diff --git a/views/ngXosViews/subscriberPortal/bs-config.js b/views/ngXosViews/subscriberPortal/bs-config.js
index 507b8d3..6888103 100644
--- a/views/ngXosViews/subscriberPortal/bs-config.js
+++ b/views/ngXosViews/subscriberPortal/bs-config.js
@@ -51,10 +51,10 @@
         req.url.indexOf('/xoslib/') !== -1 ||
         req.url.indexOf('/hpcapi/') !== -1
       ){
-        if(conf.xoscsrftoken && conf.xossessionid){
-          req.headers.cookie = `xoscsrftoken=${conf.xoscsrftoken}; xossessionid=${conf.xossessionid}`;
-          req.headers['x-csrftoken'] = conf.xoscsrftoken;
-        }
+        //if(conf.xoscsrftoken && conf.xossessionid){
+        //  req.headers.cookie = `xoscsrftoken=${conf.xoscsrftoken}; xossessionid=${conf.xossessionid}`;
+        //  req.headers['x-csrftoken'] = conf.xoscsrftoken;
+        //}
         proxy.web(req, res);
       }
       else{
diff --git a/views/ngXosViews/subscriberPortal/env/local.js b/views/ngXosViews/subscriberPortal/env/local.js
new file mode 100644
index 0000000..9389110
--- /dev/null
+++ b/views/ngXosViews/subscriberPortal/env/local.js
@@ -0,0 +1,13 @@
+// This is a default configuration for your development environment.
+// You can duplicate this configuration for any of your Backend Environments.
+// Different configurations are loaded setting a NODE_ENV variable that contain the config file name.
+// `NODE_ENV=local npm start`
+//
+// If xoscsrftoken or xossessionid are not specified the browser value are used
+// (works only for local environment as both application are served on the same domain)
+
+module.exports = {
+  host: 'http://xos:9999/',
+  xoscsrftoken: '4h041U85TInxbCVJ0OHW4dY9qriY7gRQ',
+  xossessionid: 'pw3di6n5j7idq2o1egx90i11u3u8in5b'
+};
diff --git a/views/ngXosViews/subscriberPortal/src/app/fw/services/rest.js b/views/ngXosViews/subscriberPortal/src/app/fw/services/rest.js
index 7ca2546..2bb2b82 100644
--- a/views/ngXosViews/subscriberPortal/src/app/fw/services/rest.js
+++ b/views/ngXosViews/subscriberPortal/src/app/fw/services/rest.js
@@ -1,10 +1,26 @@
 "use strict";
 
 angular.module('cordRest', [])
+  .service('User', function($http, $q, cordConfig){
+    this.login = function(username, password){
+      var deferred = $q.defer();
+
+      $http.post(cordConfig.url + '/xoslib/login/', {username: username, password: password})
+      .then(function(res){
+          deferred.resolve(JSON.parse(res.data.user));
+      })
+      .catch(function(e){
+        throw new Error(e);
+      });
+
+      return deferred.promise;
+    };
+  })
   .service('Subscribers', function($resource, cordConfig){
     return $resource(cordConfig.url + '/xoslib/rs/subscriber');
   })
   .service('SubscriberUsers', function($resource, cordConfig){
+    // TODO define an interceptor as res.users should be resources
     // NOTE SubscriberId should ne retrieved from login information
     return $resource(cordConfig.url + '/xoslib/rs/subscriber/:subscriberId/users/:id', {}, {
       query: {
@@ -12,4 +28,8 @@
         isArray: false
       }
     });
+    //return $resource(cordConfig.url + '/xoslib/corduser/:id')
+  })
+  .service('SubscriberUsersUrlFilterLevel', function($resource, cordConfig){
+    return $resource(cordConfig.url + '/xoslib/rs/subscriber/:subscriberId/users/:userId/url_filter/');
   });
\ No newline at end of file
diff --git a/views/ngXosViews/subscriberPortal/src/app/view/login/login.js b/views/ngXosViews/subscriberPortal/src/app/view/login/login.js
index eae16d5..1d50b20 100644
--- a/views/ngXosViews/subscriberPortal/src/app/view/login/login.js
+++ b/views/ngXosViews/subscriberPortal/src/app/view/login/login.js
@@ -15,32 +15,39 @@
  */
 
 (function () {
-    'use strict';
-    var urlSuffix = '/rs/login';
+  'use strict';
+  var urlSuffix = '/rs/login';
 
-    angular.module('cordLogin', [])
-        .controller('CordLoginCtrl',
-        ['$log', '$scope', '$resource', '$location', '$window',
-            function ($log, $scope, $resource, $location, $window) {
-                var LoginData, resource;
-                $scope.page.curr = 'login';
+  angular.module('cordLogin', [])
+    .controller('CordLoginCtrl', [
+      '$log', '$scope', '$resource', '$location', '$window', 'User',
+      function ($log, $scope, $resource, $location, $window, User) {
+        var LoginData, resource;
+        $scope.page.curr = 'login';
 
-                function getResource(email) {
-                    LoginData = $resource($scope.shared.url + urlSuffix + '/' + email);
-                    resource = LoginData.get({},
-                        function () {
-                            $location.url('/home');
-                            $window.location.href = $location.absUrl();
-                        });
-                }
+        function getResource(email) {
+          LoginData = $resource($scope.shared.url + urlSuffix + '/' + email);
+          resource = LoginData.get({},
+            function () {
+              $location.url('/home');
+              $window.location.href = $location.absUrl();
+            });
+        }
 
-                $scope.login = function () {
-                    if ($scope.email && $scope.password) {
-                        getResource($scope.email);
-                        $scope.shared.login = $scope.email;
-                    }
-                };
+        $scope.login = function () {
+          if ($scope.email && $scope.password) {
+            //getResource($scope.email);
 
-                $log.debug('Cord Login Ctrl has been created.');
-        }]);
+            User.login($scope.email, $scope.password)
+            .then(function(user){
+              console.log(user);
+              $location.url('/home');
+            });
+
+            $scope.shared.login = $scope.email;
+          }
+        };
+
+        $log.debug('Cord Login Ctrl has been created.');
+      }]);
 }());
diff --git a/views/ngXosViews/subscriberPortal/src/app/view/user/user.html b/views/ngXosViews/subscriberPortal/src/app/view/user/user.html
index d8a0620..9822b57 100644
--- a/views/ngXosViews/subscriberPortal/src/app/view/user/user.html
+++ b/views/ngXosViews/subscriberPortal/src/app/view/user/user.html
@@ -19,21 +19,17 @@
         </div>
 
         <div class="main-right" ng-class="{family: isFamily}">
-            <form ng-if="isFamily"
-                  name="changeLevels">
+            <form ng-if="isFamily" name="changeLevels">
                 <table class="user-form">
                     <tr>
                         <th>
                             Select Site Rating
-                            <span class="help"
-                                  ng-click="showRatings()"> (?)</span>
+                            <span class="help" ng-click="showRatings()"> (?)</span>
                         </th>
                     </tr>
                     <tr ng-repeat="user in users" class="options">
                         <td>
-                            <select ng-init="newLevels[user.id]=user.profile.url_filter.level"
-                                    ng-model="newLevels[user.id]"
-                                    ng-options="l for l in levels">
+                            <select ng-model="user.level" ng-options="l for l in levels" ng-change="updateLevel(user)">
                             </select>
                         </td>
                     </tr>
diff --git a/views/ngXosViews/subscriberPortal/src/app/view/user/user.js b/views/ngXosViews/subscriberPortal/src/app/view/user/user.js
index 4d69269..ecdf970 100644
--- a/views/ngXosViews/subscriberPortal/src/app/view/user/user.js
+++ b/views/ngXosViews/subscriberPortal/src/app/view/user/user.js
@@ -58,13 +58,6 @@
             // add an icon to the user
             res.users.map(function(user){
               user['icon_id'] = 'mom';
-              // NOTE mock data, waiting for #CORD-516
-              var levels = ['R', 'PG', 'PG-13'];
-              user.profile = {
-                url_filter: {
-                  level: levels[Math.floor(Math.random() * levels.length)]
-                }
-              };
               return user;
             });
 
@@ -81,6 +74,43 @@
             $log.error('Problem with resource', bundleResource);
           });
 
+        $scope.updateLevel = function(user){
+          console.log(user);
+          user.$save()
+            .then(function(){
+              console.log('saved');
+            })
+            .catch(function(e){
+              throw new Error(e);
+            });
+        };
+
+        //function getUsers(url) {
+        //  var UserData, userResource;
+        //  UserData = $resource(url);
+        //  userResource = UserData.get({},
+        //    // success
+        //    function () {
+        //      $scope.users = userResource.users;
+        //      if ($.isEmptyObject($scope.shared.userActivity)) {
+        //        $scope.users.forEach(function (user) {
+        //          var date = randomDate(new Date(2015, 0, 1),
+        //            new Date());
+        //
+        //          $scope.shared.userActivity[user.id] =
+        //            $filter('date')(date, 'mediumTime');
+        //        });
+        //      }
+        //    },
+        //    // error
+        //    function () {
+        //      $log.error('Problem with resource', userResource);
+        //    }
+        //  );
+        //}
+        //
+        //getUsers($scope.shared.url + userUrlSuffix);
+
         // === Form functions ---
 
         function levelUrl(id, level) {
@@ -88,6 +118,7 @@
             userUrlSuffix + '/' + id + '/apply/url_filter/level/' + level;
         }
 
+        // NOTE This will trigger one request for each user to update url_filter level
         $scope.applyChanges = function (changeLevels) {
           var requests = [];
 
diff --git a/views/ngXosViews/subscriberPortal/src/cord.js b/views/ngXosViews/subscriberPortal/src/cord.js
index 0b4d853..bae4b2e 100644
--- a/views/ngXosViews/subscriberPortal/src/cord.js
+++ b/views/ngXosViews/subscriberPortal/src/cord.js
@@ -93,7 +93,7 @@
               "desc": "Variable levels of URL filtering.",
               "params": {
                 "level": "PG",
-                "levels": [ "PG", "PG-13", "R" ]
+                "levels": [ "PG", "PG_13", "R" ]
               }
             }
           ]
diff --git a/xos/configurations/frontend/docker-compose.yml b/xos/configurations/frontend/docker-compose.yml
index 2779deb..95dfe8a 100644
--- a/xos/configurations/frontend/docker-compose.yml
+++ b/xos/configurations/frontend/docker-compose.yml
@@ -20,4 +20,4 @@
         - xos_db
     volumes:
       - ../common/xos_common_config:/opt/xos/xos_configuration/xos_common_config:ro
-      - ../../core/xoslib:/opt/xos/core/xoslib:ro
+      - ../../core/xoslib:/opt/xos/core/xoslib
diff --git a/xos/core/xoslib/methods/loginview.py b/xos/core/xoslib/methods/loginview.py
index fb20897..193d14f 100755
--- a/xos/core/xoslib/methods/loginview.py
+++ b/xos/core/xoslib/methods/loginview.py
@@ -15,6 +15,15 @@
 import time
 import django.middleware.csrf
 from xos.exceptions import *
+from django.forms.models import model_to_dict
+
+def serialize_user(model):
+    serialized = model_to_dict(model)
+    del serialized['last_login']
+    del serialized['timezone']
+    del serialized['password']
+    print serialized
+    return json.dumps(serialized)
 
 class LoginView(APIView):
     method_kind = "list"
@@ -43,7 +52,7 @@
         return Response({
             "xoscsrftoken": django.middleware.csrf.get_token(request),
             "xossessionid": request.session.session_key,
-            "user": serializers.serialize('json', [u])
+            "user": serialize_user(u)
         })
 
     def get(self, request, format=None):