diff --git a/data/Dockerfiles/sogo/bootstrap-sogo.sh b/data/Dockerfiles/sogo/bootstrap-sogo.sh
index 51e1eea3..5290f9dc 100755
--- a/data/Dockerfiles/sogo/bootstrap-sogo.sh
+++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh
@@ -83,19 +83,16 @@ EOF
 done
 
 
-mkdir -p /var/lib/sogo/GNUstep/Defaults/
-
-# Force-remove lines from sogo.conf
-sed -i '/SOGoIMAPServer/d' /etc/sogo/sogo.conf
-
 if [[ "${ALLOW_ADMIN_EMAIL_LOGIN}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
   TRUST_PROXY="YES"
 else
   TRUST_PROXY="NO"
 fi
-RAND_PASS=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 24 | head -n 1)
+# cat /dev/urandom seems to hang here occasionally and is not recommended anyway, better use openssl
+RAND_PASS=$(openssl rand -base64 16 | tr -dc _A-Z-a-z-0-9)
 
 # Generate plist header with timezone data
+mkdir -p /var/lib/sogo/GNUstep/Defaults/
 cat <<EOF > /var/lib/sogo/GNUstep/Defaults/sogod.plist
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//GNUstep//DTD plist 0.9//EN" "http://www.gnustep.org/plist-0_9.xml">
diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php
index d9c10557..b08ca4e7 100644
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -1,30 +1,5 @@
 <?php
 
-/**
-* currently disabled: we could add auth_request to ningx sogo_eas.template
-* but this seems to be not required with the postfix allow_real_nets option
-*/
-/*
-if (substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 28) === "/Microsoft-Server-ActiveSync") {
-  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-
-  $server=print_r($_SERVER, true);
-  $username = $_SERVER['PHP_AUTH_USER'];
-  $password = $_SERVER['PHP_AUTH_PW'];
-  $login_check = check_login($username, $password);
-  if ($login_check !== 'user') {
-      header('HTTP/1.0 401 Unauthorized');
-      echo 'Invalid login';
-      exit;
-  } else {
-      echo 'Login OK';
-      exit;
-  }
-} else {
-  // other code
-}
-*/
-
 $ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
   "/^([yY][eE][sS]|[yY])+$/",
   $_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
@@ -34,28 +9,34 @@ $session_var_user = 'sogo-sso-user';
 $session_var_pass = 'sogo-sso-pass';
 
 if (!$ALLOW_ADMIN_EMAIL_LOGIN) {
-  header("Location: /");
+  header('HTTP/1.0 401 Forbidden');
+  echo "this feature is disabled";
   exit;
 }
 elseif (isset($_GET['login'])) {
+  // load prerequisites only when required
   require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
+  // check permissions
   if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['acl']['login_as'] == "1") {
     $login = html_entity_decode(rawurldecode($_GET["login"]));
     if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
       if (!empty(mailbox('get', 'mailbox_details', $login))) {
+        // load master password
         $sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
+        // register username and password in session
         $_SESSION[$session_var_user] = $login;
         $_SESSION[$session_var_pass] = $sogo_sso_pass;
+        // redirect to sogo (sogo will get the correct credentials via nginx auth_request
         header("Location: /SOGo/");
         exit;
       }
     }
   }
-  header("Location: /");
+  header('HTTP/1.0 401 Forbidden');
   exit;
 }
 else {
-  // this is an nginx auth_request call, we check for an existing sogo-sso-user session variable
+  // this is an nginx auth_request call, we check for existing sogo-sso session variables
   session_start();
   if (isset($_SESSION[$session_var_user]) && filter_var($_SESSION[$session_var_user], FILTER_VALIDATE_EMAIL)) {
       $username = $_SESSION[$session_var_user];