diff --git a/plugins/kolab_2fa/kolab2fa.js b/plugins/kolab_2fa/kolab2fa.js
index bb92359a..9114a3f3 100644
--- a/plugins/kolab_2fa/kolab2fa.js
+++ b/plugins/kolab_2fa/kolab2fa.js
@@ -1,368 +1,372 @@
 /**
  * Kolab 2-Factor-Authentication plugin client functions
  *
  * @author Thomas Bruederli <bruederli@kolabsys.com>
  *
  * @licstart  The following is the entire license notice for the
  * JavaScript code in this page.
  *
  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
  * published by the Free Software Foundation, either version 3 of the
  * License, or (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU Affero General Public License for more details.
  *
  * You should have received a copy of the GNU Affero General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  *
  * @licend  The above is the entire license notice
  * for the JavaScript code in this page.
  */
 
 window.rcmail && rcmail.addEventListener('init', function(evt) {
     var highsec_call_stack = [];
     var highsec_dialog;
     var factor_dialog;
 
     if (!rcmail.env.kolab_2fa_factors) {
         rcmail.env.kolab_2fa_factors = {};
     }
 
     /**
      * Equivalend of PHP time()
      */
     function time() {
         return Math.round(new Date().getTime() / 1000);
     }
 
     /**
      * Render the settings UI
      */
     function render() {
         var table = $('#kolab2fa-factors tbody');
         table.html('');
 
         var rows = 0;
         $.each(rcmail.env.kolab_2fa_factors, function(id, props) {
             if (props.active) {
-                var tr = $('<tr>').addClass(props.method).appendTo(table);
+                var tr = $('<tr>').addClass(props.method).appendTo(table),
+                    button = $('<a class="button icon delete">').attr({href: '#', rel: id})
+                        .append($('<span class="inner">').text(rcmail.get_label('remove','kolab_2fa')));
+
                 $('<td>').addClass('name').text(props.label || props.name).appendTo(tr);
                 $('<td>').addClass('created').text(props.created || '??').appendTo(tr);
-                $('<td>').addClass('actions').html('<a class="button delete" rel="'+id+'">' + rcmail.get_label('remove','kolab_2fa') + '</a>').appendTo(tr);
+                $('<td>').addClass('actions buttons-cell').append(button).appendTo(tr);
                 rows++;
             }
         });
 
         table.parent()[(rows > 0 ? 'show' : 'hide')]();
     }
 
     /**
      * Open dialog to add the given authentication factor
      */
     function add_factor(method) {
         var lock, form = $('#kolab2fa-prop-' + method),
             props = rcmail.env.kolab_2fa_factors[method];
 
         if (form.length) {
             form.get(0).reset();
             form.find('img.qrcode').attr('src', 'data:image/gif;base64,R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7');
             form.off('submit');
 
             factor_dialog = rcmail.show_popup_dialog(
                 form.show(),
                 rcmail.get_label('addfactor', 'kolab_2fa'),
                 [
                     {
                         text: rcmail.gettext('save', 'kolab_2fa'),
-                        'class': 'mainaction',
+                        'class': 'mainaction save',
                         click: function(e) {
                             save_data(method);
                         }
                     },
                     {
                         text: rcmail.gettext('cancel'),
+                        'class': 'cancel',
                         click: function() {
                             factor_dialog.dialog('close');
                         }
                     }
                 ],
                 {
                     open: function(event, ui) {
                         $(event.target).find('input[name="_verify_code"]').keypress(function(e) {
                             if (e.which == 13) {
                                 $(e.target).closest('.ui-dialog').find('.ui-button.mainaction').click();
                             }
                         });
                     },
                     close: function(event, ui) {
                         form.hide().appendTo(document.body);
                         factor_dialog = null;
                     }
                 }
             )
-            .addClass('propform')
             .data('method', method)
             .data('timestamp', time());
 
             form.on('submit', function(e) {
                 save_data(method);
                 return false;
             });
 
             // load generated data
             lock = rcmail.set_busy(true, 'loading');
             rcmail.http_post('plugin.kolab-2fa-data', { _method: method }, lock);
         }
     }
 
     /**
      * Remove the given factor from the account
      */
     function remove_factor(id) {
         if (rcmail.env.kolab_2fa_factors[id]) {
             rcmail.env.kolab_2fa_factors[id].active = false;
         }
         render();
 
         var lock = rcmail.set_busy(true, 'saving');
         rcmail.http_post('plugin.kolab-2fa-save', { _method: id, _data: 'false' }, lock);
     }
 
     /**
      * Submit factor settings form
      */
     function save_data(method) {
         var lock, data, form = $('#kolab2fa-prop-' + method),
             verify = form.find('input[name="_verify_code"]');
 
         if (verify.length && !verify.val().length) {
             alert(rcmail.get_label('verifycodemissing','kolab_2fa'));
             verify.select();
             return false;
         }
 
         data = form_data(form);
         lock = rcmail.set_busy(true, 'saving');
         rcmail.http_post('plugin.kolab-2fa-save', {
             _method: data.id || method,
             _data: JSON.stringify(data),
             _verify_code: verify.val(),
             _timestamp: factor_dialog ? factor_dialog.data('timestamp') : null
         }, lock);
     }
 
     /**
      * Collect all factor properties from the form
      */
     function form_data(form)
     {
         var data = {};
         form.find('input, select').each(function(i, elem) {
             if (elem.name.indexOf('_prop') === 0) {
                 k = elem.name.match(/\[([a-z0-9_.-]+)\]$/i) ? RegExp.$1 : null;
                 if (k) {
                     data[k] = elem.tagName == 'SELECT' ? $('option:selected', elem).val() : $(elem).val();
                 }
             }
         });
 
         return data;
     }
 
     /**
      * Execute the given function after the user authorized the session with a 2nd factor
      */
     function require_high_security(func, exclude)
     {
         // request 2nd factor auth
         if (!rcmail.env.session_secured || rcmail.env.session_secured < time() - 120) {
             var method, name;
 
             // find an active factor
             $.each(rcmail.env.kolab_2fa_factors, function(id, prop) {
                 if (prop.active && !method || method == exclude) {
                     method = id;
                     name = prop.label || prop.name;
                     if (!exclude || id !== exclude) {
                         return true;
                     }
                 }
             });
 
             // we have a registered factor, use it
             if (method) {
                 highsec_call_stack.push(func);
 
                 // TODO: list all active factors to choose from
                 var html = String($('#kolab2fa-highsecuritydialog').html()).replace('$name', name);
 
                 highsec_dialog = rcmail.show_popup_dialog(
                     html,
                     rcmail.get_label('highsecurityrequired', 'kolab_2fa'),
                     [
                         {
                             text: rcmail.gettext('enterhighsecurity', 'kolab_2fa'),
                             click: function(e) {
                                 var lock, code = highsec_dialog.find('input[name="_code"]').val();
 
                                 if (code && code.length) {
                                     lock = rcmail.set_busy(true, 'verifying');
                                     rcmail.http_post('plugin.kolab-2fa-verify', {
                                         _method: method,
                                         _code: code,
                                         _session: 1,
                                         _timestamp: highsec_dialog.data('timestamp')
                                     }, lock);
                                 }
                                 else {
                                     highsec_dialog.find('input[name="_code"]').select();
                                 }
                             },
-                            'class': 'mainaction'
+                            'class': 'mainaction save'
                         },
                         {
                             text: rcmail.gettext('cancel'),
+                            'class': 'cancel',
                             click: function() {
                                 highsec_dialog.dialog('close');
                             }
                         }
                     ],
                     {
                         open: function(event, ui) {
                             // submit code on <Enter>
                             $(event.target).find('input[name="_code"]').keypress(function(e) {
                                 if (e.which == 13) {
                                     $(e.target).closest('.ui-dialog').find('.ui-button.mainaction').click();
                                 }
                             }).select();
                         },
                         close: function(event, ui) {
                             $(this).remove();
                             highsec_dialog = null;
                             highsec_call_stack.pop();
                         }
                     }
                 ).data('timestamp', time());
 
                 return false;
             }
         }
 
         // just trigger the callback
         func.call(this);
     };
 
     // callback for factor data provided by the server
     rcmail.addEventListener('plugin.render_data', function(data) {
         var method = data.method,
             form = $('#kolab2fa-prop-' + method);
 
         if (form.length) {
             $.each(data, function(field, value) {
                 form.find('[name="_prop[' + field + ']"]').val(value);
             });
 
             if (data.qrcode) {
                 $('img.qrcode[rel='+method+']').attr('src', "data:image/png;base64," + data.qrcode);
             }
         }
         else if (window.console) {
             console.error("Cannot assign auth data", data);
         }
     });
 
     // callback for save action
     rcmail.addEventListener('plugin.save_success', function(data) {
         if (!data.active && rcmail.env.kolab_2fa_factors[data.id]) {
             delete rcmail.env.kolab_2fa_factors[data.id];
         }
         else if (rcmail.env.kolab_2fa_factors[data.id]) {
             $.extend(rcmail.env.kolab_2fa_factors[data.id], data);
         }
         else {
             rcmail.env.kolab_2fa_factors[data.id] = data;
         }
 
         if (factor_dialog) {
             factor_dialog.dialog('close');
         }
 
         render();
     });
 
     // callback for verify action
     rcmail.addEventListener('plugin.verify_response', function(data) {
         // execute high-security call stack and close dialog
         if (data.success && highsec_dialog && highsec_dialog.is(':visible')) {
             var func;
             while (highsec_call_stack.length) {
                 func = highsec_call_stack.pop();
                 func();
             }
 
             highsec_dialog.dialog('close');
             rcmail.env.session_secured = time();
         }
         else {
             rcmail.display_message(data.message, data.success ? 'confirmation' : 'warning');
 
             if (highsec_dialog && highsec_dialog.is(':visible')) {
                 highsec_dialog.find('input[name="_code"]').val('').select();
             }
             else {
                 $('#kolab2fa-prop-' + data.method + ' input.k2fa-verify').val('').select();
             }
         }
     });
 
     // callback for save failure
     rcmail.addEventListener('plugin.reset_form', function(method) {
         if (rcmail.env.kolab_2fa_factors[method]) {
             rcmail.env.kolab_2fa_factors[method].active = false;
         }
 
         render();
     });
 
     // handler for selections
     $('#kolab2fa-add').change(function() {
         var method = $('option:selected', this).val();
 
         // require auth verification
         require_high_security(function() {
             add_factor(method);
         });
 
         this.selectedIndex = 0;
     });
 
     // handler for delete button clicks
     $('#kolab2fa-factors tbody').on('click', '.button.delete', function(e) {
         var id = $(this).attr('rel');
 
         // require auth verification
         require_high_security(function() {
             if (confirm(rcmail.get_label('authremoveconfirm', 'kolab_2fa'))) {
                 remove_factor(id);
             }
         }, id);
 
         return false;
     });
 
     // submit verification code on <Enter>
     $('.propform input.k2fa-verify').keypress(function(e) {
         if (e.which == 13) {
             $(this).closest('.propform').find('.button.verify').click();
         }
     });
 
     // render list initially
     render();
 });
\ No newline at end of file
diff --git a/plugins/kolab_2fa/kolab_2fa.php b/plugins/kolab_2fa/kolab_2fa.php
index f1f78788..f1794588 100644
--- a/plugins/kolab_2fa/kolab_2fa.php
+++ b/plugins/kolab_2fa/kolab_2fa.php
@@ -1,767 +1,774 @@
 <?php
 
 /**
  * Kolab 2-Factor-Authentication plugin
  *
- * ...
- *
  * @author Thomas Bruederli <bruederli@kolabsys.com>
  *
  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
  * published by the Free Software Foundation, either version 3 of the
  * License, or (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU Affero General Public License for more details.
  *
  * You should have received a copy of the GNU Affero General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
 class kolab_2fa extends rcube_plugin
 {
     public $task = '(login|settings)';
 
     protected $login_verified = null;
     protected $login_factors = array();
     protected $drivers = array();
     protected $storage;
 
     /**
      * Plugin init
      */
     public function init()
     {
         $this->load_config();
         $this->add_hook('startup', array($this, 'startup'));
     }
 
     /**
      * Startup hook
      */
     public function startup($args)
     {
         $rcmail = rcmail::get_instance();
 
         // register library namespace to autoloader
         $loader = include(INSTALL_PATH . 'vendor/autoload.php');
         $loader->set('Kolab2FA', array($this->home . '/lib'));
 
         if ($args['task'] === 'login' && $this->api->output) {
             $this->add_texts('localization/', false);
             $this->add_hook('authenticate', array($this, 'authenticate'));
 
             // process 2nd factor auth step after regular login
             if ($args['action'] === 'plugin.kolab-2fa-login' /* || !empty($_SESSION['kolab_2fa_factors']) */) {
                 return $this->login_verify($args);
             }
         }
         else if ($args['task'] === 'settings') {
             $this->add_texts('localization/', !$this->api->output->ajax_call);
             $this->add_hook('settings_actions', array($this, 'settings_actions'));
             $this->register_action('plugin.kolab-2fa', array($this, 'settings_view'));
             $this->register_action('plugin.kolab-2fa-data', array($this, 'settings_data'));
             $this->register_action('plugin.kolab-2fa-save', array($this, 'settings_save'));
             $this->register_action('plugin.kolab-2fa-verify', array($this, 'settings_verify'));
         }
 
         return $args;
     }
 
     /**
      * Handler for 'authenticate' plugin hook.
      *
      * ATTENTION: needs to be called *after* kolab_auth::authenticate()
      */
     public function authenticate($args)
     {
         // nothing to be done for me
         if ($args['abort'] || $this->login_verified !== null) {
             return $args;
         }
 
         $rcmail = rcmail::get_instance();
 
         // parse $host URL
         $a_host = parse_url($args['host']);
         $hostname = $_SESSION['hostname'] = $a_host['host'] ?: $args['host'];
 
         // 1. find user record (and its prefs) before IMAP login
         if ($user = rcube_user::query($args['user'], $hostname)) {
             $rcmail->config->set_user_prefs($user->get_prefs());
         }
 
         // 2a. let plugins provide the list of active authentication factors
         $lookup = $rcmail->plugins->exec_hook('kolab_2fa_lookup', array(
             'user'    => $args['user'],
             'host'    => $hostname,
             'factors' => $rcmail->config->get('kolab_2fa_factors'),
             'check'   => $rcmail->config->get('kolab_2fa_check', true),
         ));
         if (isset($lookup['factors'])) {
             $factors = (array)$lookup['factors'];
         }
         // 2b. check storage if this user has 2FA enabled
         else if ($lookup['check'] !== false && ($storage = $this->get_storage($args['user']))) {
             $factors = (array)$storage->enumerate();
         }
 
         if (count($factors) > 0) {
             $args['abort'] = true;
             $factors = array_unique($factors);
 
             // 3. flag session for 2nd factor verification
             $_SESSION['kolab_2fa_time']    = time();
             $_SESSION['kolab_2fa_nonce']   = bin2hex(openssl_random_pseudo_bytes(32));
             $_SESSION['kolab_2fa_factors'] = $factors;
 
             $_SESSION['username'] = $args['user'];
             $_SESSION['host']     = $args['host'];
             $_SESSION['password'] = $rcmail->encrypt($args['pass']);
 
             // 4. render to 2nd auth step
             $this->login_step($factors);
         }
 
         return $args;
     }
 
     /**
      * Handler for the additional login step requesting the 2FA verification code
      */
     public function login_step($factors)
     {
         // replace handler for login form
         $this->login_factors = array_values($factors);
         $this->api->output->add_handler('loginform', array($this, 'auth_form'));
 
         // focus the code input field on load
         $this->api->output->add_script('$("input.kolab2facode").first().select();', 'docready');
 
         $this->api->output->send('login');
     }
 
     /**
      * Process the 2nd factor code verification form submission
      */
     public function login_verify($args)
     {
         $rcmail = rcmail::get_instance();
 
         $time  = $_SESSION['kolab_2fa_time'];
         $nonce = $_SESSION['kolab_2fa_nonce'];
         $factors = (array)$_SESSION['kolab_2fa_factors'];
 
         $this->login_verified = false;
         $expired = $time < time() - $rcmail->config->get('kolab_2fa_timeout', 120);
 
         if (!empty($factors) && !empty($nonce) && !$expired) {
             // TODO: check signature
 
             // try to verify each configured factor
             foreach ($factors as $factor) {
                 list($method) = explode(':', $factor, 2);
 
                 // verify the submitted code
                 $code = rcube_utils::get_input_value("_${nonce}_${method}", rcube_utils::INPUT_POST);
                 $this->login_verified = $this->verify_factor_auth($factor, $code);
 
                 // accept first successful method
                 if ($this->login_verified) {
                     break;
                 }
             }
         }
 
         if ($this->login_verified) {
             // restore POST data from session
             $_POST['_user'] = $_SESSION['username'];
             $_POST['_host'] = $_SESSION['host'];
             $_POST['_pass'] = $rcmail->decrypt($_SESSION['password']);
         }
 
         // proceed with regular login ...
         $args['action'] = 'login';
 
         // session data will be reset in index.php thus additional
         // auth attempts with intercepted data will be rejected
         // $rcmail->kill_session();
 
         // we can't display any custom error messages on failed login
         // but that's actually desired to expose as little information as possible
 
         return $args;
     }
     
     /**
      * Helper method to verify the given method/code tuple
      */
     protected function verify_factor_auth($method, $code)
     {
         if (strlen($code) && ($driver = $this->get_driver($method))) {
             // set properties from login
             $driver->username  = $_SESSION['username'];
 
             try {
                 // verify the submitted code
                 return $driver->verify($code, $_SESSION['kolab_2fa_time']);
             }
             catch (Exception $e) {
                 rcube::raise_error($e, true, false);
             }
         }
 
         return false;
     }
 
     /**
      * Render 2nd factor authentication form in place of the regular login form
      */
     public function auth_form($attrib = array())
     {
         $form_name  = !empty($attrib['form']) ? $attrib['form'] : 'form';
         $nonce = $_SESSION['kolab_2fa_nonce'];
 
         $methods = array_unique(array_map(function($factor) {
                 list($method, $id) = explode(':', $factor);
                 return $method;
             },
             $this->login_factors
         ));
 
         // forward these values as the regular login screen would submit them
         $input_task   = new html_hiddenfield(array('name' => '_task', 'value' => 'login'));
         $input_action = new html_hiddenfield(array('name' => '_action', 'value' => 'plugin.kolab-2fa-login'));
         $input_tzone  = new html_hiddenfield(array('name' => '_timezone', 'id' => 'rcmlogintz', 'value' => rcube_utils::get_input_value('_timezone', rcube_utils::INPUT_POST)));
         $input_url    = new html_hiddenfield(array('name' => '_url', 'id' => 'rcmloginurl', 'value' => rcube_utils::get_input_value('_url', rcube_utils::INPUT_POST)));
 
         // create HTML table with two cols
         $table = new html_table(array('cols' => 2));
         $required = count($methods) > 1 ? null : 'required';
 
         // render input for each configured auth method
         foreach ($methods as $i => $method) {
             if ($row++ > 0) {
                 $table->add(array('colspan' => 2, 'class' => 'title hint', 'style' => 'text-align:center'),
                     $this->gettext('or'));
             }
 
             $field_id = "rcmlogin2fa$method";
-            $input_code = new html_inputfield(array('name' => "_${nonce}_${method}", 'class' => 'kolab2facode', 'id' => $field_id, 'required' => $required, 'autocomplete' => 'off')
-                + $attrib);
+            $input_code = new html_inputfield(array(
+                    'name'         => "_${nonce}_${method}",
+                    'class'        => 'kolab2facode',
+                    'id'           => $field_id,
+                    'required'     => $required,
+                    'autocomplete' => 'off',
+                    'data-icon'    => 'key' // for Elastic
+                ) + $attrib);
             $table->add('title', html::label($field_id, html::quote($this->gettext($method))));
             $table->add('input', $input_code->show(''));
         }
 
         $out  = $input_task->show();
         $out .= $input_action->show();
         $out .= $input_tzone->show();
         $out .= $input_url->show();
         $out .= $table->show();
 
         // add submit button
         if (rcube_utils::get_boolean($attrib['submit'])) {
-            $submit = new html_inputfield(array('type' => 'submit', 'id' => 'rcmloginsubmit',
-                'class' => 'button mainaction', 'value' => $this->gettext('continue')));
-            $out .= html::p('formbuttons', $submit->show());
+            $out .= html::p('formbuttons', html::tag('button', array(
+                    'type'  => 'submit',
+                    'id'    => 'rcmloginsubmit',
+                    'class' => 'button mainaction save',
+                ), $this->gettext('continue'))
+            );
         }
 
         // surround html output with a form tag
         if (empty($attrib['form'])) {
             $out = $this->api->output->form_tag(array('name' => $form_name, 'method' => 'post'), $out);
         }
 
         return $out;
     }
 
     /**
      * Load driver class for the given authentication factor
      *
      * @param string $factor Factor identifier (<method>:<id>)
      * @return Kolab2FA\Driver\Base
      */
     public function get_driver($factor)
     {
         list($method) = explode(':', $factor, 2);
 
         $rcmail = rcmail::get_instance();
 
         if ($this->drivers[$factor]) {
             return $this->drivers[$factor];
         }
 
         $config = $rcmail->config->get('kolab_2fa_' . $method, array());
 
         // use product name as "issuer""
         if (empty($config['issuer'])) {
             $config['issuer'] = $rcmail->config->get('product_name');
         }
 
         try {
             // TODO: use external auth service if configured
 
             $driver = \Kolab2FA\Driver\Base::factory($factor, $config);
 
             // attach storage
             $driver->storage = $this->get_storage();
 
             if ($rcmail->user->ID) {
                 $driver->username  = $rcmail->get_user_name();
             }
 
             $this->drivers[$factor] = $driver;
             return $driver;
         }
         catch (Exception $e) {
             $error = strval($e);
         }
 
         rcube::raise_error(array(
                 'code' => 600,
                 'type' => 'php',
                 'file' => __FILE__,
                 'line' => __LINE__,
                 'message' => $error),
             true, false);
 
         return false;
     }
 
     /**
      * Getter for a storage instance singleton
      */
     public function get_storage($for = null)
     {
         if (!isset($this->storage) || (!empty($for) && $this->storage->username !== $for)) {
             $rcmail = rcmail::get_instance();
             try {
                 $this->storage = \Kolab2FA\Storage\Base::factory(
                     $rcmail->config->get('kolab_2fa_storage', 'roundcube'),
                     $rcmail->config->get('kolab_2fa_storage_config', array())
                 );
 
                 $this->storage->set_username($for);
                 $this->storage->set_logger(new \Kolab2FA\Log\RcubeLogger());
 
                 // set user properties from active session
                 if (!empty($_SESSION['kolab_dn'])) {
                     $this->storage->userdn = $_SESSION['kolab_dn'];
                 }
             }
             catch (Exception $e) {
                 $this->storage = false;
 
                 rcube::raise_error(array(
                         'code' => 600,
                         'type' => 'php',
                         'file' => __FILE__,
                         'line' => __LINE__,
                         'message' => $error),
                     true, false);
             }
         }
 
         return $this->storage;
     }
 
     /**
      * Handler for 'settings_actions' hook
      */
     public function settings_actions($args)
     {
         // register as settings action
         $args['actions'][] = array(
             'action' => 'plugin.kolab-2fa',
             'class'  => 'twofactorauth',
             'label'  => 'settingslist',
             'title'  => 'settingstitle',
             'domain' => 'kolab_2fa',
         );
 
         return $args;
     }
 
     /**
      * Handler for settings/plugin.kolab-2fa requests
      */
     public function settings_view()
     {
         $this->register_handler('plugin.settingsform', array($this, 'settings_form'));
         $this->register_handler('plugin.settingslist', array($this, 'settings_list'));
         $this->register_handler('plugin.factoradder', array($this, 'settings_factoradder'));
         $this->register_handler('plugin.highsecuritydialog', array($this, 'settings_highsecuritydialog'));
 
         $this->include_script('kolab2fa.js');
         $this->include_stylesheet($this->local_skin_path() . '/kolab2fa.css', true);
 
         if ($this->check_secure_mode()) {
             $this->api->output->set_env('session_secured', $_SESSION['kolab_2fa_secure_mode']);
         }
 
         $this->api->output->add_label('save','cancel');
         $this->api->output->set_pagetitle($this->gettext('settingstitle'));
         $this->api->output->send('kolab_2fa.config');
     }
 
     /**
      * Render the menu to add another authentication factor
      */
     public function settings_factoradder($attrib)
     {
         $rcmail = rcmail::get_instance();
 
-        $select = new html_select(array('id' => 'kolab2fa-add'));
+        $attrib['id'] = 'kolab2fa-add';
+
+        $select = new html_select($attrib);
         $select->add($this->gettext('addfactor') . '...', '');
         foreach ((array)$rcmail->config->get('kolab_2fa_drivers', array()) as $method) {
             $select->add($this->gettext($method), $method);
         }
 
         return $select->show();
     }
 
     /**
      * Render a list of active factor this user has configured
      */
     public function settings_list($attrib = array())
     {
         $attrib['id'] = 'kolab2fa-factors';
         $table = new html_table(array('cols' => 3));
 
         $table->add_header('name', $this->gettext('factor'));
         $table->add_header('created', $this->gettext('created'));
         $table->add_header('actions', '');
 
         return $table->show($attrib);
     }
 
     /**
      * Render the settings form template object
      */
     public function settings_form($attrib = array())
     {
         $rcmail = rcmail::get_instance();
         $storage = $this->get_storage($rcmail->get_user_name());
         $factors = $storage ? (array)$storage->enumerate() : array();
         $drivers = (array)$rcmail->config->get('kolab_2fa_drivers', array());
         $env_methods = array();
 
         foreach ($drivers as $j => $method) {
             $out .= $this->settings_factor($method, $attrib);
             $env_methods[$method] = array(
                 'name'   => $this->gettext($method),
                 'active' => 0,
             );
         }
 
         $me = $this;
         $factors = array_combine(
             $factors,
             array_map(function($id) use ($me, &$env_methods) {
                 $props = array('id' => $id);
 
                 if ($driver = $me->get_driver($id)) {
                     $props += $this->format_props($driver->props());
                     $props['method'] = $driver->method;
                     $props['name'] = $me->gettext($driver->method);
                     $env_methods[$driver->method]['active']++;
                 }
 
                 return $props;
             }, $factors)
         );
 
         $this->api->output->set_env('kolab_2fa_methods', $env_methods);
         $this->api->output->set_env('kolab_2fa_factors', !empty($factors) ? $factors : null);
 
         return html::div(array('id' => 'kolab2fapropform'), $out);
     }
 
     /**
      * Render the settings UI for the given method/driver
      */
     protected function settings_factor($method, $attrib)
     {
         $out = '';
         $rcmail = rcmail::get_instance();
         $attrib += array('class' => 'propform');
 
         if ($driver = $this->get_driver($method)) {
             $table = new html_table(array('cols' => 2, 'class' => $attrib['class']));
 
             foreach ($driver->props() as $field => $prop) {
                 if (!$prop['editable']) {
                     continue;
                 }
 
                 switch ($prop['type']) {
                     case 'boolean':
                     case 'checkbox':
                         $input = new html_checkbox(array('value' => '1'));
                         break;
 
                     case 'enum':
                     case 'select':
                         $input = new html_select(array('disabled' => $prop['readonly']));
                         $input->add(array_map(array($this, 'gettext'), $prop['options']), $prop['options']);
                         break;
 
                     default:
                         $input = new html_inputfield(array('size' => $prop['size'] ?: 30, 'disabled' => !$prop['editable']));
                 }
 
                 $explain_label = $field . 'explain' . $method;
-                $explain_html = $rcmail->text_exists($explain_label, 'kolab_2fa') ? html::p('explain', $this->gettext($explain_label)) : '';
+                $explain_html = $rcmail->text_exists($explain_label, 'kolab_2fa') ? html::div('explain form-text', $this->gettext($explain_label)) : '';
 
                 $field_id = 'rcmk2fa' . $method . $field;
                 $table->add('title', html::label($field_id, $this->gettext($field)));
                 $table->add(null, $input->show('', array('id' => $field_id, 'name' => "_prop[$field]")) . $explain_html);
             }
 
             // add row for displaying the QR code
             if (method_exists($driver, 'get_provisioning_uri')) {
                 $table->add('title', $this->gettext('qrcode'));
                 $table->add(null,
-                    html::p('explain',
-                        $this->gettext("qrcodeexplain$method")
-                    ) .
-                    html::p(null,
-                        html::tag('img', array('src' => 'data:image/gif;base64,R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7', 'class' => 'qrcode', 'rel' => $method))
-                    )
+                    html::div('explain form-text', $this->gettext("qrcodeexplain$method"))
+                    . html::tag('img', array('src' => 'data:image/gif;base64,R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7', 'class' => 'qrcode', 'rel' => $method))
                 );
 
                 // add row for testing the factor
                 $field_id = 'rcmk2faverify' . $method;
                 $table->add('title', html::label($field_id, $this->gettext('verifycode')));
                 $table->add(null,
                     html::tag('input', array('type' => 'text', 'name' => '_verify_code', 'id' => $field_id, 'class' => 'k2fa-verify', 'size' => 20, 'required' => true)) .
-                    html::p('explain', $this->gettext("verifycodeexplain$method"))
+                    html::div('explain form-text', $this->gettext("verifycodeexplain$method"))
                 );
 
             }
 
             $input_id = new html_hiddenfield(array('name' => '_prop[id]', 'value' => ''));
 
             $out .= html::tag('form', array(
                     'method' => 'post',
                     'action' => '#',
-                    'id' => 'kolab2fa-prop-' . $method,
-                    'style' => 'display:none',
+                    'id'     => 'kolab2fa-prop-' . $method,
+                    'style'  => 'display:none',
+                    'class'  => 'propform',
                 ),
                 html::tag('fieldset', array(),
                     html::tag('legend', array(), $this->gettext($method)) .
                     html::div('factorprop', $table->show()) .
                     $input_id->show()
                 )
             );
         }
 
         return $out;
     }
-    
+
     /**
-     * Render th
+     * Render the high-security-dialog content
      */
     public function settings_highsecuritydialog($attrib = array())
     {
         $attrib += array('id' => 'kolab2fa-highsecuritydialog');
 
         $field_id = 'rcmk2facode';
         $input = new html_inputfield(array('name' => '_code', 'id' => $field_id, 'class' => 'verifycode', 'size' => 20));
+        $label = html::label(array('for' => $field_id, 'class' => 'col-form-label col-sm-4'), '$name');
 
         return html::div($attrib,
-            html::p('explain', $this->gettext('highsecuritydialog')) .
-            html::div('propform', html::label($field_id, '$name') . $input->show(''))
+            html::div('explain form-text', $this->gettext('highsecuritydialog'))
+            . html::div('propform row form-group', $label . html::div('col-sm-8', $input->show('')))
         );
     }
 
     /**
      * Handler for settings/plugin.kolab-2fa-save requests
      */
     public function settings_save()
     {
         $method = rcube_utils::get_input_value('_method', rcube_utils::INPUT_POST);
         $data   = @json_decode(rcube_utils::get_input_value('_data', rcube_utils::INPUT_POST), true);
 
         $rcmail = rcmail::get_instance();
         $storage = $this->get_storage($rcmail->get_user_name());
         $success = false;
         $errors = 0;
         $save_data = array();
 
         if ($driver = $this->get_driver($method)) {
             if ($data === false) {
                 if ($this->check_secure_mode()) {
                     // remove method from active factors and clear stored settings
                     $success = $driver->clear();
                 }
                 else {
                     $errors++;
                 }
             }
             else {
                 // verify the submitted code before saving
                 $verify_code = rcube_utils::get_input_value('_verify_code', rcube_utils::INPUT_POST);
                 $timestamp = intval(rcube_utils::get_input_value('_timestamp', rcube_utils::INPUT_POST));
                 if (!empty($verify_code)) {
                     if (!$driver->verify($verify_code, $timestamp)) {
                         $this->api->output->command('plugin.verify_response', array(
                             'id'      => $driver->id,
                             'method'  => $driver->method,
                             'success' => false,
                             'message' => str_replace('$method', $this->gettext($driver->method), $this->gettext('codeverificationfailed'))
                         ));
                         $this->api->output->send();
                     }
                 }
 
                 foreach ($data as $prop => $value) {
                     if (!$driver->set($prop, $value)) {
                         $errors++;
                     }
                 }
 
                 $driver->set('active', true);
             }
 
             // commit changes to the user properties
             if (!$errors) {
                 if ($success = $driver->commit()) {
                     $save_data = $data !== false ? $this->format_props($driver->props()) : array();
                 }
                 else {
                     $errors++;
                 }
             }
         }
 
         if ($success) {
             $this->api->output->show_message($data === false ? $this->gettext('factorremovesuccess') : $this->gettext('factorsavesuccess'), 'confirmation');
             $this->api->output->command('plugin.save_success', array(
                     'method' => $method,
                     'active' => $data !== false,
                     'id'     => $driver->id) + $save_data);
         }
         else if ($errors) {
             $this->api->output->show_message($this->gettext('factorsaveerror'), 'error');
             $this->api->output->command('plugin.reset_form', $method);
         }
 
         $this->api->output->send();
     }
 
     /**
      * Handler for settings/plugin.kolab-2fa-data requests
      */
     public function settings_data()
     {
         $method = rcube_utils::get_input_value('_method', rcube_utils::INPUT_POST);
 
         if ($driver = $this->get_driver($method)) {
             $data = array('method' => $method, 'id' => $driver->id);
 
             foreach ($driver->props(true) as $field => $prop) {
                 $data[$field] = $prop['text'] ?: $prop['value'];
             }
 
             // generate QR code for provisioning URI
             if (method_exists($driver, 'get_provisioning_uri')) {
                 try {
                     $uri = $driver->get_provisioning_uri();
 
                     $qr = new Endroid\QrCode\QrCode();
                     $qr->setText($uri)
                        ->setSize(240)
                        ->setPadding(10)
                        ->setErrorCorrection('high')
                        ->setForegroundColor(array('r' => 0, 'g' => 0, 'b' => 0, 'a' => 0))
                        ->setBackgroundColor(array('r' => 255, 'g' => 255, 'b' => 255, 'a' => 0));
                     $data['qrcode'] = base64_encode($qr->get());
                 }
                 catch (Exception $e) {
                     rcube::raise_error($e, true, false);
                 }
             }
 
             $this->api->output->command('plugin.render_data', $data);
         }
 
         $this->api->output->send();
     }
 
     /**
      * Handler for settings/plugin.kolab-2fa-verify requests
      */
     public function settings_verify()
     {
         $method = rcube_utils::get_input_value('_method', rcube_utils::INPUT_POST);
         $timestamp = intval(rcube_utils::get_input_value('_timestamp', rcube_utils::INPUT_POST));
         $success = false;
 
         if ($driver = $this->get_driver($method)) {
             $data = @json_decode(rcube_utils::get_input_value('_data', rcube_utils::INPUT_POST), true);
             if (is_array($data)) {
                 foreach ($data as $key => $value) {
                     if ($value !== '******') {
                         $driver->$key = $value;
                     }
                 }
             }
 
             $success = $driver->verify(rcube_utils::get_input_value('_code', rcube_utils::INPUT_POST), $timestamp);
             $method = $driver->method;
         }
 
         // put session into high-security mode
         if ($success && !empty($_POST['_session'])) {
             $_SESSION['kolab_2fa_secure_mode'] = time();
         }
 
         $this->api->output->command('plugin.verify_response', array(
             'method' => $method,
             'success' => $success,
             'message' => str_replace('$method', $this->gettext($method),
                 $this->gettext($success ? 'codeverificationpassed' : 'codeverificationfailed'))
         ));
 
         $this->api->output->send();
     }
 
     /**
      *
      */
     protected function format_props($props)
     {
         $rcmail = rcmail::get_instance();
         $values = array();
 
         foreach ($props as $key => $prop) {
             switch ($prop['type']) {
                 case 'datetime':
                     $value = $rcmail->format_date($prop['value']);
                     break;
 
                 default:
                     $value = $prop['value'];
             }
 
             $values[$key] = $value;
         }
 
         return $values;
     }
 
     /**
      *
      */
     protected function check_secure_mode()
     {
         $valid = ($_SESSION['kolab_2fa_secure_mode'] && $_SESSION['kolab_2fa_secure_mode'] > time() - 180);
         return $valid;
     }
 
 }
\ No newline at end of file
diff --git a/plugins/kolab_2fa/skins/elastic/templates/config.html b/plugins/kolab_2fa/skins/elastic/templates/config.html
new file mode 100644
index 00000000..6b76b8fc
--- /dev/null
+++ b/plugins/kolab_2fa/skins/elastic/templates/config.html
@@ -0,0 +1,25 @@
+<roundcube:include file="includes/layout.html" />
+<roundcube:include file="includes/menu.html" />
+<roundcube:include file="includes/settings-menu.html" />
+
+<h1 class="voice"><roundcube:label name="kolab_2fa.settingstitle" /></h1>
+
+<div class="content selected no-navbar" role="main">
+	<h2 id="aria-label-toolbar" class="voice"><roundcube:label name="arialabeltoolbar" /></h2>
+	<div class="header" role="toolbar" aria-labelledby="aria-label-toolbar">
+		<a class="button icon back-list-button" href="#back"><span class="inner"><roundcube:label name="back" /></span></a>
+		<span class="header-title"><roundcube:label name="kolab_2fa.settingstitle" /></span>
+		<div class="toolbar"></div>
+	</div>
+	<div class="scroller frame-content">
+		<p class="addfactor">
+			<roundcube:object name="plugin.factoradder" class="form-control" />
+		</p>
+		<roundcube:object name="plugin.settingslist" class="authentication-factors" />
+	</div>
+</div>
+
+<roundcube:object name="plugin.settingsform" class="propform" />
+<roundcube:object name="plugin.highsecuritydialog" class="kolab2fa-highsecuritydialog hidden" />
+
+<roundcube:include file="includes/footer.html" />