diff --git a/browser/concept.py b/browser/concept.py
index c94dce3..b550830 100644
--- a/browser/concept.py
+++ b/browser/concept.py
@@ -1,5 +1,5 @@
 #
-#  Copyright (c) 2012 Helmut Merz helmutm@cy55.de
+#  Copyright (c) 2013 Helmut Merz helmutm@cy55.de
 #
 #  This program is free software; you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -50,6 +50,7 @@ from cybertools.meta.interfaces import IOptions
 from cybertools.typology.interfaces import IType, ITypeManager
 from cybertools.util.jeep import Jeep
 from loops.browser.common import EditForm, BaseView, LoopsTerms, concept_macros
+from loops.browser.common import ViewMode
 from loops.common import adapted
 from loops.concept import Concept, ConceptTypeSourceList, PredicateSourceList
 from loops.i18n.browser import I18NView
@@ -746,3 +747,30 @@ class ListTypeInstances(ListChildren):
                                     noDuplicates, useFilter, [self.typePredicate]):
                 yield c
 
+
+class TabbedPage(ConceptView):
+
+    @Lazy
+    def subpagePredicates(self):
+        pred = self.conceptManager.get('issubpage')
+        if pred is None:
+            pred = self.isPartOfPredicate
+        return [pred]
+
+    def viewModes(self):
+        modes = Jeep()
+        for s in self.getSiblings(self.subpagePredicates):
+            url = self.nodeView.getUrlForTarget(s)
+            modes.append(ViewMode(getName(s), s.title, url))
+        if not modes:
+            return modes
+        modes[getName(self.context)].active = True
+        return modes
+
+    def getSiblings(self, preds):
+        for p in self.context.getParents(preds):
+            parent = p
+            break
+        else:
+            return []
+        return p.getChildren(preds)
diff --git a/browser/configure.zcml b/browser/configure.zcml
index 97782d8..37f0542 100644
--- a/browser/configure.zcml
+++ b/browser/configure.zcml
@@ -553,6 +553,14 @@
       factory="loops.browser.concept.ListTypeInstances"
       permission="zope.View" />
 
+  <zope:adapter
+      name="tabbed_page.html"
+      for="loops.interfaces.IConcept
+           zope.publisher.interfaces.browser.IBrowserRequest"
+      provides="zope.interface.Interface"
+      factory="loops.browser.concept.TabbedPage"
+      permission="zope.View" />
+
   <!-- dialogs/forms (end-user views) -->
 
   <page
diff --git a/browser/lobo/standard.pt b/browser/lobo/standard.pt
index 9148b61..34a015e 100644
--- a/browser/lobo/standard.pt
+++ b/browser/lobo/standard.pt
@@ -117,6 +117,7 @@
   <tal:img condition="cell/img">
     <a dojoType="dojox.image.Lightbox" group="mediasset"
        i18n:attributes="title"
+       tal:omit-tag="python:part.imageSize in ('large',)"
        tal:attributes="href cell/img/fullImageUrl;
                        title python: cell.img['description'] or cell.img['title']">
       <img tal:condition="showImageLink|python:False"
diff --git a/browser/loops.js b/browser/loops.js
index 5072186..7da13e2 100644
--- a/browser/loops.js
+++ b/browser/loops.js
@@ -1,4 +1,4 @@
-/* $Id$ */
+/* loops.js */
 
 function openEditWindow(url) {
     zmi = window.open(url, 'zmi');
@@ -19,6 +19,12 @@ function toggleCheckBoxes(toggle, fieldName) {
     for (i in w) w[i].checked=toggle.checked;
 }
 
+function setRadioButtons(value) {
+    dojo.forEach(dojo.query('input[type="radio"][value="' + value + '"]'), 
+                        function(n) {
+                            n.checked = true;})
+}
+
 function validate(nodeName, required) {
     // (work in progress) - may be used for onBlur event handler
     var w = dojo.byId(nodeName);
diff --git a/browser/node.py b/browser/node.py
index 5bed9b3..8302c3d 100644
--- a/browser/node.py
+++ b/browser/node.py
@@ -195,9 +195,12 @@ class NodeView(BaseView):
             cm.register('portlet_left', 'calendar', title=_(u'Calendar'),
                         subMacro=calendar_macros.macros['main'],
                         priority=90)
-        if self.setupTarget:
-            # force early portlet registrations by target
-            self.virtualTarget
+        # force early portlet registrations by target by setting up target view
+        if self.virtualTarget is not None:
+            std = self.virtualTarget.typeOptions('portlet_states')
+            if std:
+                from loops.organize.stateful.browser import registerStatesPortlet
+                registerStatesPortlet(self.controller, self.virtualTarget, std)
 
     @Lazy
     def usersPresent(self):
diff --git a/knowledge/survey/browser.py b/knowledge/survey/browser.py
index 6b6c767..99eac6d 100644
--- a/knowledge/survey/browser.py
+++ b/knowledge/survey/browser.py
@@ -42,14 +42,19 @@ template = ViewPageTemplateFile('view_macros.pt')
 
 class SurveyView(ConceptView):
 
-    tabview = 'index.html'
     data = None
     errors = None
 
     @Lazy
     def macro(self):
+        self.registerDojo()
         return template.macros['survey']
 
+    @Lazy
+    def tabview(self):
+        if self.editable:
+            return 'index.html'
+
     def results(self):
         result = []
         response = None
diff --git a/knowledge/survey/response.py b/knowledge/survey/response.py
index b27979e..3841c4f 100644
--- a/knowledge/survey/response.py
+++ b/knowledge/survey/response.py
@@ -39,10 +39,9 @@ class Responses(BaseRecordManager):
         self.context = context
 
     def save(self, data):
-        if not self.personId:
-            return
-        self.storage.saveUserTrack(self.uid, 0, self.personId, data, 
-                                    update=True, overwrite=True)
+        if self.personId:
+            self.storage.saveUserTrack(self.uid, 0, self.personId, data, 
+                                        update=True, overwrite=True)
 
     def load(self):
         if self.personId:
diff --git a/knowledge/survey/view_macros.pt b/knowledge/survey/view_macros.pt
index 49731dc..51c2c6a 100644
--- a/knowledge/survey/view_macros.pt
+++ b/knowledge/survey/view_macros.pt
@@ -85,6 +85,9 @@
       </table>
       <input type="submit" name="submit" value="Evaluate Questionnaire"
              i18n:attributes="value" />
+      <input type="button" name="reset_responses" value="Reset Responses Entered"
+             i18n:attributes="value"
+             onclick="setRadioButtons('none'); return false" />
     </form>
   </div>
 </metal:block>
diff --git a/layout/base.py b/layout/base.py
index 8a0e6eb..9cae325 100644
--- a/layout/base.py
+++ b/layout/base.py
@@ -158,4 +158,5 @@ class TargetLayoutInstance(NodeLayoutInstance):
         target = self.viewAnnotations.get('target')
         if target is None:
             target = adapted(self.context.target)
+            #self.viewAnnotations['target'] = target    # TODO: has to be tested!
         return target
diff --git a/locales/de/LC_MESSAGES/loops.mo b/locales/de/LC_MESSAGES/loops.mo
index 2029589..45b1e4c 100644
Binary files a/locales/de/LC_MESSAGES/loops.mo and b/locales/de/LC_MESSAGES/loops.mo differ
diff --git a/locales/de/LC_MESSAGES/loops.po b/locales/de/LC_MESSAGES/loops.po
index bea0e51..ca2a770 100644
--- a/locales/de/LC_MESSAGES/loops.po
+++ b/locales/de/LC_MESSAGES/loops.po
@@ -3,7 +3,7 @@ msgstr ""
 
 "Project-Id-Version: 0.13.0\n"
 "POT-Creation-Date: 2007-05-22 12:00 CET\n"
-"PO-Revision-Date: 2013-04-01 12:00 CET\n"
+"PO-Revision-Date: 2013-04-06 12:00 CET\n"
 "Last-Translator: Helmut Merz <helmutm@cy55.de>\n"
 "Language-Team: loops developers <helmutm@cy55.de>\n"
 "MIME-Version: 1.0\n"
@@ -241,6 +241,9 @@ msgstr "Trifft für unser Unternehmen voll und ganz zu"
 msgid "Evaluate Questionnaire"
 msgstr "Fragebogen auswerten"
 
+msgid "Reset Responses Entered"
+msgstr "Eingaben zurücksetzen"
+
 msgid "Back to Questionnaire"
 msgstr "Zurück zum Fragebogen"
 
diff --git a/organize/browser/configure.zcml b/organize/browser/configure.zcml
index 91d40f1..e351efa 100644
--- a/organize/browser/configure.zcml
+++ b/organize/browser/configure.zcml
@@ -27,6 +27,18 @@
       class="loops.organize.browser.member.MemberRegistration"
       permission="zope.View" />
 
+  <browser:page
+      for="loops.interfaces.INode"
+      name="selfservice_registration.html"
+      class="loops.organize.browser.member.SecureMemberRegistration"
+      permission="zope.View" />
+
+  <browser:page
+      for="loops.interfaces.INode"
+      name="selfservice_confirmation.html"
+      class="loops.organize.browser.member.ConfirmMemberRegistration"
+      permission="zope.View" />
+
   <browser:page
       for="loops.interfaces.INode"
       name="change_password.html"
diff --git a/organize/browser/member.py b/organize/browser/member.py
index 6baacf8..7b31e2f 100644
--- a/organize/browser/member.py
+++ b/organize/browser/member.py
@@ -1,5 +1,5 @@
 #
-#  Copyright (c) 2008 Helmut Merz helmutm@cy55.de
+#  Copyright (c) 2013 Helmut Merz helmutm@cy55.de
 #
 #  This program is free software; you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -19,8 +19,6 @@
 """
 Definition of view classes and other browser related stuff for
 members (persons).
-
-$Id$
 """
 
 from zope import interface, component
@@ -78,7 +76,7 @@ class PersonalInfo(ConceptView):
 
 class MemberRegistration(NodeView, CreateForm):
 
-    interface = IMemberRegistration
+    interface = IMemberRegistration     # TODO: add company, create institution
     message = _(u'The user account has been created.')
 
     formErrors = dict(
@@ -99,7 +97,7 @@ class MemberRegistration(NodeView, CreateForm):
 
     def checkPermissions(self):
         personType = adapted(self.conceptManager['person'])
-        perms = IOptions(personType)('registration.permission')
+        perms = IOptions(personType)(self.permissions_key)
         if perms:
             return checkPermission(perms[0], self.context)
         return checkPermission('loops.ManageSite', self.context)
@@ -114,7 +112,7 @@ class MemberRegistration(NodeView, CreateForm):
         schema.fields.remove('birthDate')
         schema.fields.reorder(-2, 'loginName')
         return schema
-
+    # TODO: add company, create institution
     @Lazy
     def object(self):
         return Person(Concept())
@@ -157,6 +155,31 @@ class MemberRegistration(NodeView, CreateForm):
         return False
 
 
+class SecureMemberRegistration(MemberRegistration):
+
+    permissions_key = u'secure_registration.permissions'
+    roles_key = u'secure_registration.roles'
+
+    @Lazy
+    def schema(self):
+        schema = super(MemberRegistration, self).schema
+        schema.fields.remove('birthDate')
+        schema.fields.remove('password')
+        schema.fields.remove('passwordConfirm')
+        schema.fields.remove('phoneNumbers')
+        schema.fields.reorder(-2, 'loginName')
+        return schema
+
+
+class ConfirmMemberRegistration(NodeView):
+
+    # TODO: control form via interface?
+
+    @Lazy
+    def macro(self):
+        return organize_macros.macros['confirm']
+
+
 class PasswordChange(NodeView, Form):
 
     interface = IPasswordChange
diff --git a/organize/browser/view_macros.pt b/organize/browser/view_macros.pt
index 9eb86b9..af8ea2b 100644
--- a/organize/browser/view_macros.pt
+++ b/organize/browser/view_macros.pt
@@ -1,5 +1,9 @@
 <html i18n:domain="loops">
 
+<metal:registration define-macro="confirm">
+</metal:registration>
+
+
 <metal:task define-macro="task">
   <metal:data use-macro="view/concept_macros/conceptdata">
   </metal:data>
diff --git a/organize/stateful/browser.py b/organize/stateful/browser.py
index 8dc1069..5b77b7d 100644
--- a/organize/stateful/browser.py
+++ b/organize/stateful/browser.py
@@ -43,6 +43,16 @@ statefulActions = ('classification_quality',
                    'publishable_task',)
 
 
+def registerStatesPortlet(controller, view, statesDefs,
+                          region='portlet_right', priority=98):
+    cm = controller.macros
+    stfs = [component.getAdapter(view.context, IStateful, name=std) 
+                for std in statesDefs]
+    cm.register(region, 'states', title=_(u'States'),
+                subMacro=template.macros['portlet_states'],
+                priority=priority, info=view, stfs=stfs)
+
+
 class StateAction(Action):
 
     url = None
diff --git a/organize/stateful/view_macros.pt b/organize/stateful/view_macros.pt
index 6dfad17..d1be431 100644
--- a/organize/stateful/view_macros.pt
+++ b/organize/stateful/view_macros.pt
@@ -68,4 +68,32 @@
 </metal:query>
 
 
+<!-- portlets -->
+
+<metal:actions define-macro="portlet_states">
+    <div tal:repeat="stf macro/stfs">
+      <div tal:condition="python:len(macro.stfs) > 1">
+        <span i18n:translate="">Workflow</span>
+        <span i18n:translate=""
+              tal:content="stf/statesDefinition" />
+      </div>
+      <div>
+        <b i18n:translate="">State</b>:
+        <span i18n:translate=""
+              tal:content="stf/state" />
+      </div>
+      <div>
+        <div><b i18n:translate="">Available Transitions</b>:</div>
+        <ul>
+          <li tal:repeat="action stf/getAvailableTransitionsForUser">
+            <a i18n:translate=""
+               tal:attributes="href string:change_state.html"
+               tal:content="action/title" />
+          </li>
+        </ul>
+      </div>
+    </div>
+</metal:actions>
+
+
 </html>
diff --git a/organize/tracking/base.py b/organize/tracking/base.py
index f8a1323..645e091 100644
--- a/organize/tracking/base.py
+++ b/organize/tracking/base.py
@@ -20,6 +20,7 @@
 Base class(es) for track/record managers.
 """
 
+from zope.app.security.interfaces import IUnauthenticatedPrincipal
 from zope.cachedescriptors.property import Lazy
 
 from cybertools.meta.interfaces import IOptions
@@ -65,6 +66,8 @@ class BaseRecordManager(object):
         else:
             principal = getPrincipalForUserId(userId, context=self.context)
         if principal is not None:
+            if IUnauthenticatedPrincipal.providedBy(principal):
+                return None
             person = getPersonForUser(self.context, principal=principal)
             if person is None:
                 return principal.id