diff --git a/TODO-2.0.md b/TODO-2.0.md
index c0007e980..ad0e6fc73 100644
--- a/TODO-2.0.md
+++ b/TODO-2.0.md
@@ -1,3 +1,4 @@
+* Calendar in notifications explorer
 * login history
 * Test for Zero
 * updateStatus( Main, SOAP server )
diff --git a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Notifications.pm b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Notifications.pm
index ad1eea420..60809a8dc 100644
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Notifications.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Notifications.pm
@@ -3,7 +3,7 @@ package Lemonldap::NG::Manager::Notifications;
 use 5.10.0;
 use utf8;
 use Mouse;
-use JSON qw(to_json);
+use JSON qw(from_json to_json);
 
 use Lemonldap::NG::Common::Conf::Constants;
 use Lemonldap::NG::Common::PSGI::Constants;
diff --git a/lemonldap-ng-portal/MANIFEST b/lemonldap-ng-portal/MANIFEST
index 846019345..938ce101e 100644
--- a/lemonldap-ng-portal/MANIFEST
+++ b/lemonldap-ng-portal/MANIFEST
@@ -269,8 +269,8 @@ site/templates/common/mail_header.tpl
 site/templates/common/mail_password.tpl
 site/templates/common/mail_register_confirm.tpl
 site/templates/common/mail_register_done.tpl
-site/templates/common/notification.tpl
 site/templates/common/notification.xsl
+site/templates/common/notifinclude.tpl
 site/templates/common/oidc_checksession.tpl
 site/templates/common/redirect.tpl
 site/templates/common/script.tpl
@@ -362,6 +362,8 @@ t/34-Auth-Proxy-and-SOAP-Server.t
 t/35-REST-sessions-with-REST-server.t
 t/35-SOAP-sessions-with-SOAP-server.t
 t/40-Notifications-JSON-DBI.t
+t/40-Notifications-JSON-File-with-token.t
+t/40-Notifications-JSON-File.t
 t/40-Notifications-XML-DBI.t
 t/40-Notifications-XML-File.t
 t/41-Captcha.t
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/Notifications/JSON.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/Notifications/JSON.pm
index 5de7dc31e..e52458437 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/Notifications/JSON.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/Notifications/JSON.pm
@@ -118,6 +118,7 @@ sub getNotifBack {
             my $file       = $notifs->{$fileName};
             my $fileResult = 1;
             my $json       = from_json($file);
+            $json = [$json] unless ( ref $json eq 'ARRAY' );
 
             # Get pending notifications and verify that they have been accepted
             foreach my $notif (@$json) {
diff --git a/lemonldap-ng-portal/site/templates/bootstrap/notification.tpl b/lemonldap-ng-portal/site/templates/bootstrap/notification.tpl
index 28328d116..7a0edb1d6 100644
--- a/lemonldap-ng-portal/site/templates/bootstrap/notification.tpl
+++ b/lemonldap-ng-portal/site/templates/bootstrap/notification.tpl
@@ -2,7 +2,7 @@
 
 <div id="notifcontent" class="container">
   
-  <form action="#" method="post" class="notif" role="form">
+  <form action="/notifback" method="post" class="notif" role="form">
     <TMPL_VAR NAME="HIDDEN_INPUTS">
     <TMPL_IF NAME="CHOICE_VALUE">
       <input type="hidden" id="authKey" name="<TMPL_VAR NAME="CHOICE_PARAM">" value="<TMPL_VAR NAME="CHOICE_VALUE">" />
diff --git a/lemonldap-ng-portal/site/templates/common/notifinclude.tpl b/lemonldap-ng-portal/site/templates/common/notifinclude.tpl
index 6442512ca..1a1d3ffad 100644
--- a/lemonldap-ng-portal/site/templates/common/notifinclude.tpl
+++ b/lemonldap-ng-portal/site/templates/common/notifinclude.tpl
@@ -1,13 +1,13 @@
 <TMPL_LOOP NAME="notifications">
 <input type="hidden" name="reference<TMPL_VAR NAME="id">" value="<TMPL_VAR NAME="reference">">
 <TMPL_IF NAME="title">
-<h2 class="notifText">Test title</h2>
+<h2 class="notifText"><TMPL_VAR NAME="title"></h2>
 </TMPL_IF>
 <TMPL_IF NAME="subtitle">
-<h3 class="notifText">Test subtitle</h3>
+<h3 class="notifText"><TMPL_VAR NAME="subtitle"></h3>
 </TMPL_IF>
 <TMPL_IF NAME="text">
-<p class="notifText">This is a test text</p>
+<p class="notifText"><TMPL_VAR NAME="text"></p>
 </TMPL_IF>
 <TMPL_LOOP NAME="check">
 <p class="notifCheck"><label for="check<TMPL_VAR NAME="id">"><input type="checkbox" name="check<TMPL_VAR NAME="id">" id="<TMPL_VAR NAME="id">" value="accepted"><TMPL_VAR NAME="value"></label></p>
diff --git a/lemonldap-ng-portal/site/templates/impact/notification.tpl b/lemonldap-ng-portal/site/templates/impact/notification.tpl
index 778044fe5..875ebba8b 100644
--- a/lemonldap-ng-portal/site/templates/impact/notification.tpl
+++ b/lemonldap-ng-portal/site/templates/impact/notification.tpl
@@ -8,7 +8,7 @@
       </div>
       <hr class="solid" />
       <p class="text-error"><span trspan="newMessages">New message(s)</span></p>
-      <form action="#" method="post" class="login">
+      <form action="/notifback" method="post" class="login">
       <TMPL_VAR NAME="HIDDEN_INPUTS">
       <TMPL_IF NAME="CHOICE_VALUE">
       <input type="hidden" id="authKey" name="<TMPL_VAR NAME="CHOICE_PARAM">" value="<TMPL_VAR NAME="CHOICE_VALUE">" />
diff --git a/lemonldap-ng-portal/site/templates/pastel/notification.tpl b/lemonldap-ng-portal/site/templates/pastel/notification.tpl
index 6d325e8e3..ab7abac73 100644
--- a/lemonldap-ng-portal/site/templates/pastel/notification.tpl
+++ b/lemonldap-ng-portal/site/templates/pastel/notification.tpl
@@ -8,7 +8,7 @@
 
   <div class="loginlogo"></div>
 
-  <form action="#" method="post" class="login">
+  <form action="/notifback" method="post" class="login">
     <TMPL_VAR NAME="HIDDEN_INPUTS">
     <TMPL_IF NAME="CHOICE_VALUE">
       <input type="hidden" id="authKey" name="<TMPL_VAR NAME="CHOICE_PARAM">" value="<TMPL_VAR NAME="CHOICE_VALUE">" />
diff --git a/lemonldap-ng-portal/t/40-Notifications-JSON-DBI.t b/lemonldap-ng-portal/t/40-Notifications-JSON-DBI.t
index 691adf103..ae2ce7617 100644
--- a/lemonldap-ng-portal/t/40-Notifications-JSON-DBI.t
+++ b/lemonldap-ng-portal/t/40-Notifications-JSON-DBI.t
@@ -66,6 +66,7 @@ q{INSERT INTO notifications VALUES ('dwho','testref','2016-05-30 00:00:00',?,nul
     expectOK($res);
     my $id = expectCookie($res);
     ok($res->[2]->[0] =~ /1x1x1/,' Found ref');
+    expectForm( $res, undef, '/notifback', 'reference1x1', 'url' );
 
     # Verify that cookie is ciphered (session unvalid)
     ok(
diff --git a/lemonldap-ng-portal/t/40-Notifications-JSON-File-with-token.t b/lemonldap-ng-portal/t/40-Notifications-JSON-File-with-token.t
new file mode 100644
index 000000000..8a6bfe58c
--- /dev/null
+++ b/lemonldap-ng-portal/t/40-Notifications-JSON-File-with-token.t
@@ -0,0 +1,116 @@
+use Test::More;
+use strict;
+use IO::String;
+
+require 't/test-lib.pm';
+
+my $res;
+my $file = 't/20160530_dwho_dGVzdHJlZg==.json';
+
+open F, "> $file" or die($!);
+print F '[
+{
+  "uid": "dwho",
+  "date": "2016-05-30",
+  "reference": "testref",
+  "title": "Test title",
+  "subtitle": "Test subtitle",
+  "text": "This is a test text",
+  "check": ["Accept test"]
+}
+]';
+close F;
+
+my $client = LLNG::Manager::Test->new(
+    {
+        ini => {
+            logLevel                   => 'error',
+            useSafeJail                => 1,
+            notification               => 1,
+            templatesDir               => 'site/templates/',
+            notificationStorage        => 'File',
+            notificationStorageOptions => {
+                dirName => 't'
+            },
+            oldNotifFormat => 0,
+            requireToken   => 1,
+        }
+    }
+);
+
+# Try yo authenticate
+# -------------------
+ok( $res = $client->_get( '/', accept => 'text/html' ), 'Unauth request' );
+count(1);
+
+my ( $host, $url, $query ) = expectForm( $res, '#', undef, 'token' );
+$query =~
+s/.*\b(token=[^&]+).*/$1&user=dwho&password=dwho&url=aHR0cDovL3Rlc3QxLmV4YW1wbGUuY29tLw==/;
+
+ok(
+    $res = $client->_post(
+        '/',
+        IO::String->new($query),
+        accept => 'text/html',
+        length => length($query),
+    ),
+    'Auth query'
+);
+count(1);
+expectOK($res);
+my $id = expectCookie($res);
+expectForm( $res, undef, '/notifback', 'reference1x1', 'url' );
+
+# Verify that cookie is ciphered (session unvalid)
+ok(
+    $res = $client->_get(
+        '/',
+        query  => 'url=aHR0cDovL3Rlc3QxLmV4YW1wbGUuY29tLw==',
+        cookie => "lemonldap=$id",
+    ),
+    'Test cookie received'
+);
+count(1);
+expectReject($res);
+
+# Try to validate notification without accepting it
+my $str = 'reference1x1=testref&url=aHR0cDovL3Rlc3QxLmV4YW1wbGUuY29tLw==';
+ok(
+    $res = $client->_post(
+        '/notifback',
+        IO::String->new($str),
+        cookie => "lemonldap=$id",
+        accept => 'text/html',
+        length => length($str),
+    ),
+    "Don't accept notification"
+);
+ok( $res->[0] == 200, "Don't receive redirection" )
+  or explain( [ $res->[0], $res->[1] ], 200 );
+count(2);
+
+# Try to validate notification
+$str =
+'reference1x1=testref&check1x1x1=accepted&url=aHR0cDovL3Rlc3QxLmV4YW1wbGUuY29tLw==';
+ok(
+    $res = $client->_post(
+        '/notifback',
+        IO::String->new($str),
+        cookie => "lemonldap=$id",
+        accept => 'text/html',
+        length => length($str),
+    ),
+    "Accept notification"
+);
+expectRedirection( $res, qr/./ );
+$file =~ s/json$/done/;
+ok( -e $file, 'Notification was deleted' );
+count(2);
+
+#print STDERR Dumper($res);
+
+clean_sessions();
+
+unlink $file;
+
+done_testing( count() );
diff --git a/lemonldap-ng-portal/t/40-Notifications-JSON-File.t b/lemonldap-ng-portal/t/40-Notifications-JSON-File.t
index 04a98bc3d..50563ed76 100644
--- a/lemonldap-ng-portal/t/40-Notifications-JSON-File.t
+++ b/lemonldap-ng-portal/t/40-Notifications-JSON-File.t
@@ -52,6 +52,7 @@ ok(
 count(1);
 expectOK($res);
 my $id = expectCookie($res);
+expectForm( $res, undef, '/notifback', 'reference1x1', 'url' );
 
 # Verify that cookie is ciphered (session unvalid)
 ok(
diff --git a/lemonldap-ng-portal/t/40-Notifications-XML-DBI.t b/lemonldap-ng-portal/t/40-Notifications-XML-DBI.t
index 9e299723d..50fcf6051 100644
--- a/lemonldap-ng-portal/t/40-Notifications-XML-DBI.t
+++ b/lemonldap-ng-portal/t/40-Notifications-XML-DBI.t
@@ -4,7 +4,7 @@ use IO::String;
 
 my $res;
 my $file      = 't/notifications.db';
-my $mainTests = 5;
+my $mainTests = 6;
 eval { unlink $file };
 require 't/test-lib.pm';
 
@@ -59,6 +59,8 @@ qq{INSERT INTO notifications VALUES ('dwho','testref','2016-05-30 00:00:00','<?x
     );
     expectOK($res);
     my $id = expectCookie($res);
+    ok($res->[2]->[0] =~ /1x1x1/,' Found ref');
+    expectForm( $res, undef, '/notifback', 'reference1x1', 'url' );
 
     # Verify that cookie is ciphered (session unvalid)
     ok(
diff --git a/lemonldap-ng-portal/t/40-Notifications-XML-File.t b/lemonldap-ng-portal/t/40-Notifications-XML-File.t
index 9e76aaa47..5c09c0928 100644
--- a/lemonldap-ng-portal/t/40-Notifications-XML-File.t
+++ b/lemonldap-ng-portal/t/40-Notifications-XML-File.t
@@ -48,6 +48,7 @@ ok(
 count(1);
 expectOK($res);
 my $id = expectCookie($res);
+expectForm( $res, undef, '/notifback', 'reference1x1', 'url' );
 
 # Verify that cookie is ciphered (session unvalid)
 ok(
diff --git a/lemonldap-ng-portal/t/41-Token.t b/lemonldap-ng-portal/t/41-Token.t
index 414d48da5..47e261f53 100644
--- a/lemonldap-ng-portal/t/41-Token.t
+++ b/lemonldap-ng-portal/t/41-Token.t
@@ -18,10 +18,6 @@ my $client = LLNG::Manager::Test->new(
 
 # Test normal first access
 # ------------------------
-ok( $res = $client->_get('/'), 'Unauth JSON request' );
-count(1);
-expectReject($res);
-
 ok( $res = $client->_get( '/', accept => 'text/html' ), 'Unauth request' );
 count(1);
 
diff --git a/lemonldap-ng-portal/t/test-lib.pm b/lemonldap-ng-portal/t/test-lib.pm
index 798af9de4..a34afc84e 100644
--- a/lemonldap-ng-portal/t/test-lib.pm
+++ b/lemonldap-ng-portal/t/test-lib.pm
@@ -79,7 +79,7 @@ sub expectForm {
     if (
         ok(
             $res->[2]->[0] =~
-m@<form.+?action="(?:http://([^/]+)(/.*?)?|(#))".+method="(post|get)"@is,
+m@<form.+?action="(?:(?:http://([^/]+))?(/.*?)?|(#))".+method="(post|get)"@is,
             ' Page contains a form'
         )
       )