diff --git a/scm-webapp/src/main/java/sonia/scm/web/BasicWebTokenGenerator.java b/scm-webapp/src/main/java/sonia/scm/web/BasicWebTokenGenerator.java
index 04bf59bd1b..80aee62b36 100644
--- a/scm-webapp/src/main/java/sonia/scm/web/BasicWebTokenGenerator.java
+++ b/scm-webapp/src/main/java/sonia/scm/web/BasicWebTokenGenerator.java
@@ -40,6 +40,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import sonia.scm.plugin.Extension;
+import sonia.scm.util.HttpUtil;
 import sonia.scm.util.Util;
 
 //~--- JDK imports ------------------------------------------------------------
@@ -47,6 +48,8 @@ import sonia.scm.util.Util;
 import javax.servlet.http.HttpServletRequest;
 
 /**
+ * Creates a {@link UsernamePasswordToken} from an authorization header with
+ * basic authentication.
  *
  * @author Sebastian Sdorra
  * @since 2.0.0
@@ -55,10 +58,7 @@ import javax.servlet.http.HttpServletRequest;
 public class BasicWebTokenGenerator extends SchemeBasedWebTokenGenerator
 {
 
-  /** Field description */
-  public static final String AUTHORIZATION_BASIC_PREFIX = "basic";
-
-  /** Field description */
+  /** credential separator for basic authentication */
   public static final String CREDENTIAL_SEPARATOR = ":";
 
   /**
@@ -70,14 +70,15 @@ public class BasicWebTokenGenerator extends SchemeBasedWebTokenGenerator
   //~--- methods --------------------------------------------------------------
 
   /**
-   * Method description
+   * Creates a {@link UsernamePasswordToken} from an authorization header with
+   * basic authentication scheme.
    *
    *
-   * @param request
-   * @param scheme
-   * @param authorization
+   * @param request http servlet request
+   * @param scheme authentication scheme
+   * @param authorization authorization payload
    *
-   * @return
+   * @return {@link UsernamePasswordToken} or {@code null}
    */
   @Override
   protected UsernamePasswordToken createToken(HttpServletRequest request,
@@ -85,7 +86,7 @@ public class BasicWebTokenGenerator extends SchemeBasedWebTokenGenerator
   {
     UsernamePasswordToken authToken = null;
 
-    if (AUTHORIZATION_BASIC_PREFIX.equalsIgnoreCase(scheme))
+    if (HttpUtil.AUTHORIZATION_SCHEME_BASIC.equalsIgnoreCase(scheme))
     {
       String token = new String(Base64.decode(authorization.getBytes()));
 
diff --git a/scm-webapp/src/main/java/sonia/scm/web/BearerWebTokenGenerator.java b/scm-webapp/src/main/java/sonia/scm/web/BearerWebTokenGenerator.java
index 14c9408b2e..7a041d8b97 100644
--- a/scm-webapp/src/main/java/sonia/scm/web/BearerWebTokenGenerator.java
+++ b/scm-webapp/src/main/java/sonia/scm/web/BearerWebTokenGenerator.java
@@ -33,15 +33,18 @@ package sonia.scm.web;
 
 //~--- non-JDK imports --------------------------------------------------------
 
+import sonia.scm.plugin.Extension;
 import sonia.scm.security.BearerAuthenticationToken;
+import sonia.scm.util.HttpUtil;
 
 //~--- JDK imports ------------------------------------------------------------
 
 import javax.servlet.http.HttpServletRequest;
-import sonia.scm.plugin.Extension;
 
 /**
- *
+ * Creates a {@link BearerAuthenticationToken} from an authorization header with
+ * bearer authorization.
+ * 
  * @author Sebastian Sdorra
  * @since 2.0.0
  */
@@ -49,20 +52,15 @@ import sonia.scm.plugin.Extension;
 public class BearerWebTokenGenerator extends SchemeBasedWebTokenGenerator
 {
 
-  /** Field description */
-  public static final String AUTHORIZATION_BEARER_PREFIX = "BEARER";
-
-  //~--- methods --------------------------------------------------------------
-
   /**
-   * Method description
+   * Creates a {@link BearerAuthenticationToken} from an authorization header 
+   * with bearer authorization.
    *
+   * @param request http servlet request
+   * @param scheme authorization scheme
+   * @param authorization authorization payload
    *
-   * @param request
-   * @param scheme
-   * @param authorization
-   *
-   * @return
+   * @return {@link BearerAuthenticationToken} or {@code null}
    */
   @Override
   protected BearerAuthenticationToken createToken(HttpServletRequest request,
@@ -70,7 +68,7 @@ public class BearerWebTokenGenerator extends SchemeBasedWebTokenGenerator
   {
     BearerAuthenticationToken token = null;
 
-    if (AUTHORIZATION_BEARER_PREFIX.equalsIgnoreCase(scheme))
+    if (HttpUtil.AUTHORIZATION_SCHEME_BEARER.equalsIgnoreCase(scheme))
     {
       token = new BearerAuthenticationToken(authorization);
     }
diff --git a/scm-webapp/src/main/java/sonia/scm/web/CookieBearerWebTokenGenerator.java b/scm-webapp/src/main/java/sonia/scm/web/CookieBearerWebTokenGenerator.java
index 47dcf78dc7..ca9f1d7d22 100644
--- a/scm-webapp/src/main/java/sonia/scm/web/CookieBearerWebTokenGenerator.java
+++ b/scm-webapp/src/main/java/sonia/scm/web/CookieBearerWebTokenGenerator.java
@@ -43,6 +43,8 @@ import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 
 /**
+ * Creates an {@link BearerAuthenticationToken} from the {@link #COOKIE_NAME} 
+ * cookie.
  *
  * @author Sebastian Sdorra
  * @since 2.0.0
@@ -51,19 +53,19 @@ import javax.servlet.http.HttpServletRequest;
 public class CookieBearerWebTokenGenerator implements WebTokenGenerator
 {
 
-  /** Field description */
+  /** cookie name */
   @VisibleForTesting
   static final String COOKIE_NAME = "X-Bearer-Token";
 
   //~--- methods --------------------------------------------------------------
 
   /**
-   * Method description
+   * Creates an {@link BearerAuthenticationToken} from the {@link #COOKIE_NAME} 
+   * cookie.
    *
+   * @param request http servlet request
    *
-   * @param request
-   *
-   * @return
+   * @return {@link BearerAuthenticationToken} or {@code null}
    */
   @Override
   public BearerAuthenticationToken createToken(HttpServletRequest request)