diff --git a/public/app/invites.jade b/public/app/invites.jade
index 8bfb963..5165a6c 100644
--- a/public/app/invites.jade
+++ b/public/app/invites.jade
@@ -1,5 +1,8 @@
 .container
 	h1 Invites
+	a.btn.btn.default(ng-click="toggleAdmin()")
+		span.glyphicon.glyphicon-ok(ng-if="invitor.admin")
+		span.glyphicon.glyphicon-remove(ng-if="!invitor.admin")
 	a.btn.btn-default(ng-click="isAdding=true")
 		span.glyphicon.glyphicon-plus
 	form(ng-submit="add()",name="addform",ng-if="isAdding")
@@ -18,16 +21,19 @@
 	table.table.table-bordered(ng-table="tableParams")
 		tr(ng-hide='group.$hideRows',ng-repeat="item in $data")
 			td(data-title="'#'") {{item.invited.ID}}
-			td(data-title="'Hostname'", filter="{'invited.username': 'text'}")
+			td(data-title="'Username'", filter="{'invited.username': 'text'}")
 				span(ng-if="!item.isEditing") {{item.invited.username}}
 				h4(ng-if="item.isEditing") Username: {{item.invited.username}}
 				form(ng-submit="submit(obj)",name="myform",ng-if="item.isEditing")
+					.form-group(ng-if="session.login.superadmin",ng-class="{'has-error': (error.fields.indexOf('username') >= 0 || !myform.username.$valid)}")
+						label(for="username") Username
+						input.form-control(id="username",name="username",ng-model="item.invited.username")
 					.form-group(ng-class="{'has-error': (error.fields.indexOf('newpassword') >= 0 || !myform.newPassword.$valid)}")
 						label(for="newPassword") New Password
-						input.form-control(id="newPassword",type="password",name="newPassword",ng-model="obj.newPassword",ng-minlength="3")
-					.form-group(ng-class="{'has-error': (obj.newPassword != obj.repeatPassword && myform.repeatPassword.$dirty)}")
+						input.form-control(id="newPassword",type="password",name="newPassword",ng-model="item.newPassword",ng-minlength="3")
+					.form-group(ng-class="{'has-error': (item.newPassword != item.repeatPassword && myform.repeatPassword.$dirty)}")
 						label(for="repeatPassword") Again Password
-						input.form-control(id="repeatPassword",type="password",name="repeatPassword",ng-model="obj.repeatPassword")
+						input.form-control(id="repeatPassword",type="password",name="repeatPassword",ng-model="item.repeatPassword")
 			td(data-title="'Administrator'", filter="{'admin': 'components/ngfilter-boolean.html'}")
 				span.glyphicon.glyphicon-ok(ng-if="item.admin")
 				span.glyphicon.glyphicon-remove(ng-if="!item.admin")
@@ -35,7 +41,7 @@
 				.btn-group.btn-group-xs(ng-if="item.admin || item.invited.createat >= item.invited.lastloginat")
 					span.btn.btn-default(ng-click="item.isEditing = true",ng-if="!item.isEditing")
 						span.glyphicon.glyphicon-pencil
-					span.btn.btn-default(ng-click="item.isEditing = false",ng-if="item.isEditing")
+					span.btn.btn-default(ng-click="edit(item)",ng-if="item.isEditing")
 						span.glyphicon.glyphicon-remove-circle
-					span.btn.btn-default
+					span.btn.btn-default(ng-click="delete(item)")
 						span.glyphicon.glyphicon-trash
diff --git a/public/app/invites.js b/public/app/invites.js
index 62b57ad..da349a1 100644
--- a/public/app/invites.js
+++ b/public/app/invites.js
@@ -9,6 +9,9 @@ angular.module('warehost')
 		}, { dataset: [] });
 		alert.set({});
 		$scope.list = {};
+		$scope.obj = {};
+		$scope.invitor = {}
+
 		function resetObj(){
 			$scope.obj = {};
 			var username = session.get().login.username;
@@ -21,22 +24,34 @@ angular.module('warehost')
 				session.set(res);
 				$scope.tableParams.settings({dataset: angular.copy(res.data.data),total: (res.data.data).length});
 			});
+			$http.get(config.api+'/invitor').then(function(res){
+				session.set(res);
+				$scope.invitor = res.data.data;
+			});
+		}
+		function submitresult(res){
+			session.set(res);
+			alert.set(res);
+			if(res.data.data){
+				load();
+				resetObj();
+				$scope.isAdding = false;
+			}
 		}
 		resetObj();
 		load();
 
-		$scope.submit = function(a){
-			console.log(a);
+		$scope.edit = function(a){
+			a.invited.password = a.newPassword;
+			$http.put(config.api+'/invite/'+a.invited.ID,a.invited).then(submitresult);
+		};
+		$scope.delete = function(a){
+			$http.delete(config.api+'/invite/'+a.invited.ID).then(submitresult);
 		};
 		$scope.add = function(){
-			$http.post(config.api+'/invite',$scope.obj).then(function(res){
-				session.set(res);
-				alert.set(res);
-				if(res.data.data){
-					load();
-					resetObj();
-					$scope.isAdding = false;
-				}
-			});
+			$http.post(config.api+'/invite',$scope.obj).then(submitresult);
+		};
+		$scope.toggleAdmin = function(a){
+			$http.put(config.api+'/invitor').then(submitresult);
 		};
 	});
diff --git a/public/components/config.js b/public/components/config.js
index 181cfdc..582a254 100644
--- a/public/components/config.js
+++ b/public/components/config.js
@@ -2,7 +2,7 @@
 angular.module('config', [])
 	.factory('config', function() {
 		return {
-			api: 'https://apiv2.warehost.de',
+			api: 'http://[::1]:8080',
 			table: {
 				count: 25
 			}
diff --git a/tests/index.coffee b/tests/index.coffee
index 3de635e..7dfbbde 100644
--- a/tests/index.coffee
+++ b/tests/index.coffee
@@ -19,6 +19,22 @@ describe('API',->
 	)
 	describe('invite',->
 		describe('add',->
+			it('-> without login',(done)->
+				invite = {
+					username: 'test',
+					password:'test'
+				}
+				request({method: 'POST',uri:config.ADDRESS+"/invite",json:invite},(err,res,body)->
+					expect(err).to.be.null
+					expect(res.statusCode).to.be.equal(200)
+					if(typeof body == "string")
+						body = JSON.parse(body)
+					expect(body.data).to.be.false
+					expect(body.error.msg).to.not.be.null
+					expect(body.error.fields).to.include('session')
+					done()
+				)
+			)
 			it('-> validate',(done)->
 				lib.login((j)->
 					invite = {
@@ -39,6 +55,18 @@ describe('API',->
 			)
 		)
 		describe('list',->
+			it('-> without login',(done)->
+				request({method: 'GET',uri:config.ADDRESS+"/invite"},(err,res,body)->
+					expect(err).to.be.null
+					expect(res.statusCode).to.be.equal(200)
+					if(typeof body == "string")
+						body = JSON.parse(body)
+					expect(body.data).to.be.false
+					expect(body.error.msg).to.not.be.null
+					expect(body.error.fields).to.include('session')
+					done()
+				)
+			)
 			it('-> validate',(done)->
 				lib.login((j)->
 					request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
@@ -48,12 +76,403 @@ describe('API',->
 							body = JSON.parse(body)
 						expect(body.error).to.be.undefined
 						expect(body.data).to.be.a("array")
+						expect(body.data).to.have.length(1)
 						expect(body.session.login).to.not.be.null
 						done()
 					)
 				)
 			)
 		)
+		describe('admin/toggle',->
+			before((done)->
+				lib.login({
+						username:'test',
+						password:'test'
+					},(j)->
+					invite = {
+						username:'test_admin',
+						password:'test'
+					}
+					request({method: 'POST',uri:config.ADDRESS+"/invite",jar:j,json:invite},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.be.true
+						expect(body.session.login).to.not.be.null
+						done()
+					)
+				)
+			)
+			it('-> without login (get)',(done)->
+				request({method: 'GET',uri:config.ADDRESS+"/invitor"},(err,res,body)->
+					expect(err).to.be.null
+					expect(res.statusCode).to.be.equal(200)
+					if(typeof body == "string")
+						body = JSON.parse(body)
+					expect(body.data).to.be.false
+					expect(body.error.msg).to.not.be.null
+					expect(body.error.fields).to.include('session')
+					done()
+				)
+			)
+			it('-> without login (put)',(done)->
+				request({method: 'PUT',uri:config.ADDRESS+"/invitor"},(err,res,body)->
+					expect(err).to.be.null
+					expect(res.statusCode).to.be.equal(200)
+					if(typeof body == "string")
+						body = JSON.parse(body)
+					expect(body.data).to.be.false
+					expect(body.error.msg).to.not.be.null
+					expect(body.error.fields).to.include('session')
+					done()
+				)
+			)
+			it('-> validate on',(done)->
+				lib.login({username:'test_admin',password:'test'},(j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data.admin).to.be.false
+						expect(body.session.login).to.not.be.null
+						request({method: 'PUT',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							request({method: 'GET',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+								expect(err).to.be.null
+								expect(res.statusCode).to.be.equal(200)
+								if(typeof body == "string")
+									body = JSON.parse(body)
+								expect(body.error).to.be.undefined
+								expect(body.data.admin).to.be.true
+								expect(body.session.login).to.not.be.null
+								done()
+							)
+						)
+					)
+				)
+			)
+			it('-> validate off',(done)->
+				lib.login({username:'test_admin',password:'test'},(j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data.admin).to.be.true
+						expect(body.session.login).to.not.be.null
+						request({method: 'PUT',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							request({method: 'GET',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+								expect(err).to.be.null
+								expect(res.statusCode).to.be.equal(200)
+								if(typeof body == "string")
+									body = JSON.parse(body)
+								expect(body.error).to.be.undefined
+								expect(body.data.admin).to.be.false
+								expect(body.session.login).to.not.be.null
+								done()
+							)
+						)
+					)
+				)
+			)
+			it('-> validate on',(done)->
+				lib.login({username:'test_admin',password:'test'},(j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data.admin).to.be.false
+						expect(body.session.login).to.not.be.null
+						request({method: 'PUT',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							request({method: 'GET',uri:config.ADDRESS+"/invitor",jar:j},(err,res,body)->
+								expect(err).to.be.null
+								expect(res.statusCode).to.be.equal(200)
+								if(typeof body == "string")
+									body = JSON.parse(body)
+								expect(body.error).to.be.undefined
+								expect(body.data.admin).to.be.true
+								expect(body.session.login).to.not.be.null
+								done()
+							)
+						)
+					)
+				)
+			)
+		)
+		describe('edit',->
+			it('-> not invited/exists',(done)->
+				lib.login({username:'test',password:'test'},(j)->
+					request({method: 'PUT',uri:config.ADDRESS+"/invite/"+1,jar:j,json:{
+							username: 'test_not_exits',
+							password:'test'
+						}},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.not.undefined
+						expect(body.data).to.be.false
+						expect(body.session.login).to.not.be.null
+						done()
+					)
+				)
+			)
+			it('-> invited, not used',(done)->
+				lib.login({username:'test',password:'test'},(j)->
+					invite = {
+						username: 'test_not_used',
+						password:'test'
+					}
+					request({method: 'POST',uri:config.ADDRESS+"/invite",jar:j,json:invite},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.be.true
+						expect(body.session.login).to.not.be.null
+						request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.have.length(1)
+							expect(body.session.login).to.not.be.null
+							request({method: 'PUT',uri:config.ADDRESS+"/invite/"+body.data[0].invited.ID,jar:j,json:{
+									username:'test2_not_used',
+									password:'test2'
+								}},(err,res,body)->
+								expect(err).to.be.null
+								expect(res.statusCode).to.be.equal(200)
+								if(typeof body == "string")
+									body = JSON.parse(body)
+								expect(body.error).to.be.undefined
+								expect(body.data).to.be.true
+								expect(body.session.login).to.not.be.null
+								done()
+							)
+						)
+					)
+				)
+			)
+			it('-> invited, used',(done)->
+				lib.login({username:'test',password:'test'},(j)->
+					invite = {
+						username: 'test_used',
+						password:'test'
+					}
+					request({method: 'POST',uri:config.ADDRESS+"/invite",jar:j,json:invite},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.be.true
+						expect(body.session.login).to.not.be.null
+						lib.login({username:'test_used',password:'test'},()->
+							request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+								expect(err).to.be.null
+								expect(res.statusCode).to.be.equal(200)
+								if(typeof body == "string")
+									body = JSON.parse(body)
+								expect(body.error).to.be.undefined
+								expect(body.data).to.have.length(2)
+								expect(body.session.login).to.not.be.null
+								i = 0
+								if(body.data[0].invited.username!="test_used")
+									i = 1
+								request({method: 'PUT',uri:config.ADDRESS+"/invite/"+body.data[i].invited.ID,jar:j,json:{
+										username:'test2_not_used',
+										password:'test2'
+									}},(err,res,body)->
+									expect(err).to.be.null
+									expect(res.statusCode).to.be.equal(200)
+									if(typeof body == "string")
+										body = JSON.parse(body)
+									expect(body.error).to.be.not.undefined
+									expect(body.data).to.be.false
+									expect(body.session.login).to.not.be.null
+									done()
+								)
+							)
+						)
+					)
+				)
+			)
+			it('-> superadmin',(done)->
+				lib.login((j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.have.length(1)
+						expect(body.session.login).to.not.be.null
+						request({method: 'PUT',uri:config.ADDRESS+"/invite/"+body.data[0].invited.ID,jar:j,json:{
+								username:'test2',
+								password:'test2'
+							}},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							done()
+						)
+					)
+				)
+			)
+		)
+		describe('delete',->
+			it('-> not invited/exists',(done)->
+				lib.login({username:'test2',password:'test2'},(j)->
+					request({method: 'DELETE',uri:config.ADDRESS+"/invite/"+1,jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.not.undefined
+						expect(body.data).to.be.false
+						expect(body.session.login).to.not.be.null
+						done()
+					)
+				)
+			)
+			it('-> invited, admin',(done)->
+				lib.login({username:'test2',password:'test2'},(j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.have.length(2)
+						expect(body.session.login).to.not.be.null
+						i = 0
+						if(body.data[i].invited.username!="test_admin")
+							i = 1
+							if(body.data[i].invited.username!="test_admin")
+								i = 2
+						request({method: 'DELETE',uri:config.ADDRESS+"/invite/"+body.data[i].invited.ID,jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							done()
+						)
+					)
+				)
+			)
+			it('-> invited, not used',(done)->
+				lib.login({username:'test2',password:'test2'},(j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.have.length(2)
+						expect(body.session.login).to.not.be.null
+						i = 0
+						if(body.data[0].invited.username!="test_not_used")
+							i = 1
+						request({method: 'DELETE',uri:config.ADDRESS+"/invite/"+body.data[i].invited.ID,jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							done()
+						)
+					)
+				)
+			)
+			it('-> invited, used',(done)->
+				lib.login({username:'test2',password:'test2'},(j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.have.length(1)
+						expect(body.session.login).to.not.be.null
+						i = 0
+						if(body.data[0].invited.username!="test_used")
+							i = 1
+						request({method: 'DELETE',uri:config.ADDRESS+"/invite/"+body.data[i].invited.ID,jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.not.undefined
+							expect(body.data).to.be.false
+							expect(body.session.login).to.not.be.null
+							done()
+						)
+					)
+				)
+			)
+			it('-> superadmin',(done)->
+				lib.login((j)->
+					request({method: 'GET',uri:config.ADDRESS+"/invite",jar:j},(err,res,body)->
+						expect(err).to.be.null
+						expect(res.statusCode).to.be.equal(200)
+						if(typeof body == "string")
+							body = JSON.parse(body)
+						expect(body.error).to.be.undefined
+						expect(body.data).to.have.length(1)
+						expect(body.session.login).to.not.be.null
+						request({method: 'DELETE',uri:config.ADDRESS+"/invite/"+body.data[0].invited.ID,jar:j},(err,res,body)->
+							expect(err).to.be.null
+							expect(res.statusCode).to.be.equal(200)
+							if(typeof body == "string")
+								body = JSON.parse(body)
+							expect(body.error).to.be.undefined
+							expect(body.data).to.be.true
+							expect(body.session.login).to.not.be.null
+							done()
+						)
+					)
+				)
+			)
+		)
 	)
 	describe('login',->
 		it('-> wrong username',(done)->
@@ -95,8 +514,8 @@ describe('API',->
 				expect(res.statusCode).to.be.equal(200)
 				if(typeof body == "string")
 					body = JSON.parse(body)
-				expect(body.data).to.be.true
 				expect(body.error).to.be.undefined
+				expect(body.data).to.be.true
 				expect(body.session.login.active).to.be.true
 				done()
 			)
@@ -193,8 +612,8 @@ describe('API',->
 					expect(res.statusCode).to.be.equal(200)
 					if(typeof body == "string")
 						body = JSON.parse(body)
-					expect(body.data).to.be.true
 					expect(body.error).to.be.undefined
+					expect(body.data).to.be.true
 					request({method: 'POST',uri: config.ADDRESS+"/password",json:{
 							currentpassword: config.testdata.password+"f",
 							newpassword: config.testdata.password,
@@ -221,14 +640,14 @@ describe('API',->
 			)
 		)
 		it('-> validate',(done)->
-			lib.login((j)->
+			lib.login({username:'test_used',password:'test'},(j)->
 				request({method: 'GET',uri:config.ADDRESS+"/delete",jar:j},(err,res,body)->
 					expect(err).to.be.null
 					expect(res.statusCode).to.be.equal(200)
 					if(typeof body == "string")
 						body = JSON.parse(body)
-					expect(body.data).to.be.true
 					expect(body.error).to.be.undefined
+					expect(body.data).to.be.true
 					expect(body.session.login).to.be.undefined
 					done()
 				)
diff --git a/tests/lib.coffee b/tests/lib.coffee
index 411ae58..aac79cf 100644
--- a/tests/lib.coffee
+++ b/tests/lib.coffee
@@ -3,12 +3,17 @@ request = require('request')
 
 config = require('./config')
 
-module.exports.login = (call)->
+module.exports.login = (args,args2)->
 	j = request.jar()
-	request({method: 'POST',uri: config.ADDRESS+"/login",json:{
-			username: config.testdata.username,
-			password: config.testdata.password
-		},jar:j},(err,res,body)->
+	login = {
+		username: config.testdata.username,
+		password: config.testdata.password
+	}
+	call = args
+	if args2
+		login = args
+		call = args2
+	request({method: 'POST',uri: config.ADDRESS+"/login",json:login,jar:j},(err,res,body)->
 		expect(err).to.be.null
 		expect(res.statusCode).to.be.equal(200)
 		expect(body.data).to.be.true