > maxsize) {
+        res.status(500).send(getResponse(500, "Exceeds file size limit"));
+        deleteFile(filepath);
+    } else {
+        http.get(auth + token, function (resp) {
+            var responseString = "";
+            resp.on("data", function (data) {
+                responseString += data;
+            });
+            resp.on("end", function () {
+                var result = JSON.parse(responseString);
+                if (result.error) {
+                    res.status(401).send(getResponse(401, "Unauthorized"));
+                    deleteFile(filepath);
+                } else {
+                    if (authorized(result)) {
+                        res.send(file);
+                    } else {
+                        res.status(401).send(getResponse(401, "Unauthorized"));
+                        deleteFile(filepath);
+                    }
+                }
+            });
+        });
+    }
+}
+
 function getResponse(code, message) {
     var response = {};
     response["code"] = code;
@@ -205,44 +211,33 @@ function deleteFile(filepath) {
 function isAdminOrCurator(roles) {
     var isAdmin = false;
     var isCurator = false;
-    for(var i = 0; i < roles.length; i++) {
-        if(roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') {
+    for (var i = 0; i < roles.length; i++) {
+        if (roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') {
             isAdmin = true;
         }
-        if(roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Community#aai.openaire.eu') {
+        if (roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Community#aai.openaire.eu') {
             isCurator = true;
         }
     }
     return isAdmin || isCurator;
 }
 
-function checkCookies(request){
+function checkCookies(request) {
     var valid = true;
     var cookieValue = request.cookies.AccessToken;
-    if(cookieValue === undefined || cookieValue === ''){
+    if (cookieValue === undefined || cookieValue === '') {
         console.log("no cookie available");
         valid = false;
-    } else {
-        const headerValue = request.headers['x-xsrf-token'];
-        if(headerValue === undefined || headerValue === ''){
-            console.log("no header available");
-            valid = false;
-        } else{
-            if(cookieValue !== headerValue){
-                console.log("no proper header or cookie");
-                valid = false;
-            } else if(!hasValidOrigin(request.headers.origin)){
-                console.log("no proper origin");
-                valid = false;
-            }
-        }
+    } else if (!hasValidOrigin(request.headers.origin)) {
+        console.log("no proper origin");
+        valid = false;
     }
     return valid;
 }
 
 
 function hasValidOrigin(origin) {
-    if(origin !== undefined && origin.indexOf(originServer) !== -1) {
+    if (origin !== undefined && origin.indexOf(originServer) !== -1) {
         return true;
     } else {
         console.log("Not valid origin. Origin server is \"" + origin +