diff --git a/test/integration/acl-tls-test.js b/test/integration/acl-tls-test.js
index c2103f669..4bd3c660f 100644
--- a/test/integration/acl-tls-test.js
+++ b/test/integration/acl-tls-test.js
@@ -19,9 +19,11 @@ var rm = require('../utils').rm
 var ldnode = require('../../index')
 var ns = require('solid-namespace')($rdf)
 
-var address = 'https://localhost:3456/test/'
-let rootPath = path.join(__dirname, '../resources')
-let configPath = path.join(rootPath, 'config')
+const port = 7777
+const serverUri = `https://localhost:7777`
+const rootPath = path.join(__dirname, '../resources/acl-tls')
+const dbPath = path.join(rootPath, 'db')
+const configPath = path.join(rootPath, 'config')
 
 var aclExtension = '.acl'
 var metaExtension = '.meta'
@@ -37,8 +39,9 @@ var globFile = testDir + '/*'
 var origin1 = 'http://example.org/'
 var origin2 = 'http://example.com/'
 
-var user1 = 'https://user1.databox.me/profile/card#me'
-var user2 = 'https://user2.databox.me/profile/card#me'
+var user1 = 'https://tim.localhost:7777/profile/card#me'
+var user2 = 'https://nicola.localhost:7777/profile/card#me'
+var address = 'https://tim.localhost:7777'
 var userCredentials = {
   user1: {
     cert: fs.readFileSync(path.join(__dirname, '../keys/user1-cert.pem')),
@@ -50,22 +53,38 @@ var userCredentials = {
   }
 }
 
-describe('ACL with WebID+TLS', function () {
+// TODO Remove skip. TLS is currently broken, but is not a priority to fix since
+// the current Solid spec does not require supporting webid-tls on the resource
+// server. The current spec only requires the resource server to support webid-oidc,
+// and it requires the IDP to support webid-tls as a log in method, so that users of
+// a webid-tls client certificate can still use their certificate (and not a
+// username/password pair or other login method) to "bridge" from webid-tls to
+// webid-oidc.
+describe.skip('ACL with WebID+TLS', function () {
   var ldpHttpsServer
-  var ldp = ldnode.createServer({
-    mount: '/test',
+  var serverConfig = {
     root: rootPath,
+    serverUri,
+    dbPath,
+    port,
     configPath,
     sslKey: path.join(__dirname, '../keys/key.pem'),
     sslCert: path.join(__dirname, '../keys/cert.pem'),
     webid: true,
-    strictOrigin: true,
+    multiuser: true,
     auth: 'tls',
-    rejectUnauthorized: false
-  })
+    rejectUnauthorized: false,
+    strictOrigin: true,
+    host: { serverUri }
+  }
+  var ldp = ldnode.createServer(serverConfig)
 
   before(function (done) {
-    ldpHttpsServer = ldp.listen(3456, done)
+    ldpHttpsServer = ldp.listen(port, () => {
+      setTimeout(() => {
+        done()
+      }, 0)
+    })
   })
 
   after(function () {
@@ -466,7 +485,7 @@ describe('ACL with WebID+TLS', function () {
   })
 
   describe('Read-only', function () {
-    var body = fs.readFileSync(path.join(__dirname, '../resources/acl-tls/read-acl/.acl'))
+    var body = fs.readFileSync(path.join(__dirname, '../resources/acl-tls/tim.localhost/read-acl/.acl'))
     it('user1 should be able to access ACL file', function (done) {
       var options = createOptions('/acl-tls/read-acl/.acl', 'user1')
       request.head(options, function (error, response, body) {
diff --git a/test/keys/user1-cert.pem b/test/keys/user1-cert.pem
index e161cb4ea..9d554e939 100644
--- a/test/keys/user1-cert.pem
+++ b/test/keys/user1-cert.pem
@@ -1,23 +1,23 @@
-Bag Attributes
-    friendlyName: user1 [on user1.databox.me]'s WebID ID
-    localKeyID: 4A 83 02 D8 45 D4 50 5C 29 45 D7 6E 75 41 5A 71 C2 D7 ED 1B 
-subject=/O=WebID/CN=user1 [on user1.databox.me]
-issuer=/O=WebID/CN=user1 [on user1.databox.me]
 -----BEGIN CERTIFICATE-----
-MIIC6TCCAlSgAwIBAgIBKjALBgkqhkiG9w0BAQswNjEOMAwGA1UEChMFV2ViSUQx
-JDAiBgNVBAMMG3VzZXIxIFtvbiB1c2VyMS5kYXRhYm94Lm1lXTAeFw0wMDAxMDEw
-MDAwMDBaFw00OTEyMzEyMzU5NTlaMDYxDjAMBgNVBAoTBVdlYklEMSQwIgYDVQQD
-DBt1c2VyMSBbb24gdXNlcjEuZGF0YWJveC5tZV0wggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQC9prgg9hPV1ICTDJpOphfO46KpDSnsE8L+JI2wp5nIxgAK
-WDGfOmjLfJN3JJk90G0Tr8FjrY230XBL8yW7JG9K94NhPzltcP3lbMPRub9CYPP+
-z8pMiJdwI3W4gIM9BTWP83p+/DIwL8xVreTGh8hd2BuWCOOBO35NrHRC0wf55GwS
-LF+PHHy5JCHJyIN6sDsoAqjgH1/cmH7VGyiJ8AdbZePavMQSmo/9aADPH2qC/se4
-tHp8NCww2ed9iZ5Eb+R1foK7SICZOZaOKZzIbWUsnIE9jDZDC/HTGjx04v69xm9n
-okAiNWOZ23NwYE6VJtKbypgEZ9Sw1pxW3FOMM2RbAgMBAAGjgYYwgYMwDAYDVR0T
-AQH/BAIwADAdBgNVHQ4EFgQUMIIBIjANBgkqhkiG9w0BAQEFAAMwHwYDVR0jBBgw
-FoAUMIIBIjANBgkqhkiG9w0BAQEFAAMwMwYDVR0RBCwwKoYoaHR0cHM6Ly91c2Vy
-MS5kYXRhYm94Lm1lL3Byb2ZpbGUvY2FyZCNtZTALBgkqhkiG9w0BAQsDgYEAPY/B
-4LdzOshkaVp9WVm53SEHq2pgXzlZQqTaFkXzGg9OkTA0yh/J0PQkYbs/a9xZOQj4
-Ki8VpoGoxAEtpf5IrchAKU+9i7EdC7eadfHwoo5FKt1XUX1r+71kvWmvABHCV4Nq
-RGPUoNEE9gJ1OJxx1mEI1+xTq05ZOm1NRSU2Sbs=
------END CERTIFICATE-----
+MIID0zCCArugAwIBAgIJAJIyT436cY6uMA0GCSqGSIb3DQEBBQUAMGAxIjAgBgNV
+BAMTGVdlYklEIGZvciBUaW0gQmVybmVycy1MZWUxOjA4BgoJkiaJk/IsZAEBFCpo
+dHRwczovL3RpbS5sb2NhbGhvc3Q6Nzc3Ny9wcm9maWxlL2NhcmQjbWUwHhcNMTkx
+MDI0MTgyMzUyWhcNMjkxMDIxMTgyMzUyWjBgMSIwIAYDVQQDExlXZWJJRCBmb3Ig
+VGltIEJlcm5lcnMtTGVlMTowOAYKCZImiZPyLGQBARQqaHR0cHM6Ly90aW0ubG9j
+YWxob3N0Ojc3NzcvcHJvZmlsZS9jYXJkI21lMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAtVinQ0UG3k3P0G/rQiH8hzTdpyeHePZXZHEx4fTXiIrPgDyY
+oLxzzzl3A6VQ+zCV0SQ17npauEGQzVXg+QhOwRUbH4rfOoT6CrYmcnhrmkiGAqfY
+HO2I5DsJAyiLtuTmMPBVkLgDuhs0eOR0jsjbBE1AJ809i4Nngu5vYSNhf3rZz/qU
+ZEvvWDnb50EQJrAGeWndNl/+EohENPKlpFmBedgttwJGc/skuNpAwBta+F03EdO8
+6V2Z+qDQKdyG1VvXVF5SVB9jPOXkWLQrTTyjcyyE8Sx62ZXxDlsYvQAGd27Iuw4E
+emmST8jxvjob8mC5Pb1KAhAK7EIbMIUAP456TwIDAQABo4GPMIGMMB0GA1UdDgQW
+BBSKeuVdr8beU5Y6NkeggCSCtlZZrDA4BgNVHREBAf8ELjAshipodHRwczovL3Rp
+bS5sb2NhbGhvc3Q6Nzc3Ny9wcm9maWxlL2NhcmQjbWUwCQYDVR0TBAIwADATBgNV
+HSUEDDAKBggrBgEFBQcDAjARBglghkgBhvhCAQEEBAMCB4AwDQYJKoZIhvcNAQEF
+BQADggEBACH7beIj0OFsq6FwkthagI53cxPhjIxFOYdy8G5mN/JcCyL0xemJm5Fz
+HEXKv/QhFdbX6NCCal/d+2r566fRf1C/8sY/Cx4yKqYaZ/ZZeH/q3IlfQSyEZEJy
+XLARCG9WzeXHJsL6u/lN/rcrI3ylUb9qAAzlNWyg3xtb58ieUSUjuO0fOfKMu+LJ
+VGPpMyhtjwBhelJ32l6ffHpnyzj6v14QxTEGWQpLvtX1iUDExNbHcm8khlbEgGzG
+Zyrojk0cHg3tH4nmBei7QvuLOiDaBs2N5ITTETwExiWD2CUPCiYO0DMr0oljN/nS
+KRRJsj1QOjM4/A46RjXWhmvx7RTXQdM=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/test/keys/user1-key.pem b/test/keys/user1-key.pem
index 602106134..221f1add9 100644
--- a/test/keys/user1-key.pem
+++ b/test/keys/user1-key.pem
@@ -1,27 +1,28 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAvaa4IPYT1dSAkwyaTqYXzuOiqQ0p7BPC/iSNsKeZyMYAClgx
-nzpoy3yTdySZPdBtE6/BY62Nt9FwS/MluyRvSveDYT85bXD95WzD0bm/QmDz/s/K
-TIiXcCN1uICDPQU1j/N6fvwyMC/MVa3kxofIXdgblgjjgTt+Tax0QtMH+eRsEixf
-jxx8uSQhyciDerA7KAKo4B9f3Jh+1RsoifAHW2Xj2rzEEpqP/WgAzx9qgv7HuLR6
-fDQsMNnnfYmeRG/kdX6Cu0iAmTmWjimcyG1lLJyBPYw2Qwvx0xo8dOL+vcZvZ6JA
-IjVjmdtzcGBOlSbSm8qYBGfUsNacVtxTjDNkWwIDAQABAoIBABMncnNJxykShEXV
-wQPufHsVvIjsXm6MdGYslO7hjoObk8d3rtNRF+JtW4tt89gtY8bYOmTx011cVsYk
-8YucG21r4CYDN66Y+duhB4n4A5wVpK74l4rxRLI7spkGybpw+z7lrVqD6CG7whxp
-KrDuZ8sql2ao0SltM81ufHN/Us/nGEIho8YUAh3/aIwqHPEb8OPmlbDcTJBwN0kh
-54YeGN/1QT81DXWomg2VR9KTzfy9Z0v7jl3phcAEvM6Kp2rvSKFWnw7DvB/+XTQf
-6ekN0elBF8aIp+5lC2Kpui+DqQjSFaMhkZnnX0Yd4OjX3RE8CzpYUa60lydZjZVd
-mszCKDkCgYEA9xiEfWIfcBSx5jt3+o+U4MHJCw5kF5i07E/4IetZ9mAHemr8UCmO
-uGRxgokFrOapXIMTY4wPKSIl5Jb9laDEfUZcQs4Fl0cs9aE21JN9QeeusRzOiTMo
-5MGOqDIqn6XUukDCVAQ0fQuY8uAEkFHLbq+MwMOsooiR2Ta9+XhfyrcCgYEAxHxF
-OSuQ3RHrTstvyAenmCIY6XQOsO8eVSpk8afsAYJYSwTWlrEUNRw310YnVT2FuW/r
-pPqXbiHAeNCFsT8LdCfGiEaS0kegXYg66ZX85wIiaXTEsnmNWjNr6K6iOi1xl92J
-OEqtCwI+rBX0tl6K1BvA/e2uoaoARMW5ZlLo330CgYBdVKNmgJODUC3J2ph8yZLg
-OhHn3S2tQ/7Ca4o7tZurVaY9dP+Mf8Xqm/XL6ll8bzt1OAUwyoxHayCI8QcjZzAQ
-aW0bxpmSBE5VEOmW7YaYSBxRxaG1bN97WCi8GwbCem6ZUzCTb2sr+B9zTW4r3NlM
-G368qKwiUBdWxjiHbBIyjQKBgDrK3IPAz3X22KwZH3eBItrYyQ+B1KuIwVDGgLH2
-hx3kfLrl1bf9gIhryyG1MivFXvAf1yjkes9PdiIwcvCYZrr48+TvCRu2pvuVudsP
-MD+HWfioIfstd+hXnqBfMNerpWPFvDuFzMWQhGRFpZW0MGJLc7IHnsts7OunJlTB
-1kCZAoGBAO1//QwkCvgnS5Na8zjBFa5K48llYC2eZ4L21/PI1DNXO5phvdy2r3rW
-h3LbL05PNFPIDX5JkGJslO7M3o/dbMMY9rKZ/EOsveYYD292oZVbUXFZkF9yQWkY
-8daXg7oMOkkKy7WzHI3fAxJVquaobdHyIImwpB1YUzyXpuaihecj
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC1WKdDRQbeTc/Q
+b+tCIfyHNN2nJ4d49ldkcTHh9NeIis+APJigvHPPOXcDpVD7MJXRJDXuelq4QZDN
+VeD5CE7BFRsfit86hPoKtiZyeGuaSIYCp9gc7YjkOwkDKIu25OYw8FWQuAO6GzR4
+5HSOyNsETUAnzT2Lg2eC7m9hI2F/etnP+pRkS+9YOdvnQRAmsAZ5ad02X/4SiEQ0
+8qWkWYF52C23AkZz+yS42kDAG1r4XTcR07zpXZn6oNAp3IbVW9dUXlJUH2M85eRY
+tCtNPKNzLITxLHrZlfEOWxi9AAZ3bsi7DgR6aZJPyPG+OhvyYLk9vUoCEArsQhsw
+hQA/jnpPAgMBAAECggEBAKEUhzYciTZLfa1SzHCoyau7jKseVJpgjk38sedYWV7C
+lf/9U0FrQ58tFwcY/+6vQFROSs1yx0RlkN6jSrtJ4tJlEfuZmiFb3tJG663AQyv/
+AXI4bqF7aJ35xk6U5E1n0wRjZk2u9jiIU7qSiuoNhWWzzKnOB7310aseabap+7+D
++/gTd4rrJUCM3K4BMCLmtGUKSh/F2EpIyGM2qQC7zhsvj/F1W3V6n2UhxyNs/2dn
+MS34ddmuYRTUt4qbOXeRt2duKFGHmlBhey0Q+/hdE74zV7n2Rq92UvSitP3me5al
+RPpgTZ4NFa4w0rshvzbWXKBJWRj2bBk5aumx9ZWlimECgYEA4NQ7MIVpsBGwFiss
+JqD4eBr+7lRRxe0+oUtYdHkoC5iGnRQACQyKjk7/5kZRWEvix9SsnhJ5YZ/GWpEl
+T8FR/tCjVyOMyuNfQJ2RQ/sPcVVUys4/CCTg4UROJygpP4fz46mHysL9mREA9rFK
+QWprKAZEBYi+Rv0Q9hJNRMaxDd8CgYEAzn0bVVSQ6pmqk+s1GRG62UHlXyDRn7kH
+0XvK/wQqO0A1QJzdKefXgZL6m+PI7wuYvrL9PzSYb8THwAnWWIKTqeK+T7Nb4Dzx
+MSgj2DNLzGpbXdC8TlNJRytAzoVN7dhiXuyfWWZjQRe8l1NMD9h1wIqROWG152GC
+xgA8MddAQZECgYBsPqIUtVbyF0IBGl4SZxPZt52fn2cTdSrfO0hmI2LdWl0NSXDO
+6oPXCj/4XUiSy05vSXymSly4XNWCCzm8kWXp2geaT5pcoGXe1T34TercdOnzDqOY
+RzEiI+HAxnw9gzYwGRIw0/qG9IHTQ/5tSlA3H/Ul+PUrdnHxF1SuVT8vXwKBgAQO
+4WKj7tUtf/S4QqrjdlCewutDsdr5v/WWAT9RzaKseF90tcQFEm8xfEtkBqbsC2x0
+CBYd6oEH1QUpLFVA+7XzBtp6I+wcRoE40LuHBo5V6MXHPGwtptsHNpbYd9ec0RIc
+hGU1Ze35kXNH587H6kiGcKQ4D2Mkv3U0u/oeyNyBAoGAfUJI8H63XOar6TXs0Ug4
+IW34WrdC8BM4cz342rXKusS6+o15wnI8kAyVkSEx54W/cK5QaIUIQNGia74UlGhq
+wqGyBxn3ahZPZhu0eOE2PHIDcxS+09d87bNjpUjMcysORJV2u9klyVMc5ornV6aO
+cpKHUgbAsaKX3NgPiLrgxFQ=
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/test/resources/acl-tls/config/templates/emails/delete-account.js b/test/resources/acl-tls/config/templates/emails/delete-account.js
new file mode 100644
index 000000000..9ef228651
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/emails/delete-account.js
@@ -0,0 +1,49 @@
+'use strict'
+
+/**
+ * Returns a partial Email object (minus the `to` and `from` properties),
+ * suitable for sending with Nodemailer.
+ *
+ * Used to send a Delete Account email, upon user request
+ *
+ * @param data {Object}
+ *
+ * @param data.deleteUrl {string}
+ * @param data.webId {string}
+ *
+ * @return {Object}
+ */
+function render (data) {
+  return {
+    subject: 'Delete Solid-account request',
+
+    /**
+     * Text version
+     */
+    text: `Hi,
+
+We received a request to delete your Solid account, ${data.webId}
+
+To delete your account, click on the following link:
+
+${data.deleteUrl}
+
+If you did not mean to delete your account, ignore this email.`,
+
+    /**
+     * HTML version
+     */
+    html: `<p>Hi,</p>
+
+<p>We received a request to delete your Solid account, ${data.webId}</p>
+
+<p>To delete your account, click on the following link:</p>
+
+<p><a href="${data.deleteUrl}">${data.deleteUrl}</a></p>
+
+<p>If you did not mean to delete your account, ignore this email.</p>
+`
+  }
+}
+
+module.exports.render = render
diff --git a/test/resources/acl-tls/config/templates/emails/invalid-username.js b/test/resources/acl-tls/config/templates/emails/invalid-username.js
new file mode 100644
index 000000000..8a7497fc5
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/emails/invalid-username.js
@@ -0,0 +1,30 @@
+module.exports.render = render
+
+function render (data) {
+  return {
+    subject: `Invalid username for account ${data.accountUri}`,
+
+    /**
+     * Text version
+     */
+    text: `Hi,
+
+We're sorry to inform you that the username for account ${data.accountUri} is not allowed after changes to username policy.
+
+This account has been set to be deleted at ${data.dateOfRemoval}.
+
+${data.supportEmail ? `Please contact ${data.supportEmail} if you want to move your account.` : ''}`,
+
+    /**
+     * HTML version
+     */
+    html: `<p>Hi,</p>
+
+<p>We're sorry to inform you that the username for account ${data.accountUri} is not allowed after changes to username policy.</p>
+
+<p>This account has been set to be deleted at ${data.dateOfRemoval}.</p>
+
+${data.supportEmail ? `<p>Please contact ${data.supportEmail} if you want to move your account.</p>` : ''}
+`
+  }
+}
diff --git a/test/resources/acl-tls/config/templates/emails/reset-password.js b/test/resources/acl-tls/config/templates/emails/reset-password.js
new file mode 100644
index 000000000..fb18972cc
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/emails/reset-password.js
@@ -0,0 +1,49 @@
+'use strict'
+
+/**
+ * Returns a partial Email object (minus the `to` and `from` properties),
+ * suitable for sending with Nodemailer.
+ *
+ * Used to send a Reset Password email, upon user request
+ *
+ * @param data {Object}
+ *
+ * @param data.resetUrl {string}
+ * @param data.webId {string}
+ *
+ * @return {Object}
+ */
+function render (data) {
+  return {
+    subject: 'Account password reset',
+
+    /**
+     * Text version
+     */
+    text: `Hi,
+
+We received a request to reset your password for your Solid account, ${data.webId}
+
+To reset your password, click on the following link:
+
+${data.resetUrl}
+
+If you did not mean to reset your password, ignore this email, your password will not change.`,
+
+    /**
+     * HTML version
+     */
+    html: `<p>Hi,</p>
+
+<p>We received a request to reset your password for your Solid account, ${data.webId}</p>
+
+<p>To reset your password, click on the following link:</p>
+
+<p><a href="${data.resetUrl}">${data.resetUrl}</a></p>
+
+<p>If you did not mean to reset your password, ignore this email, your password will not change.</p>
+`
+  }
+}
+
+module.exports.render = render
diff --git a/test/resources/acl-tls/config/templates/emails/welcome.js b/test/resources/acl-tls/config/templates/emails/welcome.js
new file mode 100644
index 000000000..bce554462
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/emails/welcome.js
@@ -0,0 +1,39 @@
+'use strict'
+
+/**
+ * Returns a partial Email object (minus the `to` and `from` properties),
+ * suitable for sending with Nodemailer.
+ *
+ * Used to send a Welcome email after a new user account has been created.
+ *
+ * @param data {Object}
+ *
+ * @param data.webid {string}
+ *
+ * @return {Object}
+ */
+function render (data) {
+  return {
+    subject: 'Welcome to Solid',
+
+    /**
+     * Text version of the Welcome email
+     */
+    text: `Welcome to Solid!
+
+Your account has been created.
+
+Your Web Id: ${data.webid}`,
+
+    /**
+     * HTML version of the Welcome email
+     */
+    html: `<p>Welcome to Solid!</p>
+
+<p>Your account has been created.</p>
+
+<p>Your Web Id: ${data.webid}</p>`
+  }
+}
+
+module.exports.render = render
diff --git a/test/resources/acl-tls/config/templates/new-account/.acl b/test/resources/acl-tls/config/templates/new-account/.acl
new file mode 100644
index 000000000..9f2213c84
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/.acl
@@ -0,0 +1,26 @@
+# Root ACL resource for the user account
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+# The homepage is readable by the public
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;
+    acl:accessTo </>;
+    acl:mode acl:Read.
+
+# The owner has full access to every resource in their pod.
+# Other agents have no access rights,
+# unless specifically authorized in other .acl resources.
+<#owner>
+    a acl:Authorization;
+    acl:agent <{{webId}}>;
+    # Optional owner email, to be used for account recovery:
+    {{#if email}}acl:agent <mailto:{{{email}}}>;{{/if}}
+    # Set the access to the root storage folder itself
+    acl:accessTo </>;
+    # All resources will inherit this authorization, by default
+    acl:default </>;
+    # The owner has all of the access modes allowed
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
diff --git a/test/resources/acl-tls/config/templates/new-account/.meta b/test/resources/acl-tls/config/templates/new-account/.meta
new file mode 100644
index 000000000..591051f43
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/.meta
@@ -0,0 +1,5 @@
+# Root Meta resource for the user account
+# Used to discover the account's WebID URI, given the account URI
+<{{webId}}>
+  <http://www.w3.org/ns/solid/terms#account>
+  </>.
diff --git a/test/resources/acl-tls/config/templates/new-account/.meta.acl b/test/resources/acl-tls/config/templates/new-account/.meta.acl
new file mode 100644
index 000000000..c297ce822
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/.meta.acl
@@ -0,0 +1,25 @@
+# ACL resource for the Root Meta
+# Should be public-readable (since the root meta is used for WebID discovery)
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    acl:accessTo </.meta>;
+
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </.meta>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/.well-known/.acl b/test/resources/acl-tls/config/templates/new-account/.well-known/.acl
new file mode 100644
index 000000000..9e13201e2
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/.well-known/.acl
@@ -0,0 +1,19 @@
+# ACL resource for the well-known folder
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+# The owner has all permissions
+<#owner>
+    a acl:Authorization;
+    acl:agent <{{webId}}>;
+    acl:accessTo <./>;
+    acl:defaultForNew <./>;
+    acl:mode acl:Read, acl:Write, acl:Control.
+
+# The public has read permissions
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;
+    acl:accessTo <./>;
+    acl:defaultForNew <./>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/favicon.ico b/test/resources/acl-tls/config/templates/new-account/favicon.ico
new file mode 100644
index 000000000..764acb205
Binary files /dev/null and b/test/resources/acl-tls/config/templates/new-account/favicon.ico differ
diff --git a/test/resources/acl-tls/config/templates/new-account/favicon.ico.acl b/test/resources/acl-tls/config/templates/new-account/favicon.ico.acl
new file mode 100644
index 000000000..01e11d075
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/favicon.ico.acl
@@ -0,0 +1,26 @@
+# ACL for the default favicon.ico resource
+# Individual users will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    acl:accessTo </favicon.ico>;
+
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </favicon.ico>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/inbox/.acl b/test/resources/acl-tls/config/templates/new-account/inbox/.acl
new file mode 100644
index 000000000..17b8e4bb7
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/inbox/.acl
@@ -0,0 +1,26 @@
+# ACL resource for the profile Inbox
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    acl:accessTo <./>;
+    acl:default <./>;
+
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
+
+# Public-appendable but NOT public-readable
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo <./>;
+
+    acl:mode acl:Append.
diff --git a/test/resources/acl-tls/config/templates/new-account/private/.acl b/test/resources/acl-tls/config/templates/new-account/private/.acl
new file mode 100644
index 000000000..1fae7fb55
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/private/.acl
@@ -0,0 +1,10 @@
+# ACL resource for the private folder
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+
+# The owner has all permissions
+<#owner>
+    a acl:Authorization;
+    acl:agent <{{webId}}>;
+    acl:accessTo <./>;
+    acl:defaultForNew <./>;
+    acl:mode acl:Read, acl:Write, acl:Control.
diff --git a/test/resources/acl-tls/config/templates/new-account/profile/.acl b/test/resources/acl-tls/config/templates/new-account/profile/.acl
new file mode 100644
index 000000000..a3cfaedc4
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/profile/.acl
@@ -0,0 +1,19 @@
+# ACL resource for the profile folder
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+# The owner has all permissions
+<#owner>
+    a acl:Authorization;
+    acl:agent <{{webId}}>;
+    acl:accessTo <./>;
+    acl:defaultForNew <./>;
+    acl:mode acl:Read, acl:Write, acl:Control.
+
+# The public has read permissions
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;
+    acl:accessTo <./>;
+    acl:defaultForNew <./>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/profile/card$.ttl b/test/resources/acl-tls/config/templates/new-account/profile/card$.ttl
new file mode 100644
index 000000000..063bc61cf
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/profile/card$.ttl
@@ -0,0 +1,25 @@
+@prefix solid: <http://www.w3.org/ns/solid/terms#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+@prefix pim: <http://www.w3.org/ns/pim/space#>.
+@prefix schema: <http://schema.org/>.
+@prefix ldp: <http://www.w3.org/ns/ldp#>.
+
+<>
+    a foaf:PersonalProfileDocument ;
+    foaf:maker <{{webId}}> ;
+    foaf:primaryTopic <{{webId}}> .
+
+<{{webId}}>
+    a foaf:Person ;
+    a schema:Person ;
+
+    foaf:name "{{name}}" ;
+
+    solid:account </> ;  # link to the account uri
+    pim:storage </> ;    # root storage
+
+    ldp:inbox </inbox/> ;
+
+    pim:preferencesFile </settings/prefs.ttl> ;  # private settings/preferences
+    solid:publicTypeIndex </settings/publicTypeIndex.ttl> ;
+    solid:privateTypeIndex </settings/privateTypeIndex.ttl> .
diff --git a/test/resources/acl-tls/config/templates/new-account/public/.acl b/test/resources/acl-tls/config/templates/new-account/public/.acl
new file mode 100644
index 000000000..210555a83
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/public/.acl
@@ -0,0 +1,19 @@
+# ACL resource for the public folder
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+# The owner has all permissions
+<#owner>
+    a acl:Authorization;
+    acl:agent <{{webId}}>;
+    acl:accessTo <./>;
+    acl:default <./>;
+    acl:mode acl:Read, acl:Write, acl:Control.
+
+# The public has read permissions
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;
+    acl:accessTo <./>;
+    acl:default <./>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/robots.txt b/test/resources/acl-tls/config/templates/new-account/robots.txt
new file mode 100644
index 000000000..8c27a0227
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/robots.txt
@@ -0,0 +1,3 @@
+User-agent: *
+# Allow all crawling (subject to ACLs as usual, of course)
+Disallow:
diff --git a/test/resources/acl-tls/config/templates/new-account/robots.txt.acl b/test/resources/acl-tls/config/templates/new-account/robots.txt.acl
new file mode 100644
index 000000000..2326c86c2
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/robots.txt.acl
@@ -0,0 +1,26 @@
+# ACL for the default robots.txt resource
+# Individual users will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    acl:accessTo </robots.txt>;
+
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </robots.txt>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/.acl b/test/resources/acl-tls/config/templates/new-account/settings/.acl
new file mode 100644
index 000000000..921e65570
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/.acl
@@ -0,0 +1,20 @@
+# ACL resource for the /settings/ container
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    # Set the access to the root storage folder itself
+    acl:accessTo <./>;
+
+    # All settings resources will be private, by default, unless overridden
+    acl:default <./>;
+
+    # The owner has all of the access modes allowed
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
+
+# Private, no public access modes
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/prefs.ttl b/test/resources/acl-tls/config/templates/new-account/settings/prefs.ttl
new file mode 100644
index 000000000..72ef47b88
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/prefs.ttl
@@ -0,0 +1,15 @@
+@prefix dct: <http://purl.org/dc/terms/>.
+@prefix pim: <http://www.w3.org/ns/pim/space#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+@prefix solid: <http://www.w3.org/ns/solid/terms#>.
+
+<>
+  a pim:ConfigurationFile;
+
+  dct:title "Preferences file" .
+
+{{#if email}}<{{webId}}> foaf:mbox <mailto:{{{email}}}> .{{/if}}
+
+<{{webId}}>
+  solid:publicTypeIndex <publicTypeIndex.ttl> ;
+  solid:privateTypeIndex <privateTypeIndex.ttl> .
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/privateTypeIndex.ttl b/test/resources/acl-tls/config/templates/new-account/settings/privateTypeIndex.ttl
new file mode 100644
index 000000000..b6fee77e6
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/privateTypeIndex.ttl
@@ -0,0 +1,4 @@
+@prefix solid: <http://www.w3.org/ns/solid/terms#>.
+<>
+    a solid:TypeIndex ;
+    a solid:UnlistedDocument.
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/publicTypeIndex.ttl b/test/resources/acl-tls/config/templates/new-account/settings/publicTypeIndex.ttl
new file mode 100644
index 000000000..433486252
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/publicTypeIndex.ttl
@@ -0,0 +1,4 @@
+@prefix solid: <http://www.w3.org/ns/solid/terms#>.
+<>
+    a solid:TypeIndex ;
+    a solid:ListedDocument.
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/publicTypeIndex.ttl.acl b/test/resources/acl-tls/config/templates/new-account/settings/publicTypeIndex.ttl.acl
new file mode 100644
index 000000000..6a1901462
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/publicTypeIndex.ttl.acl
@@ -0,0 +1,25 @@
+# ACL resource for the Public Type Index
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    acl:accessTo <./publicTypeIndex.ttl>;
+
+    acl:mode
+        acl:Read, acl:Write, acl:Control.
+
+# Public-readable
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo <./publicTypeIndex.ttl>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/serverSide.ttl.acl b/test/resources/acl-tls/config/templates/new-account/settings/serverSide.ttl.acl
new file mode 100644
index 000000000..fdcc53288
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/serverSide.ttl.acl
@@ -0,0 +1,13 @@
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#owner>
+    a acl:Authorization;
+
+    acl:agent
+        <{{webId}}>;
+
+    acl:accessTo <./serverSide.ttl>;
+
+    acl:mode acl:Read .
+    
diff --git a/test/resources/acl-tls/config/templates/new-account/settings/serverSide.ttl.inactive b/test/resources/acl-tls/config/templates/new-account/settings/serverSide.ttl.inactive
new file mode 100644
index 000000000..3cad13211
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/new-account/settings/serverSide.ttl.inactive
@@ -0,0 +1,12 @@
+@prefix dct: <http://purl.org/dc/terms/>.
+@prefix pim: <http://www.w3.org/ns/pim/space#>.
+@prefix solid: <http://www.w3.org/ns/solid/terms#>.
+
+<>
+  a pim:ConfigurationFile;
+
+  dct:description "Administrative settings for the POD that the user can only read." .
+
+</>
+    solid:storageQuota "25000000" .
+    
diff --git a/test/resources/acl-tls/config/templates/server/.acl b/test/resources/acl-tls/config/templates/server/.acl
new file mode 100644
index 000000000..05a9842d9
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/server/.acl
@@ -0,0 +1,10 @@
+# Root ACL resource for the root
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;  # everyone
+    acl:accessTo </>;
+    acl:default </common/>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/server/.well-known/.acl b/test/resources/acl-tls/config/templates/server/.well-known/.acl
new file mode 100644
index 000000000..6cacb3779
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/server/.well-known/.acl
@@ -0,0 +1,15 @@
+# ACL for the default .well-known/ resource
+# Server operators will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </.well-known/>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/server/favicon.ico b/test/resources/acl-tls/config/templates/server/favicon.ico
new file mode 100644
index 000000000..764acb205
Binary files /dev/null and b/test/resources/acl-tls/config/templates/server/favicon.ico differ
diff --git a/test/resources/acl-tls/config/templates/server/favicon.ico.acl b/test/resources/acl-tls/config/templates/server/favicon.ico.acl
new file mode 100644
index 000000000..e76838bb8
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/server/favicon.ico.acl
@@ -0,0 +1,15 @@
+# ACL for the default favicon.ico resource
+# Server operators will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </favicon.ico>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/templates/server/index.html b/test/resources/acl-tls/config/templates/server/index.html
new file mode 100644
index 000000000..37df7b336
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/server/index.html
@@ -0,0 +1,55 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Welcome to Solid</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-header">
+    <div class="pull-right">
+      <button id="register" type="button" class="btn btn-primary">Register</button>
+      <button id="login"    type="button" class="hidden btn btn-default btn-success">Log in</button>
+      <button id="logout"   type="button" class="hidden btn btn-danger">Log out</button>
+    </div>
+
+    <h1>Welcome to the Solid Prototype</h1>
+  </div>
+
+  <p class="lead">
+    This is a prototype implementation of a Solid server.
+
+    It is a fully functional server, but there are no security or stability guarantees.
+
+    If you have not already done so, please create an account.
+  </p>
+
+  <p class="lead hidden" id="loggedIn">
+    You are logged in as
+    <a href="#" id="profileLink"></a>.
+  </p>
+
+  <section>
+    {{#if serverLogo}}
+    <img src="{{serverLogo}}" />
+    {{/if}}
+    <h2>Server info</h2>
+    <dl>
+      <dt>Name</dt>
+      <dd>{{serverName}}</dd>
+      {{#if serverDescription}}
+      <dt>Description</dt>
+      <dd>{{serverDescription}}</dd>
+      {{/if}}
+      <dt>Details</dt>
+      <dd>Running on <a href="https://github.com/solid/node-solid-server/releases/tag/v{{serverVersion}}">Solid {{serverVersion}}</a></dd>
+    </dl>
+  </section>
+</div>
+<script src="/common/js/solid-auth-client.bundle.js"></script>
+<script src="/common/js/auth-buttons.js"></script>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/templates/server/robots.txt b/test/resources/acl-tls/config/templates/server/robots.txt
new file mode 100644
index 000000000..8c27a0227
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/server/robots.txt
@@ -0,0 +1,3 @@
+User-agent: *
+# Allow all crawling (subject to ACLs as usual, of course)
+Disallow:
diff --git a/test/resources/acl-tls/config/templates/server/robots.txt.acl b/test/resources/acl-tls/config/templates/server/robots.txt.acl
new file mode 100644
index 000000000..1eaabc201
--- /dev/null
+++ b/test/resources/acl-tls/config/templates/server/robots.txt.acl
@@ -0,0 +1,15 @@
+# ACL for the default robots.txt resource
+# Server operators will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </robots.txt>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/config/views/account/account-deleted.hbs b/test/resources/acl-tls/config/views/account/account-deleted.hbs
new file mode 100644
index 000000000..29c76b30f
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/account-deleted.hbs
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Account Deleted</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+</head>
+<body>
+<div class="container">
+  <h4>Account Deleted</h4>
+</div>
+<div class="container">
+  <p>Your account has been deleted.</p>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/account/delete-confirm.hbs b/test/resources/acl-tls/config/views/account/delete-confirm.hbs
new file mode 100644
index 000000000..f72654041
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/delete-confirm.hbs
@@ -0,0 +1,51 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Delete Account</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+</head>
+<body>
+<div class="container">
+  <h4>Delete Account</h4>
+</div>
+<div class="container">
+  <form method="post" action="/account/delete/confirm">
+    {{#if error}}
+      <div class="form-group">
+        <div class="row">
+          <div class="col-md-12">
+            <p class="text-danger"><strong>{{error}}</strong></p>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+
+    {{#if validToken}}
+      <p>Beware that this is an irreversible action. All your data that is stored in the POD will be deleted.</p>
+
+      <div class="form-group">
+        <div class="row">
+          <div class="col-md-2">
+            <button type="submit" class="btn btn-danger">Delete account</button>
+          </div>
+        </div>
+
+        <input type="hidden" name="token" value="{{token}}" />
+      </div>
+    {{else}}
+      <div class="form-group">
+        <div class="row">
+          <div class="col-md-12">
+            <div>
+              <strong>Token not valid</strong>
+            </div>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+  </form>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/account/delete-link-sent.hbs b/test/resources/acl-tls/config/views/account/delete-link-sent.hbs
new file mode 100644
index 000000000..d6d2dd722
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/delete-link-sent.hbs
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Delete Account Link Sent</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+</head>
+<body>
+<div class="container">
+  <h4>Confirm account deletion</h4>
+</div>
+<div class="container">
+  <p>A link to confirm the deletion of this account has been sent to your email.</p>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/account/delete.hbs b/test/resources/acl-tls/config/views/account/delete.hbs
new file mode 100644
index 000000000..55ac940b2
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/delete.hbs
@@ -0,0 +1,51 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Delete Account</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <script></script>
+</head>
+<body>
+<div class="container">
+  <h4>Delete Account</h4>
+</div>
+<div class="container">
+  <form method="post" action="/account/delete">
+    <div class="form-group">
+      {{#if error}}
+        <div class="row">
+          <div class="col-md-12">
+            <p class="text-danger"><strong>{{error}}</strong></p>
+          </div>
+        </div>
+      {{/if}}
+      <div class="row">
+        <div class="col-md-12">
+          {{#if multiuser}}
+            <p>Please enter your account name. A delete account link will be
+              emailed to the address you provided during account registration.</p>
+
+            <label for="username">Account Name:</label>
+            <input type="text" class="form-control" name="username" id="username"
+                   placeholder="alice" />
+          {{else}}
+            <p>A delete account link will be
+              emailed to the address you provided during account registration.</p>
+          {{/if}}
+        </div>
+      </div>
+    </div>
+
+    <div class="form-group">
+      <div class="row">
+        <div class="col-md-2">
+          <button type="submit" class="btn btn-primary">Send Delete Account Link</button>
+        </div>
+      </div>
+    </div>
+  </form>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/account/invalid-username.hbs b/test/resources/acl-tls/config/views/account/invalid-username.hbs
new file mode 100644
index 000000000..2ed52b424
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/invalid-username.hbs
@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Invalid username</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+</head>
+<body>
+<div class="container">
+  <h4>Invalid username</h4>
+</div>
+<div class="container">
+  <p>We're sorry to inform you that this account's username ({{username}}) is not allowed after changes to username policy.</p>
+  <p>This account has been set to be deleted at {{dateOfRemoval}}.</p>
+  {{#if supportEmail}}
+  <p>Please contact {{supportEmail}} if you want to move your account.</p>
+  {{/if}}
+  <p>If you had an email address connected to this account, you should have received an email about this.</p>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/account/register-disabled.hbs b/test/resources/acl-tls/config/views/account/register-disabled.hbs
new file mode 100644
index 000000000..7cf4d97af
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/register-disabled.hbs
@@ -0,0 +1,6 @@
+<div class="alert alert-danger">
+  <p>
+    Registering a new account is disabled for the WebID-TLS authentication method.
+    Please restart the server using another mode.
+  </p>
+</div>
diff --git a/test/resources/acl-tls/config/views/account/register-form.hbs b/test/resources/acl-tls/config/views/account/register-form.hbs
new file mode 100644
index 000000000..aae348e78
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/register-form.hbs
@@ -0,0 +1,147 @@
+<div class="row">
+  <div class="col-md-6">
+    <div class="panel panel-default">
+      <div class="panel-body">
+        <form method="post" action="/api/accounts/new" id="RegisterForm">
+          {{> shared/error}}
+
+          <div class="form-group">
+            <label class="control-label" for="username">Username*</label>
+            <input type="text" class="form-control" name="username" id="username" placeholder="alice"
+                   required value="{{username}}"/>
+
+	    {{#if multiuser}}
+	    <p>Your username should be a lower-case word with only
+	    letters a-z and numbers 0-9 and without periods.</p>
+	    <p>Your public Solid POD URL will be:
+	    <tt>https://<span class="editable-username">alice</span>.<script type="text/javascript">
+              document.write(window.location.host)
+	    </script></tt></p>
+	    <p>Your public Solid WebID will be:
+	    <tt>https://<span class="editable-username">alice</span>.<script type="text/javascript">
+              document.write(window.location.host)
+	    </script>/profile/card#me</tt></p>
+
+	    <p>Your <em>POD URL</em> is like the homepage for your Solid
+	    pod. By default, it is readable by the public, but you can
+	    always change that if you like by changing the access
+	    control.</p>
+
+	    <p>Your <em>Solid WebID</em> is your globally unique name
+	    that you can use to identify and authenticate yourself with
+	    other PODs across the world.</p>
+	    {{/if}}
+
+	  </div>
+
+          <div class="form-group has-feedback">
+            <label class="control-label" for="password">Password*</label>
+            <input type="password" class="form-control control-progress{{#if disablePasswordStrengthCheck}} disable-password-strength-check{{/if}}" name="password" id="password" required/>
+            <span class="glyphicon glyphicon-remove form-control-feedback hidden" aria-hidden="true"></span>
+            <div class="progress">
+              <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="4"></div>
+            </div>
+            <div class="help-block"></div>
+          </div>
+
+
+          <div class="form-group has-feedback">
+            <label class="control-label" for="repeat_password">Repeat password*</label>
+            <input type="password" class="form-control" name="repeat_password" id="repeat_password" required/>
+            <span class="glyphicon glyphicon-remove form-control-feedback hidden"></span>
+          </div>
+
+
+          <div class="form-group">
+            <label class="control-label" for="name">Name*</label>
+            <input type="text" class="form-control" name="name" id="name" required value="{{name}}"/>
+          </div>
+
+          <div class="form-group">
+            <label class="control-label" for="email">Email*</label>
+            <input type="email" class="form-control" name="email" id="email" value="{{email}}"/>
+            <span class="help-block">Your email will only be used for account recovery</span>
+          </div>
+
+          <div class="checkbox">
+            <label>
+              <input type="checkbox" name="connectExternalWebId" value="true" id="ConnectExternalWebId" {{#if connectExternalWebId}}checked{{/if}}/>
+              Connect to External WebID (<strong>Advanced feature</strong>)
+            </label>
+          </div>
+
+          <div class="form-group hidden" id="ExternalWebId">
+            <label class="control-label" for="externalWebId">External WebID:</label>
+            <input type="text" class="form-control" name="externalWebId" id="externalWebId" value="{{externalWebId}}"/>
+            <span class="help-block">
+              By connecting this account with an existing WebID, you can use that WebID to authenticate with the new account.
+            </span>
+          </div>
+
+          {{#if enforceToc}}
+            {{#if tocUri}}
+              <div class="checkbox">
+                <label>
+                  <input type="checkbox" name="acceptToc" value="true" {{#if acceptToc}}checked{{/if}}>
+                  I agree to the <a href="{{tocUri}}" target="_blank">Terms &amp; Conditions</a> of this service
+                </label>
+              </div>
+            {{/if}}
+          {{/if}}
+
+
+          <button type="submit" class="btn btn-primary" id="register">Register</button>
+
+          <input type="hidden" name="returnToUrl" value="{{returnToUrl}}"/>
+          {{> auth/auth-hidden-fields}}
+
+        </form>
+      </div>
+    </div>
+  </div>
+
+  <div class="col-md-6">
+    <div class="panel panel-default panel-already-registered">
+      <div class="panel-body">
+        <h2>Already have an account?</h2>
+        <p>
+          <a class="btn btn-lg btn-success" href="{{{loginUrl}}}">
+            Please Log In
+          </a>
+        </p>
+      </div>
+    </div>
+  </div>
+</div>
+
+<script src="/common/js/owasp-password-strength-test.js" defer></script>
+<script src="/common/js/text-encoder-lite.min.js" defer></script>
+<script src="/common/js/solid.js" defer></script>
+
+<script>
+  var username = document.getElementById('username');
+  username.onkeyup = function() {
+    var list = document.getElementsByClassName('editable-username');
+      for (let item of list) {
+      item.innerHTML = username.value.toLowerCase()
+    }
+  }
+
+  window.addEventListener('DOMContentLoaded', function () {
+    var connect = document.getElementById('ConnectExternalWebId')
+    var container = document.getElementById('ExternalWebId')
+    container.classList.toggle('hidden', !connect.checked)
+    connect.addEventListener('change', function () {
+      container.classList.toggle('hidden', !connect.checked)
+    })
+
+    var form = document.getElementById('RegisterForm')
+    var externalWebIdField = document.getElementById('externalWebId')
+    form.addEventListener('submit', function () {
+      if (!connect.checked) {
+        externalWebIdField.value = ''
+      }
+    })
+  })
+</script>
+
diff --git a/test/resources/acl-tls/config/views/account/register.hbs b/test/resources/acl-tls/config/views/account/register.hbs
new file mode 100644
index 000000000..f003871b1
--- /dev/null
+++ b/test/resources/acl-tls/config/views/account/register.hbs
@@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Register</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+
+  <div class="page-header">
+    <h1>Register</h1>
+  </div>
+
+  {{#if registerDisabled}}
+    {{> account/register-disabled}}
+  {{else}}
+    {{> account/register-form}}
+  {{/if}}
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/auth-hidden-fields.hbs b/test/resources/acl-tls/config/views/auth/auth-hidden-fields.hbs
new file mode 100644
index 000000000..35d9fd316
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/auth-hidden-fields.hbs
@@ -0,0 +1,8 @@
+<input type="hidden" name="response_type" id="response_type" value="{{response_type}}" />
+<input type="hidden" name="display" id="display" value="{{display}}" />
+<input type="hidden" name="scope" id="scope" value="{{scope}}" />
+<input type="hidden" name="client_id" id="client_id" value="{{client_id}}" />
+<input type="hidden" name="redirect_uri" id="redirect_uri" value="{{redirect_uri}}" />
+<input type="hidden" name="state" id="state" value="{{state}}" />
+<input type="hidden" name="nonce" id="nonce" value="{{nonce}}" />
+<input type="hidden" name="request" id="request" value="{{request}}" />
diff --git a/test/resources/acl-tls/config/views/auth/change-password.hbs b/test/resources/acl-tls/config/views/auth/change-password.hbs
new file mode 100644
index 000000000..07f7ffa2e
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/change-password.hbs
@@ -0,0 +1,58 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Change Password</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+
+  <div class="page-header">
+    <h1>Change Password</h1>
+  </div>
+
+  {{#if validToken}}
+    <form method="post" action="/account/password/change">
+      {{> shared/error}}
+
+
+      <div class="form-group has-feedback">
+        <label class="control-label" for="password">New Password*</label>
+        <input type="password" class="form-control control-progress" name="newPassword" id="password" required/>
+        <span class="glyphicon glyphicon-remove form-control-feedback hidden" aria-hidden="true"></span>
+        <div class="progress">
+          <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="4"></div>
+        </div>
+        <div class="help-block"></div>
+      </div>
+
+
+      <div class="form-group has-feedback">
+        <label class="control-label" for="repeat_password">Repeat password*</label>
+        <input type="password" class="form-control" name="repeat_password" id="repeat_password" required/>
+        <span class="glyphicon glyphicon-remove form-control-feedback hidden"></span>
+      </div>
+
+      <button type="submit" class="btn btn-primary">Change Password</button>
+      <input type="hidden" name="returnToUrl" value="{{{returnToUrl}}}"/>
+      <input type="hidden" name="token" value="{{token}}"/>
+
+    </form>
+
+    <script src="/common/js/owasp-password-strength-test.js" defer></script>
+    <script src="/common/js/text-encoder-lite.min.js" defer></script>
+    <script src="/common/js/solid.js" defer></script>
+
+  {{else}}
+
+  <a class="btn btn-primary" href="/account/password/reset{{#if returnToUrl}}?returnToUrl={{{returnToUrl}}}{{/if}}">
+    Email password reset link
+    </a>
+
+  {{/if}}
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/goodbye.hbs b/test/resources/acl-tls/config/views/auth/goodbye.hbs
new file mode 100644
index 000000000..0a96d5b35
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/goodbye.hbs
@@ -0,0 +1,23 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Logged Out</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-title">
+    <h1>Logout</h1>
+  </div>
+
+  <div class="alert alert-success">
+    <p>You have successfully logged out.</p>
+  </div>
+
+  <a href="/login" class="btn btn-primary">Login Again</a>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/login-required.hbs b/test/resources/acl-tls/config/views/auth/login-required.hbs
new file mode 100644
index 000000000..467a3a655
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/login-required.hbs
@@ -0,0 +1,34 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Log in</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-header">
+    <div class="pull-right">
+      <button id="register" type="button" class="btn btn-primary">Register</button>
+      <button id="login"    type="button" class="btn btn-success">Log in</button>
+      <button id="logout"   type="button" class="hidden btn btn-danger">Log out</button>
+    </div>
+    <h1>Log in to access this resource</h1>
+  </div>
+
+  <div class="alert alert-danger">
+    <p>
+      The resource you are trying to access
+      (<code>{{currentUrl}}</code>)
+      requires you to log in.
+    </p>
+  </div>
+
+</div>
+</div>
+<script src="/common/js/solid-auth-client.bundle.js"></script>
+<script src="/common/js/auth-buttons.js"></script>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/login-tls.hbs b/test/resources/acl-tls/config/views/auth/login-tls.hbs
new file mode 100644
index 000000000..3c934b45a
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/login-tls.hbs
@@ -0,0 +1,11 @@
+<div class="panel panel-default panel-login-tls">
+  <div class="panel-body">
+    <form method="post" action="{{tlsUrl}}">
+      <button type="submit" class="btn btn-lg btn-primary" id="login-tls">
+        Log in with Certificate (WebId-TLS)
+      </button>
+
+      {{> auth/auth-hidden-fields}}
+    </form>
+  </div>
+</div>
diff --git a/test/resources/acl-tls/config/views/auth/login-username-password.hbs b/test/resources/acl-tls/config/views/auth/login-username-password.hbs
new file mode 100644
index 000000000..3e6f3bb84
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/login-username-password.hbs
@@ -0,0 +1,28 @@
+<div class="panel panel-default">
+  <div class="panel-body">
+    <form method="post" action="/login/password" class="form-horizontal login-up-form">
+      <div class="form-group">
+        <label class="col-xs-3 control-label" for="username">Username</label>
+        <div class="col-xs-9">
+          <input type="text" class="form-control" name="username" id="username" placeholder="Username"/>
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label class="col-xs-3 control-label" for="password">Password</label>
+        <div class="col-xs-9">
+          <input type="password" class="form-control" name="password" id="password" placeholder="Password"/>
+          <div class="pull-right">
+            <a href="/account/password/reset{{#if returnToUrl}}?returnToUrl={{{returnToUrl}}}{{/if}}">
+              Forgot password?
+            </a>
+          </div>
+        </div>
+      </div>
+
+      <button type="submit" class="btn btn-primary" id="login">Log In</button>
+
+      {{> auth/auth-hidden-fields}}
+    </form>
+  </div>
+</div>
diff --git a/test/resources/acl-tls/config/views/auth/login.hbs b/test/resources/acl-tls/config/views/auth/login.hbs
new file mode 100644
index 000000000..37c89e2ec
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/login.hbs
@@ -0,0 +1,55 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Login</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="default">
+</head>
+<body>
+<div class="container-fluid">
+  <div class="page-header hidden-xs hidden-sm">
+    <h1>Login</h1>
+  </div>
+  
+
+  {{> shared/error}}
+
+  <div class="row visible-xs-inline visible-lg-block visible-md-block visible-sm-block">
+    <div class="col-md-6">
+      {{#if enablePassword}}
+        <h4 class="visible-xs visible-sm xs-header">Login</h4>
+        {{> auth/login-username-password}}
+      {{/if}}
+      <div class="visible-md visible-lg">
+        {{> shared/create-account }}
+      </div>
+    </div>
+
+    <div class="col-md-6">
+      {{#if enableTls}}
+        {{> auth/login-tls}}
+      {{/if}}
+      <div class="visible-xs visible-sm">
+        {{> shared/create-account }}
+      </div>
+    </div>
+  </div>
+</div>
+
+
+<script>
+  // Send return URL from localStorage to server through hidden redirect_uri field
+  var returnToUrl = localStorage.getItem('returnToUrl')
+  if (returnToUrl) {
+    for (let redirect of document.getElementsByName('redirect_uri')) {
+      redirect.value = returnToUrl
+    }
+  }
+  localStorage.removeItem('returnToUrl')
+</script>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/no-permission.hbs b/test/resources/acl-tls/config/views/auth/no-permission.hbs
new file mode 100644
index 000000000..18e719de7
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/no-permission.hbs
@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>No permission</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-header">
+    <h1>No permission to access this resource</h1>
+  </div>
+  <div class="alert alert-danger">
+    <p>
+      You are currently logged in as <code>{{webId}}</code>,
+      but do not have permission to access <code>{{currentUrl}}</code>.
+    </p>
+    <p>
+      <button id="logout" type="button" class="btn btn-danger">Log out</button>
+    </p>
+  </div>
+</div>
+</div>
+<script src="/common/js/solid-auth-client.bundle.js"></script>
+<script src="/common/js/auth-buttons.js"></script>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/password-changed.hbs b/test/resources/acl-tls/config/views/auth/password-changed.hbs
new file mode 100644
index 000000000..bf513858f
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/password-changed.hbs
@@ -0,0 +1,27 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Password Changed</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-header">
+    <h1>Password Changed</h1>
+  </div>
+
+  <div class="alert alert-success">
+    <p>Your password has been changed.</p>
+  </div>
+
+  <p>
+  <a class="btn btn-default" href="/login{{#if returnToUrl}}?returnToUrl={{{returnToUrl}}}{{/if}}">
+    Log in
+    </a>
+  </p>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/reset-link-sent.hbs b/test/resources/acl-tls/config/views/auth/reset-link-sent.hbs
new file mode 100644
index 000000000..1059f963a
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/reset-link-sent.hbs
@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Reset Link Sent</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-header">
+    <h1>Reset Link Sent</h1>
+  </div>
+
+  <div class="alert alert-success">
+    <p>A Reset Password link has been sent to your email.</p>
+  </div>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/reset-password.hbs b/test/resources/acl-tls/config/views/auth/reset-password.hbs
new file mode 100644
index 000000000..24d9c61e3
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/reset-password.hbs
@@ -0,0 +1,52 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Reset Password</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+
+  <div class="page-header">
+    <h1>Reset Password</h1>
+  </div>
+
+  <div class="panel panel-default">
+    <div class="panel-body">
+      <form method="post" action="/account/password/reset">
+        {{> shared/error}}
+
+        <div class="form-group">
+          {{#if multiuser}}
+            <p>Please enter your account name. A password reset link will be
+              emailed to the address you provided during account registration.</p>
+
+            <label class="control-label" for="username">Account Name:</label>
+            <input type="text" class="form-control" name="username" id="username"
+                   placeholder="alice"/>
+          {{else}}
+            <p>A password reset link will be
+              emailed to the address you provided during account registration.</p>
+          {{/if}}
+
+        </div>
+
+        <button type="submit" class="btn btn-primary">Send Reset Link</button>
+        <input type="hidden" name="returnToUrl" value="{{{returnToUrl}}}"/>
+      </form>
+    </div>
+  </div>
+
+  <div class="panel panel-default">
+    <div class="panel-body">
+      New to Solid? <a href="/register{{#if returnToUrl}}?returnToUrl={{{returnToUrl}}}{{/if}}">Create an
+      account</a>
+    </div>
+  </div>
+
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/auth/sharing.hbs b/test/resources/acl-tls/config/views/auth/sharing.hbs
new file mode 100644
index 000000000..c2c4e409d
--- /dev/null
+++ b/test/resources/acl-tls/config/views/auth/sharing.hbs
@@ -0,0 +1,49 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{{title}}</title>
+  <!-- Bootstrap CSS and Theme for demo purposes -->
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container title">
+  <h1>Authorize {{app_origin}} to access your Pod?</h1>
+  <p>Solid allows you to precisely choose what other people and apps can read and write in a Pod. This version of the authorization user interface (node-solid-server V5.1) only supports the toggle of global access permissions to all of the data in your Pod.</p>
+  <p><strong>If you don’t want to set these permissions at a global level, uncheck all of the boxes below, then click authorize.</strong> This will add the application origin to your authorization list, without granting it permission to any of your data yet. You will then need to manage those permissions yourself by setting them explicitly in the places you want this application to access.</p>
+  <div class="panel panel-default">
+    <div class="panel-body">
+      <div class="page-title">
+        <p>By clicking Authorize, any app from {{app_origin}} will be able to:</p>
+      </div>
+      <form method="post" action="/sharing">
+
+        <input id="read" type="checkbox" name="access_mode" value="Read" checked>
+        <label for="read">Read all documents in the Pod</label>
+        <br>
+
+        <input id="append" type="checkbox" name="access_mode" value="Append" checked>
+        <label for="append">Add data to existing documents, and create new documents</label>
+        <br>
+
+        <input id="write" type="checkbox" name="access_mode" value="Write" checked>
+        <label for="write">Modify and delete data in existing documents, and delete documents</label>
+        <br>
+
+        <input id="control" type="checkbox" name="access_mode" value="Control">
+        <label for="control">Give other people and apps access to the Pod, or revoke their (and your) access</label>
+        <br>
+        <br>
+
+        <button type="submit" class="btn btn-primary" name="consent" value="true">Authorize</button>
+        <button type="submit" class="btn btn-default" name="cancel" value="true">Cancel</button>
+        {{> auth/auth-hidden-fields}}
+      </form>
+    </div>
+  </div>
+  <p><i>This server (node-solid-server V5.1) only implements a limited subset of OpenID Connect, and doesn’t yet support token issuance for applications. OIDC Token Issuance and fine-grained management through this authorization user interface is currently in the development backlog for node-solid-server</i></p>
+</div>
+</body>
+</html>
diff --git a/test/resources/acl-tls/config/views/shared/create-account.hbs b/test/resources/acl-tls/config/views/shared/create-account.hbs
new file mode 100644
index 000000000..1cc0bd810
--- /dev/null
+++ b/test/resources/acl-tls/config/views/shared/create-account.hbs
@@ -0,0 +1,8 @@
+<div class="panel panel-default">
+  <div class="panel-body">
+    New to Solid?
+    <a href="{{{registerUrl}}}">
+      Create an account
+    </a>
+  </div>
+</div>
diff --git a/test/resources/acl-tls/config/views/shared/error.hbs b/test/resources/acl-tls/config/views/shared/error.hbs
new file mode 100644
index 000000000..8aedd23e0
--- /dev/null
+++ b/test/resources/acl-tls/config/views/shared/error.hbs
@@ -0,0 +1,5 @@
+{{#if error}}
+  <div class="alert alert-danger">
+    <p><strong>{{error}}</strong></p>
+  </div>
+{{/if}}
diff --git a/test/resources/acl-tls/localhost/.acl b/test/resources/acl-tls/localhost/.acl
new file mode 100644
index 000000000..05a9842d9
--- /dev/null
+++ b/test/resources/acl-tls/localhost/.acl
@@ -0,0 +1,10 @@
+# Root ACL resource for the root
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;  # everyone
+    acl:accessTo </>;
+    acl:default </common/>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/localhost/.well-known/.acl b/test/resources/acl-tls/localhost/.well-known/.acl
new file mode 100644
index 000000000..6cacb3779
--- /dev/null
+++ b/test/resources/acl-tls/localhost/.well-known/.acl
@@ -0,0 +1,15 @@
+# ACL for the default .well-known/ resource
+# Server operators will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </.well-known/>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/localhost/favicon.ico b/test/resources/acl-tls/localhost/favicon.ico
new file mode 100644
index 000000000..764acb205
Binary files /dev/null and b/test/resources/acl-tls/localhost/favicon.ico differ
diff --git a/test/resources/acl-tls/localhost/favicon.ico.acl b/test/resources/acl-tls/localhost/favicon.ico.acl
new file mode 100644
index 000000000..e76838bb8
--- /dev/null
+++ b/test/resources/acl-tls/localhost/favicon.ico.acl
@@ -0,0 +1,15 @@
+# ACL for the default favicon.ico resource
+# Server operators will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </favicon.ico>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/localhost/index.html b/test/resources/acl-tls/localhost/index.html
new file mode 100644
index 000000000..c0d68c8c5
--- /dev/null
+++ b/test/resources/acl-tls/localhost/index.html
@@ -0,0 +1,48 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Welcome to Solid</title>
+  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
+  <link rel="stylesheet" href="/common/css/solid.css">
+</head>
+<body>
+<div class="container">
+  <div class="page-header">
+    <div class="pull-right">
+      <button id="register" type="button" class="btn btn-primary">Register</button>
+      <button id="login"    type="button" class="hidden btn btn-default btn-success">Log in</button>
+      <button id="logout"   type="button" class="hidden btn btn-danger">Log out</button>
+    </div>
+
+    <h1>Welcome to the Solid Prototype</h1>
+  </div>
+
+  <p class="lead">
+    This is a prototype implementation of a Solid server.
+
+    It is a fully functional server, but there are no security or stability guarantees.
+
+    If you have not already done so, please create an account.
+  </p>
+
+  <p class="lead hidden" id="loggedIn">
+    You are logged in as
+    <a href="#" id="profileLink"></a>.
+  </p>
+
+  <section>
+    <h2>Server info</h2>
+    <dl>
+      <dt>Name</dt>
+      <dd>localhost</dd>
+      <dt>Details</dt>
+      <dd>Running on <a href="https://github.com/solid/node-solid-server/releases/tag/v5.2.0">Solid 5.2.0</a></dd>
+    </dl>
+  </section>
+</div>
+<script src="/common/js/solid-auth-client.bundle.js"></script>
+<script src="/common/js/auth-buttons.js"></script>
+</body>
+</html>
diff --git a/test/resources/acl-tls/localhost/robots.txt b/test/resources/acl-tls/localhost/robots.txt
new file mode 100644
index 000000000..8c27a0227
--- /dev/null
+++ b/test/resources/acl-tls/localhost/robots.txt
@@ -0,0 +1,3 @@
+User-agent: *
+# Allow all crawling (subject to ACLs as usual, of course)
+Disallow:
diff --git a/test/resources/acl-tls/localhost/robots.txt.acl b/test/resources/acl-tls/localhost/robots.txt.acl
new file mode 100644
index 000000000..1eaabc201
--- /dev/null
+++ b/test/resources/acl-tls/localhost/robots.txt.acl
@@ -0,0 +1,15 @@
+# ACL for the default robots.txt resource
+# Server operators will be able to override it as they wish
+# Public-readable
+
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+
+    acl:agentClass foaf:Agent;  # everyone
+
+    acl:accessTo </robots.txt>;
+
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/tim.localhost/.acl b/test/resources/acl-tls/tim.localhost/.acl
new file mode 100644
index 000000000..05a9842d9
--- /dev/null
+++ b/test/resources/acl-tls/tim.localhost/.acl
@@ -0,0 +1,10 @@
+# Root ACL resource for the root
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;  # everyone
+    acl:accessTo </>;
+    acl:default </common/>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/append-acl/abc.ttl b/test/resources/acl-tls/tim.localhost/append-acl/abc.ttl
similarity index 100%
rename from test/resources/acl-tls/append-acl/abc.ttl
rename to test/resources/acl-tls/tim.localhost/append-acl/abc.ttl
diff --git a/test/resources/acl-tls/append-acl/abc.ttl.acl b/test/resources/acl-tls/tim.localhost/append-acl/abc.ttl.acl
similarity index 100%
rename from test/resources/acl-tls/append-acl/abc.ttl.acl
rename to test/resources/acl-tls/tim.localhost/append-acl/abc.ttl.acl
diff --git a/test/resources/acl-tls/append-acl/abc2.ttl b/test/resources/acl-tls/tim.localhost/append-acl/abc2.ttl
similarity index 100%
rename from test/resources/acl-tls/append-acl/abc2.ttl
rename to test/resources/acl-tls/tim.localhost/append-acl/abc2.ttl
diff --git a/test/resources/acl-tls/append-acl/abc2.ttl.acl b/test/resources/acl-tls/tim.localhost/append-acl/abc2.ttl.acl
similarity index 100%
rename from test/resources/acl-tls/append-acl/abc2.ttl.acl
rename to test/resources/acl-tls/tim.localhost/append-acl/abc2.ttl.acl
diff --git a/test/resources/acl-tls/append-inherited/.acl b/test/resources/acl-tls/tim.localhost/append-inherited/.acl
similarity index 100%
rename from test/resources/acl-tls/append-inherited/.acl
rename to test/resources/acl-tls/tim.localhost/append-inherited/.acl
diff --git a/test/resources/acl-tls/empty-acl/.acl b/test/resources/acl-tls/tim.localhost/empty-acl/.acl
similarity index 100%
rename from test/resources/acl-tls/empty-acl/.acl
rename to test/resources/acl-tls/tim.localhost/empty-acl/.acl
diff --git a/test/resources/acl-tls/fake-account/.acl b/test/resources/acl-tls/tim.localhost/fake-account/.acl
similarity index 100%
rename from test/resources/acl-tls/fake-account/.acl
rename to test/resources/acl-tls/tim.localhost/fake-account/.acl
diff --git a/test/resources/acl-tls/fake-account/hello.html b/test/resources/acl-tls/tim.localhost/fake-account/hello.html
similarity index 100%
rename from test/resources/acl-tls/fake-account/hello.html
rename to test/resources/acl-tls/tim.localhost/fake-account/hello.html
diff --git a/test/resources/acl-tls/no-acl/test-file.html b/test/resources/acl-tls/tim.localhost/no-acl/test-file.html
similarity index 100%
rename from test/resources/acl-tls/no-acl/test-file.html
rename to test/resources/acl-tls/tim.localhost/no-acl/test-file.html
diff --git a/test/resources/acl-tls/origin/.acl b/test/resources/acl-tls/tim.localhost/origin/.acl
similarity index 100%
rename from test/resources/acl-tls/origin/.acl
rename to test/resources/acl-tls/tim.localhost/origin/.acl
diff --git a/test/resources/acl-tls/owner-only/.acl b/test/resources/acl-tls/tim.localhost/owner-only/.acl
similarity index 100%
rename from test/resources/acl-tls/owner-only/.acl
rename to test/resources/acl-tls/tim.localhost/owner-only/.acl
diff --git a/test/resources/acl-tls/tim.localhost/profile/.acl b/test/resources/acl-tls/tim.localhost/profile/.acl
new file mode 100644
index 000000000..49c8bf1e0
--- /dev/null
+++ b/test/resources/acl-tls/tim.localhost/profile/.acl
@@ -0,0 +1,11 @@
+# ACL resource for the profile folder
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+# The public has read permissions
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;
+    acl:accessTo <./>;
+    acl:defaultForNew <./>;
+    acl:mode acl:Read.
diff --git a/test/resources/acl-tls/tim.localhost/profile/card$.ttl b/test/resources/acl-tls/tim.localhost/profile/card$.ttl
new file mode 100644
index 000000000..3a8e32f01
--- /dev/null
+++ b/test/resources/acl-tls/tim.localhost/profile/card$.ttl
@@ -0,0 +1,17 @@
+@prefix : <#>.
+@prefix n0: <http://xmlns.com/foaf/0.1/>.
+@prefix n: <http://www.w3.org/2006/vcard/ns#>.
+@prefix cert: <http://www.w3.org/ns/auth/cert#>.
+@prefix schem: <http://schema.org/>.
+@prefix XML: <http://www.w3.org/2001/XMLSchema#>.
+
+:me
+    a schem:Person, n0:Person;
+    n:fn "Tim Berners-Lee";
+    cert:key
+            [
+                a cert:RSAPublicKey;
+                cert:exponent 65537;
+                cert:modulus
+                    "B558A7434506DE4DCFD06FEB4221FC8734DDA7278778F657647131E1F4D7888ACF803C98A0BC73CF397703A550FB3095D12435EE7A5AB84190CD55E0F9084EC1151B1F8ADF3A84FA0AB62672786B9A488602A7D81CED88E43B0903288BB6E4E630F05590B803BA1B3478E4748EC8DB044D4027CD3D8B836782EE6F6123617F7AD9CFFA94644BEF5839DBE7411026B0067969DD365FFE12884434F2A5A4598179D82DB7024673FB24B8DA40C01B5AF85D3711D3BCE95D99FAA0D029DC86D55BD7545E52541F633CE5E458B42B4D3CA3732C84F12C7AD995F10E5B18BD0006776EC8BB0E047A69924FC8F1BE3A1BF260B93DBD4A02100AEC421B3085003F8E7A4F"^^XML:hexBinary
+            ].
\ No newline at end of file
diff --git a/test/resources/acl-tls/read-acl/.acl b/test/resources/acl-tls/tim.localhost/read-acl/.acl
similarity index 100%
rename from test/resources/acl-tls/read-acl/.acl
rename to test/resources/acl-tls/tim.localhost/read-acl/.acl