diff --git a/mailadmin/permissions.py b/mailadmin/permissions.py
index 0ad7da1..d881d94 100644
--- a/mailadmin/permissions.py
+++ b/mailadmin/permissions.py
@@ -1,44 +1,37 @@
 from rest_framework import permissions
-from mailadmin.models import OrgUnit
 import re
 
 from mailadmin.serializers import AliasSerializer
 
 
 class SourcePrefixOwner(permissions.BasePermission):
-    # Ref: http://www.django-rest-framework.org/api-guide/permissions
-    # TODO have no idea if this works
+    """ Ref: http://www.django-rest-framework.org/api-guide/permissions """
+
     def has_permission(self, request, view):
+        assert hasattr(view, 'get_user_prefixes')
+
         # Read permissions (GET, HEAD or OPTIONS) are allowed for all authenticated request
-        if request.method in permissions.SAFE_METHODS and request.user and request.user.is_authenticated():
+        if request.method in permissions.SAFE_METHODS or request.method not in ['DELETE', 'POST']:
             return True
 
-        # TODO test handling the DELETE requests
         if request.user.is_superuser:
             return True
 
-        if request.method in ['DELETE', 'POST']:
-            print view
-            print view.kwargs
-            forwarder = view.kwargs['forwarder']  # TODO you are here
-            invalid_forwarder = {'error': 'Invalid forwarder: {0}'.format(forwarder)}
-            if '=' not in forwarder:
-                return True
+        serializer = AliasSerializer(data=request.data, many=True)
 
-            fwd_data = forwarder.split("=")
-            fw = AliasSerializer(data={'dest': fwd_data[0], 'forward': fwd_data[1]})
-        else:
-            fw = AliasSerializer(data=request.DATA)
-
-        if not fw.is_valid():
+        if not serializer.is_valid():
             return True  # Skip auth if not valid data
 
-        my_groups = request.user.groups.all()
-        # Look for mailinglist prefixes
-        my_prefixes = OrgUnit.objects.filter(admin_groups__in=my_groups).distinct().exclude(prefix__isnull=True).exclude(is_active=False).values_list('prefix', flat=True)
+        my_prefixes = view.get_user_prefixes(request)
         if len(my_prefixes) == 0:
             return False
+
         # Prepare regular expression
-        regexp = '|'.join(['^{0}-'.format(p) for p in my_prefixes])
-        # The destination should have at least one match with the prefix regexp
-        return re.search(regexp, fw.data['dest']) is not None
\ No newline at end of file
+        regexp = '|'.join(['^{0}-|^{0}@'.format(p) for p in my_prefixes])
+        # All source-adresses should match the prefix regexp
+        for alias in serializer.initial_data:
+            print alias, re.search(regexp, alias.get('source', ''))
+            if re.search(regexp, alias.get('source', '')) is None:
+                return False
+
+        return True
\ No newline at end of file
diff --git a/mailadmin/views.py b/mailadmin/views.py
index e9b744b..101c752 100644
--- a/mailadmin/views.py
+++ b/mailadmin/views.py
@@ -5,7 +5,6 @@ from django.contrib.auth.forms import AuthenticationForm
 from django.contrib.auth.models import User
 from django.shortcuts import render, redirect
 import logging
-from requests import exceptions
 from rest_framework import viewsets, views
 from rest_framework.decorators import api_view
 from rest_framework.permissions import IsAuthenticated
@@ -50,9 +49,9 @@ def logout(request):
 class AliasesView(views.APIView):
     """ List, create and delete aliases from django-postfix-dovecot-api """
     _api = DjangoPostfixDovecotAPI()
-    permission_classes = (SourcePrefixOwner,)
+    permission_classes = (IsAuthenticated, SourcePrefixOwner,)
 
-    def get(self, request):
+    def get_groups(self, request):
         group_filter = request.QUERY_PARAMS.get('groups', None)
         if group_filter is None:
             my_groups = request.user.groups.all()
@@ -64,13 +63,24 @@ class AliasesView(views.APIView):
                 group_filter = [group_filter]
             my_groups = request.user.groups.filter(pk__in=group_filter)
 
+        return my_groups
+
+    def get_user_prefixes(self, request):
+        my_groups = self.get_groups(request)
+
         # Look for mailinglist prefixes
         orgunits = OrgUnit.objects.exclude(prefix__isnull=True).exclude(is_active=False).distinct()
         if not request.user.is_superuser:
             orgunits = orgunits.filter(admin_groups__in=my_groups)
-
         my_prefixes = orgunits.values_list('prefix', flat=True)
+
+        return my_prefixes
+
+    def get(self, request):
+        my_prefixes = self.get_user_prefixes(request)
+
         # Prepare regular expression
+        # FIXME: Move to method on orgunit manager
         regexp = '|'.join(['^{0}-|^{0}@'.format(p) for p in my_prefixes])
         if len(my_prefixes) == 0:
             return Response({'result': 'No results'})  # Need at least one