diff --git a/database/zmon/20_api/05_stored_procedures/60_onetime_access_tokens.sql b/database/zmon/20_api/05_stored_procedures/60_onetime_access_tokens.sql
index 7f1c4423..11af652d 100644
--- a/database/zmon/20_api/05_stored_procedures/60_onetime_access_tokens.sql
+++ b/database/zmon/20_api/05_stored_procedures/60_onetime_access_tokens.sql
@@ -26,7 +26,7 @@ $$
    WHERE oat_token = token
      AND (oat_bound_ip is NULL OR oat_bound_ip = bind_ip)
      AND (oat_bound_session_id is NULL or oat_bound_session_id = session_id)
-     AND oat_bound_expires IS NULL OR oat_bound_expires > NOW()
+     AND (oat_bound_expires IS NULL OR oat_bound_expires > NOW())
     RETURNING oat_token, oat_created, oat_bound_at, oat_bound_ip, oat_bound_expires;
 $$
 LANGUAGE 'sql' VOLATILE SECURITY DEFINER;
diff --git a/zmon-controller-app/src/main/java/org/zalando/zmon/controller/TvTokenController.java b/zmon-controller-app/src/main/java/org/zalando/zmon/controller/TvTokenController.java
index af9b297d..a78abb7a 100644
--- a/zmon-controller-app/src/main/java/org/zalando/zmon/controller/TvTokenController.java
+++ b/zmon-controller-app/src/main/java/org/zalando/zmon/controller/TvTokenController.java
@@ -96,7 +96,7 @@ public ResponseEntity<String> getByEMail(@RequestParam(value="mail") String mail
         return new ResponseEntity<>("SEND_FAILED", HttpStatus.INTERNAL_SERVER_ERROR);
     }
 
-    // @RequestMapping("/tv/{token}")
+    @RequestMapping("/tv/{token}")
     public String handleToken(@PathVariable String token,
                               @RequestHeader(name = X_FORWARDED_FOR, required = false) String bindIp,
                               HttpServletRequest request,
diff --git a/zmon-controller-app/src/test/java/org/zalando/zmon/controller/TvTokenControllerTest.java b/zmon-controller-app/src/test/java/org/zalando/zmon/controller/TvTokenControllerTest.java
index 33d41c4d..60ad530a 100644
--- a/zmon-controller-app/src/test/java/org/zalando/zmon/controller/TvTokenControllerTest.java
+++ b/zmon-controller-app/src/test/java/org/zalando/zmon/controller/TvTokenControllerTest.java
@@ -43,7 +43,7 @@ oneTimeTokenService, new ControllerProperties()))
                                  .alwaysDo(MockMvcResultHandlers.print()).build();
     }
 
-    // @Test
+    @Test
     public void happyCase() throws Exception {
         when(onetimeTokensSProcService.bindOnetimeToken(eq("1234567"), eq("192.168.23.12"),
                 eq("987654321"))).thenReturn(singletonList(new OnetimeTokenInfo()));
@@ -61,7 +61,7 @@ public void happyCase() throws Exception {
                 eq("192.168.23.12"), eq("987654321"));
     }
 
-    // @Test
+    @Test
     public void invalidEmails() throws Exception {
         mockMvc.perform(post("/tv/by-email")
                 .header("X-FORWARDED-FOR", "192.168.23.12")
@@ -76,7 +76,7 @@ public void invalidEmails() throws Exception {
                 .andExpect(status().is(400));
     }
 
-    // @Test
+    @Test
     public void validEmail() throws Exception {
         mockMvc.perform(post("/tv/by-email")
                 .header("X-FORWARDED-FOR", "192.168.23.12")
diff --git a/zmon-security-common/src/main/java/org/zalando/zmon/security/WebSecurityConstants.java b/zmon-security-common/src/main/java/org/zalando/zmon/security/WebSecurityConstants.java
index 377eeda1..573a26ea 100644
--- a/zmon-security-common/src/main/java/org/zalando/zmon/security/WebSecurityConstants.java
+++ b/zmon-security-common/src/main/java/org/zalando/zmon/security/WebSecurityConstants.java
@@ -4,5 +4,6 @@ public class WebSecurityConstants {
 
     public static String[] IGNORED_PATHS = new String[]{
             "/logo.png","/clean.png","/warning.png", "/favicon.ico", "/asset/**", "/styles/**", "/js/**", "/lib/**",
-            "/grafana/public/**"};
+            "/grafana/public/**",
+            "/tv/**"};
 }