diff --git a/arangod/Indexes/EdgeIndex.cpp b/arangod/Indexes/EdgeIndex.cpp
index 735a93ea4f..d5a538ff38 100644
--- a/arangod/Indexes/EdgeIndex.cpp
+++ b/arangod/Indexes/EdgeIndex.cpp
@@ -225,6 +225,44 @@ TRI_doc_mptr_t* EdgeIndexIterator::next() {
   }
 }
 
+void EdgeIndexIterator::nextBabies(std::vector<TRI_doc_mptr_t*>& buffer, size_t limit) {
+  size_t atMost = _batchSize > limit ? limit : _batchSize;
+
+  while (true) {
+    if (_position >= static_cast<size_t>(_keys.length())) {
+      // we're at the end of the lookup values
+      buffer.clear();
+      return;
+    }
+
+    if (buffer.empty()) {
+      VPackSlice tmp = _keys.at(_position);
+      if (tmp.isObject()) {
+        tmp = tmp.get(TRI_SLICE_KEY_EQUAL);
+      }
+      _index->lookupByKey(_trx, &tmp, buffer, atMost);
+      // fallthrough intentional
+    } else {
+      // Continue the lookup
+      auto last = buffer.back();
+      buffer.clear();
+
+      _index->lookupByKeyContinue(_trx, last, buffer, atMost);
+    }
+
+    if (!buffer.empty()) {
+      // found something
+      return;
+      //return buffer.at(_posInBuffer++);
+    }
+
+    // found no result. now go to next lookup value in _keys
+    ++_position;
+  }
+}
+
+
+
 void EdgeIndexIterator::reset() {
   _position = 0;
   _posInBuffer = 0;
diff --git a/arangod/Indexes/EdgeIndex.h b/arangod/Indexes/EdgeIndex.h
index a2e06ea110..135e8825e4 100644
--- a/arangod/Indexes/EdgeIndex.h
+++ b/arangod/Indexes/EdgeIndex.h
@@ -41,6 +41,8 @@ class EdgeIndexIterator final : public IndexIterator {
 
   TRI_doc_mptr_t* next() override;
 
+  void nextBabies(std::vector<TRI_doc_mptr_t*>&, size_t) override;
+
   void reset() override;
 
   EdgeIndexIterator(arangodb::Transaction* trx,
diff --git a/arangod/Indexes/IndexIterator.cpp b/arangod/Indexes/IndexIterator.cpp
index fa6deb0bab..c070f6e1da 100644
--- a/arangod/Indexes/IndexIterator.cpp
+++ b/arangod/Indexes/IndexIterator.cpp
@@ -93,6 +93,14 @@ IndexIterator::~IndexIterator() {}
 
 TRI_doc_mptr_t* IndexIterator::next() { return nullptr; }
 
+////////////////////////////////////////////////////////////////////////////////
+/// @brief default implementation for nextBabies
+////////////////////////////////////////////////////////////////////////////////
+
+void IndexIterator::nextBabies(std::vector<TRI_doc_mptr_t*>&, size_t) {
+  THROW_ARANGO_EXCEPTION(TRI_ERROR_NOT_IMPLEMENTED);
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 /// @brief default implementation for reset
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/arangod/Indexes/IndexIterator.h b/arangod/Indexes/IndexIterator.h
index 6c57a5ff1a..403ee3fa8f 100644
--- a/arangod/Indexes/IndexIterator.h
+++ b/arangod/Indexes/IndexIterator.h
@@ -68,6 +68,8 @@ class IndexIterator {
 
   virtual TRI_doc_mptr_t* next();
 
+  virtual void nextBabies(std::vector<TRI_doc_mptr_t*>&, size_t);
+
   virtual void reset();
 
   virtual void skip(uint64_t count, uint64_t& skipped);
diff --git a/arangod/Utils/OperationCursor.cpp b/arangod/Utils/OperationCursor.cpp
index a70c59dcfb..88e505a7d6 100644
--- a/arangod/Utils/OperationCursor.cpp
+++ b/arangod/Utils/OperationCursor.cpp
@@ -63,6 +63,7 @@ void OperationCursor::getMore(std::shared_ptr<OperationResult>& opRes,
     TRI_ASSERT(false);
     // You requested more even if you should have checked it before.
     opRes->code = TRI_ERROR_FORBIDDEN;
+    return;
   }
   if (batchSize == UINT64_MAX) {
     batchSize = _batchSize;
@@ -93,6 +94,69 @@ void OperationCursor::getMore(std::shared_ptr<OperationResult>& opRes,
   }
 }
 
+//////////////////////////////////////////////////////////////////////////////
+/// @brief Get next batchSize many elements. mptr variant
+///        Defaults to _batchSize
+///        Check hasMore()==true before using this
+///        NOTE: This will throw on OUT_OF_MEMORY
+//////////////////////////////////////////////////////////////////////////////
+
+std::vector<TRI_doc_mptr_t*> OperationCursor::getMoreMptr(uint64_t batchSize) {
+  std::vector<TRI_doc_mptr_t*> res;
+  getMoreMptr(res, batchSize);
+  return res;
+}
+
+//////////////////////////////////////////////////////////////////////////////
+/// @brief Get next batchSize many elements. mptr variant
+///        Defaults to _batchSize
+///        Check hasMore()==true before using this
+///        NOTE: This will throw on OUT_OF_MEMORY
+///        NOTE: The result vector handed in is used to continue index lookups
+///              The caller shall NOT modify it.
+//////////////////////////////////////////////////////////////////////////////
+
+void OperationCursor::getMoreMptr(std::vector<TRI_doc_mptr_t*>& result,
+                                  uint64_t batchSize) {
+  if (!hasMore()) {
+    TRI_ASSERT(false);
+    // You requested more even if you should have checked it before.
+    return;
+  }
+  if (batchSize == UINT64_MAX) {
+    batchSize = _batchSize;
+  }
+
+  size_t atMost = batchSize > _limit ? _limit : batchSize;
+  _indexIterator->nextBabies(result, atMost);
+
+  size_t got = result.size();
+  if (got == 0) {
+    // Index is empty
+    _hasMore = false;
+    return;
+  }
+  // NOTE: None of these could fall below zero
+  batchSize -= got;
+  _limit -= got;
+
+  /*
+  // result.clear();
+  // TODO: Improve this for baby awareness
+  TRI_doc_mptr_t* mptr = nullptr;
+
+  while (batchSize > 0 && _limit > 0 && (mptr = _indexIterator->next()) != nullptr) {
+    --batchSize;
+    --_limit;
+    result.emplace_back(mptr);
+  }
+  */
+  if (batchSize > 0 || _limit == 0) {
+    // Iterator empty, there is no more
+    _hasMore = false;
+  }
+}
+
 //////////////////////////////////////////////////////////////////////////////
 /// @brief Skip the next toSkip many elements.
 ///        skipped will be increased by the amount of skipped elements afterwards
diff --git a/arangod/Utils/OperationCursor.h b/arangod/Utils/OperationCursor.h
index a819ef3e86..20d3a2cbdb 100644
--- a/arangod/Utils/OperationCursor.h
+++ b/arangod/Utils/OperationCursor.h
@@ -122,6 +122,25 @@ struct OperationCursor {
   void getMore(std::shared_ptr<OperationResult>&, uint64_t batchSize = UINT64_MAX,
                bool useExternals = false);
 
+//////////////////////////////////////////////////////////////////////////////
+/// @brief Get next batchSize many elements. mptr variant
+///        Defaults to _batchSize
+///        Check hasMore()==true before using this
+///        NOTE: This will throw on OUT_OF_MEMORY
+//////////////////////////////////////////////////////////////////////////////
+
+  std::vector<TRI_doc_mptr_t*> getMoreMptr(uint64_t batchSize);
+
+//////////////////////////////////////////////////////////////////////////////
+/// @brief Get next batchSize many elements. mptr variant
+///        Defaults to _batchSize
+///        Check hasMore()==true before using this
+///        NOTE: This will throw on OUT_OF_MEMORY
+///        NOTE: The result vector handed in will be cleared.
+//////////////////////////////////////////////////////////////////////////////
+
+  void getMoreMptr(std::vector<TRI_doc_mptr_t*>& result, uint64_t batchSize);
+
 //////////////////////////////////////////////////////////////////////////////
 /// @brief Skip the next toSkip many elements.
 ///        skipped will be increased by the amount of skipped elements afterwards
diff --git a/arangod/Utils/Transaction.cpp b/arangod/Utils/Transaction.cpp
index ddc20823e9..68b29af9fd 100644
--- a/arangod/Utils/Transaction.cpp
+++ b/arangod/Utils/Transaction.cpp
@@ -1283,7 +1283,7 @@ OperationResult Transaction::insertLocal(std::string const& collectionName,
       VPackArrayIterator itValue(value);
       VPackArrayIterator itResult(ourResult);
       while (itValue.valid() && itResult.valid()) {
-        TRI_ASSERT(itResult->isObject());
+        TRI_ASSERT((*itResult).isObject());
         if (!(*itResult).hasKey("error")) {
           doOneDoc(itValue.value(), itResult.value());
           count++;
diff --git a/arangod/V8Server/V8Traverser.cpp b/arangod/V8Server/V8Traverser.cpp
index ba3a4150cc..65b157aa40 100644
--- a/arangod/V8Server/V8Traverser.cpp
+++ b/arangod/V8Server/V8Traverser.cpp
@@ -665,7 +665,7 @@ static void OutboundNeighbors(std::vector<EdgeCollectionInfo*>& collectionInfos,
                               uint64_t depth = 1) {
   TRI_edge_direction_e dir = TRI_EDGE_OUT;
   std::unordered_set<std::string> nextDepth;
-  auto opRes = std::make_shared<OperationResult>(TRI_ERROR_NO_ERROR);
+  std::vector<TRI_doc_mptr_t*> cursor;
 
   for (auto const& col : collectionInfos) {
     TRI_ASSERT(col != nullptr);
@@ -673,12 +673,9 @@ static void OutboundNeighbors(std::vector<EdgeCollectionInfo*>& collectionInfos,
     for (auto const& start : startVertices) {
       auto edgeCursor = col->getEdges(dir, start);
       while (edgeCursor->hasMore()) {
-        edgeCursor->getMore(opRes, UINT64_MAX, false);
-        if (opRes->failed()) {
-          THROW_ARANGO_EXCEPTION(opRes->code);
-        }
-        VPackSlice edges = opRes->slice();
-        for (auto const& edge : VPackArrayIterator(edges)) {
+        edgeCursor->getMoreMptr(cursor, UINT64_MAX);
+        for (auto const& mptr : cursor) {
+          VPackSlice edge(mptr->vpack());
           if (opts.matchesEdge(edge)) {
             VPackValueLength l;
             char const* v = edge.get(TRI_VOC_ATTRIBUTE_TO).getString(l);
diff --git a/js/apps/system/_admin/aardvark/APP/aardvark.js b/js/apps/system/_admin/aardvark/APP/aardvark.js
index e35dcfe2a5..8282e8f022 100644
--- a/js/apps/system/_admin/aardvark/APP/aardvark.js
+++ b/js/apps/system/_admin/aardvark/APP/aardvark.js
@@ -29,6 +29,7 @@ const dd = require('dedent');
 const internal = require('internal');
 const db = require('@arangodb').db;
 const errors = require('@arangodb').errors;
+const joinPath = require('path').posix.join;
 const notifications = require('@arangodb/configuration').notifications;
 const examples = require('@arangodb/graph-examples/example-graph');
 const createRouter = require('@arangodb/foxx/router');
@@ -44,9 +45,8 @@ module.exports = router;
 
 router.get('/whoAmI', function(req, res) {
   let user = null;
-  if (internal.options()['server.disable-authentication']) {
-    user = false;
-  } else if (req.session && req.session.uid) {
+
+  if (req.session.uid) {
     try {
       const doc = db._users.document(req.session.uid);
       user = doc.user;
@@ -57,6 +57,7 @@ router.get('/whoAmI', function(req, res) {
       sessions.setUser(req.session, null);
     }
   }
+
   res.json({user});
 })
 .summary('Return the current user')
@@ -78,8 +79,16 @@ router.post('/logout', function (req, res) {
 
 
 router.post('/login', function (req, res) {
-  if (!req.session) {
-    req.session = sessions.new();
+  const currentDb = db._name();
+  const actualDb = req.body.database;
+  if (actualDb !== currentDb) {
+    res.redirect(307, joinPath(
+      '/_db',
+      encodeURIComponent(actualDb),
+      module.context.mount,
+      '/login'
+    ));
+    return;
   }
 
   const doc = db._users.firstExample({user: req.body.username});
@@ -94,12 +103,14 @@ router.post('/login', function (req, res) {
 
   sessions.setUser(req.session, doc);
   sessions.save(req.session);
+
   const user = doc.user;
   res.json({user});
 })
 .body({
   username: joi.string().required(),
-  password: joi.string().required().allow('')
+  password: joi.string().required().allow(''),
+  database: joi.string().default(db._name())
 }, 'Login credentials.')
 .error('unauthorized', 'Invalid credentials.')
 .summary('Log in')
@@ -114,7 +125,7 @@ router.use(authRouter);
 
 
 authRouter.use((req, res, next) => {
-  if (!internal.options()['server.disable-authentication'] && (!req.session || !req.session.uid)) {
+  if (!req.session.uid) {
     res.throw('unauthorized');
   }
   next();
@@ -191,16 +202,12 @@ authRouter.post('/query/explain', function(req, res) {
 authRouter.post('/query/upload/:user', function(req, res) {
   let doc;
 
-  if (req.session && req.session.uid) {
-    try {
-      doc = db._users.document(req.session.uid);
-    } catch (e) {
-      if (!e.isArangoError || e.errorNum !== errors.ERROR_ARANGO_DOCUMENT_NOT_FOUND.code) {
-        throw e;
-      }
+  try {
+    doc = db._users.document(req.session.uid);
+  } catch (e) {
+    if (!e.isArangoError || e.errorNum !== errors.ERROR_ARANGO_DOCUMENT_NOT_FOUND.code) {
+      throw e;
     }
-  } else {
-    doc = db._users.firstExample({user: req.pathParams.user});
   }
 
   if (!doc) {
@@ -240,16 +247,12 @@ authRouter.post('/query/upload/:user', function(req, res) {
 authRouter.get('/query/download/:user', function(req, res) {
   let doc;
 
-  if (req.session && req.session.uid) {
-    try {
-      doc = db._users.document(req.session.uid);
-    } catch (e) {
-      if (!e.isArangoError || e.errorNum !== errors.ERROR_ARANGO_DOCUMENT_NOT_FOUND.code) {
-        throw e;
-      }
+  try {
+    doc = db._users.document(req.session.uid);
+  } catch (e) {
+    if (!e.isArangoError || e.errorNum !== errors.ERROR_ARANGO_DOCUMENT_NOT_FOUND.code) {
+      throw e;
     }
-  } else {
-    doc = db._users.firstExample({user: req.pathParams.user});
   }
 
   if (!doc) {
diff --git a/js/apps/system/_admin/aardvark/APP/cluster.js b/js/apps/system/_admin/aardvark/APP/cluster.js
index c1ebdac83f..a9b0d16ad7 100644
--- a/js/apps/system/_admin/aardvark/APP/cluster.js
+++ b/js/apps/system/_admin/aardvark/APP/cluster.js
@@ -28,14 +28,13 @@ const _ = require('lodash');
 const dd = require('dedent');
 const cluster = require('@arangodb/cluster');
 const createRouter = require('@arangodb/foxx/router');
-const internal = require('internal');
 
 const router = createRouter();
 module.exports = router;
 
 
 router.use((req, res, next) => {
-  if (!internal.options()['server.disable-authentication'] && (!req.session || !req.session.uid)) {
+  if (!req.session.uid) {
     res.throw('unauthorized');
   }
   next();
diff --git a/js/apps/system/_admin/aardvark/APP/foxxes.js b/js/apps/system/_admin/aardvark/APP/foxxes.js
index 646672fa56..9c55b5efdb 100644
--- a/js/apps/system/_admin/aardvark/APP/foxxes.js
+++ b/js/apps/system/_admin/aardvark/APP/foxxes.js
@@ -28,7 +28,6 @@ const fs = require('fs');
 const joi = require('joi');
 const dd = require('dedent');
 const marked = require('marked');
-const internal = require('internal');
 const highlightAuto = require('highlight.js').highlightAuto;
 const FoxxManager = require('@arangodb/foxx/manager');
 const fmUtils = require('@arangodb/foxx/manager-utils');
@@ -41,7 +40,7 @@ module.exports = router;
 
 
 router.use((req, res, next) => {
-  if (!internal.options()['server.disable-authentication'] && (!req.session || !req.session.uid)) {
+  if (!req.session.uid) {
     res.throw('unauthorized');
   }
   next();
diff --git a/js/apps/system/_admin/aardvark/APP/index.js b/js/apps/system/_admin/aardvark/APP/index.js
index 202e5818a3..3199792231 100644
--- a/js/apps/system/_admin/aardvark/APP/index.js
+++ b/js/apps/system/_admin/aardvark/APP/index.js
@@ -32,11 +32,17 @@ module.context.sessions = systemStorage();
 module.context.auth = auth('sha256');
 
 module.context.use(sessionsMiddleware({
-  autoCreate: false,
   transport: cookieTransport(`arango_sid_${db._name()}`),
   storage: module.context.sessions
 }));
 
+module.context.use((req, res, next) => {
+  if (module.context.configuration.sessionPruneProb > Math.random()) {
+    module.context.sessions.prune();
+  }
+  next();
+});
+
 module.context.use(require('./aardvark'));
 module.context.use('/foxxes', require('./foxxes'));
 module.context.use('/cluster', require('./cluster'));
diff --git a/js/apps/system/_admin/aardvark/APP/manifest.json b/js/apps/system/_admin/aardvark/APP/manifest.json
index 3c4d5a2625..6cf9417f3f 100644
--- a/js/apps/system/_admin/aardvark/APP/manifest.json
+++ b/js/apps/system/_admin/aardvark/APP/manifest.json
@@ -32,6 +32,14 @@
   "main": "index.js",
   "defaultDocument": "index.html",
 
+  "configuration": {
+    "sessionPruneProb": {
+      "description": "Probability that dead sessions will be removed from the database for any given request.",
+      "type": "number",
+      "default": "0.001"
+    }
+  },
+
   "files": {
     "/index.html": {
       "path": "frontend/build/standalone-min.html",
diff --git a/js/apps/system/_admin/aardvark/APP/statistics.js b/js/apps/system/_admin/aardvark/APP/statistics.js
index 9d707a66f9..16d81823b4 100644
--- a/js/apps/system/_admin/aardvark/APP/statistics.js
+++ b/js/apps/system/_admin/aardvark/APP/statistics.js
@@ -395,7 +395,7 @@ function computeStatisticsLong (attrs, clusterId) {
 
 
 router.use((req, res, next) => {
-  if (!internal.options()['server.disable-authentication'] && (!req.session || !req.session.uid)) {
+  if (!req.session.uid) {
     throw new httperr.Unauthorized();
   }
   next();
diff --git a/js/client/client.js b/js/client/client.js
index ecdf6a1407..41d097a1fb 100644
--- a/js/client/client.js
+++ b/js/client/client.js
@@ -110,7 +110,7 @@ global.db = require("@arangodb").db;
 /// @brief template string generator for building an AQL query
 ////////////////////////////////////////////////////////////////////////////////
 
-global.aqlQuery = require("@arangodb").aql;
+global.aql = global.aqlQuery = require("@arangodb").aql;
 
 ////////////////////////////////////////////////////////////////////////////////
 /// @brief global 'arango'
diff --git a/js/client/modules/@arangodb/testing.js b/js/client/modules/@arangodb/testing.js
index bb59e080d7..7d2aad07b9 100644
--- a/js/client/modules/@arangodb/testing.js
+++ b/js/client/modules/@arangodb/testing.js
@@ -968,7 +968,7 @@ function runInArangosh(options, instanceInfo, file, addArgs) {
   args["javascript.unit-tests"] = fs.join(TOP_DIR, file);
 
   if (addArgs !== undefined) {
-    args = _.extend(args, addArgs);
+    args = Object.assign(args, addArgs);
   }
 
   let rc = executeAndWait(ARANGOSH_BIN, toArgv(args), options);
@@ -998,7 +998,7 @@ function runArangoshCmd(options, instanceInfo, addArgs, cmds) {
   args["server.endpoint"] = instanceInfo.endpoint;
 
   if (addArgs !== undefined) {
-    args = _.extend(args, addArgs);
+    args = Object.assign(args, addArgs);
   }
 
   const argv = toArgv(args).concat(cmds);
@@ -1075,7 +1075,7 @@ function runArangoBenchmark(options, instanceInfo, cmds) {
     "server.connection-timeout": 10 // 5s default
   };
 
-  args = _.extend(args, cmds);
+  args = Object.assign(args, cmds);
 
   if (!args.hasOwnProperty('verbose')) {
     args.quiet = true;
@@ -1208,7 +1208,7 @@ function startInstanceCluster(instanceInfo, protocol, options,
     fs.makeDirectoryRecursive(subDir);
 
     let subArgs = makeArgsArangod(options, fs.join(subDir, "apps"));
-    subArgs = _.extend(subArgs, args);
+    subArgs = Object.assign(subArgs, args);
 
     return [subArgs, name, subDir];
   };
@@ -1319,10 +1319,10 @@ function startArango(protocol, options, addArgs, name, rootDir, isAgency) {
     args["server.keyfile"] = fs.join("UnitTests", "server.pem");
   }
 
-  args = _.extend(args, options.extraArgs);
+  args = Object.assign(args, options.extraArgs);
 
   if (addArgs !== undefined) {
-    args = _.extend(args, addArgs);
+    args = Object.assign(args, addArgs);
   }
   instanceInfo.url = endpointToURL(instanceInfo.endpoint);
   
@@ -2089,7 +2089,7 @@ testFuncs.arangob = function(options) {
       delete args.transaction;
 
       if (options.hasOwnProperty('benchargs')) {
-        args = _.extend(args, options.benchargs);
+        args = Object.assign(args, options.benchargs);
       }
 
       let oneResult = runArangoBenchmark(options, instanceInfo, args);
diff --git a/js/common/modules/@arangodb/common.js b/js/common/modules/@arangodb/common.js
index 7b42d58722..f1088ac6db 100644
--- a/js/common/modules/@arangodb/common.js
+++ b/js/common/modules/@arangodb/common.js
@@ -44,9 +44,14 @@ exports.aql = function () {
   let strings = arguments[0];
   const bindVars = {};
   let query = strings[0];
+  let j = 0;
   for (let i = 1; i < arguments.length; i++) {
     let value = arguments[i];
-    let name = `value${i - 1}`;
+    if (value && typeof value.toAQL === 'function') {
+      query += value.toAQL();
+      continue;
+    }
+    let name = `value${j++}`;
     if (value && value.isArangoCollection) {
       name = `@${name}`;
       value = value.name();
diff --git a/js/common/modules/@arangodb/general-graph.js b/js/common/modules/@arangodb/general-graph.js
index 77019646f0..03dddc4106 100644
--- a/js/common/modules/@arangodb/general-graph.js
+++ b/js/common/modules/@arangodb/general-graph.js
@@ -567,7 +567,7 @@ AQLGenerator.prototype.neighbors = function(vertexExample, options) {
     + this.stack.length + ')';
   var opts;
   if (options) {
-    opts = _.extend({}, options);
+    opts = Object.assign({}, options);
   } else {
     opts = {};
   }
@@ -1343,7 +1343,7 @@ var _renameCollection = function(oldName, newName) {
         return;
       }
       gdb.toArray().forEach(function(doc) {
-        var c = _.extend({}, doc), i, j, changed = false;
+        var c = Object.assign({}, doc), i, j, changed = false;
         if (c.edgeDefinitions) {
           for (i = 0; i < c.edgeDefinitions.length; ++i) {
             var def = c.edgeDefinitions[i];
diff --git a/js/common/modules/@arangodb/util.js b/js/common/modules/@arangodb/util.js
index af49bd8605..cba3207682 100644
--- a/js/common/modules/@arangodb/util.js
+++ b/js/common/modules/@arangodb/util.js
@@ -58,7 +58,7 @@ exports.union = function union() {
     result = Array.prototype.concat.apply([], things);
   } else {
     things.unshift({});
-    result = _.extend.apply(_, things);
+    result = Object.assign(...things);
   }
   return result;
 };
diff --git a/js/common/modules/jslint.js b/js/common/modules/jslint.js
index f1c3f003b8..970b63e9da 100644
--- a/js/common/modules/jslint.js
+++ b/js/common/modules/jslint.js
@@ -29,7 +29,6 @@
 var internal = require("internal");
 var fs = require("fs");
 var console = require("console");
-var _ = require('lodash');
 
 var JSHINT = require("jshint").JSHINT;
 var jshintrc = {};
@@ -57,7 +56,7 @@ function RunTest(path, options) {
 
   var result = {};
   content = content.replace("/*jslint", "/*xxxxxx");
-  result["passed"] = JSHINT(content, _.extend({}, jshintrc, options));
+  result["passed"] = JSHINT(content, Object.assign({}, jshintrc, options));
 
   if (JSHINT.errors) {
     result["errors"] = JSHINT.errors;
diff --git a/js/server/modules/@arangodb/actions.js b/js/server/modules/@arangodb/actions.js
index 3cb5b4ca41..55e8f18f02 100644
--- a/js/server/modules/@arangodb/actions.js
+++ b/js/server/modules/@arangodb/actions.js
@@ -40,7 +40,6 @@ var fs = require("fs");
 var util = require("util");
 var mimeTypes = require("mime-types");
 var console = require("console");
-var _ = require("lodash");
 
 var arangodb = require("@arangodb");
 var foxxManager = require("@arangodb/foxx/manager");
@@ -888,7 +887,7 @@ function flattenRouting (routes, path, rexpr, urlParameters, depth, prefix) {
           routes.exact[k],
           path + "/" + k,
           rexpr + "/" + k.replace(/([\.\+\*\?\^\$\(\)\[\]])/g, "\\$1"),
-          _.clone(urlParameters),
+          Object.assign({}, urlParameters),
           depth + 1,
           false));
       }
@@ -925,7 +924,7 @@ function flattenRouting (routes, path, rexpr, urlParameters, depth, prefix) {
         cur = rexpr + match;
       }
 
-      newUrlParameters = _.clone(urlParameters);
+      newUrlParameters = Object.assign({}, urlParameters);
       newUrlParameters[parameter.parameter] = depth;
 
       result = result.concat(flattenRouting(
@@ -943,9 +942,9 @@ function flattenRouting (routes, path, rexpr, urlParameters, depth, prefix) {
   // .............................................................................
 
   if (routes.hasOwnProperty('routes')) {
-    var sorted = _.clone(routes.routes.sort(function(a,b) {
+    var sorted = [...routes.routes.sort(function(a,b) {
       return b.priority - a.priority;
-    }));
+    })];
 
     for (i = 0;  i < sorted.length;  ++i) {
       sorted[i] = {
@@ -1080,8 +1079,8 @@ function buildRouting (dbname) {
 
     while (i.hasNext()) {
       var n = i.next();
-      var c = _.extend({}, n);
-      
+      var c = Object.assign({}, n);
+
       c.name = '_routing.document("' + c._key + '")';
 
       routes.push(c);
diff --git a/js/server/modules/@arangodb/cluster/agency-communication.js b/js/server/modules/@arangodb/cluster/agency-communication.js
index db8ad6e43b..1512fcb7ae 100644
--- a/js/server/modules/@arangodb/cluster/agency-communication.js
+++ b/js/server/modules/@arangodb/cluster/agency-communication.js
@@ -758,7 +758,7 @@ exports.Communication = function() {
             diff.missing.push(toAdd);
             return;
           }
-          var compTo = _.extend({}, inferior[k]);
+          var compTo = Object.assign({}, inferior[k]);
           delete compTo.address;
           if (JSON.stringify(v) !== JSON.stringify(compTo)) {
             diff.difference[k] = {};
diff --git a/js/server/modules/@arangodb/foxx/auth.js b/js/server/modules/@arangodb/foxx/auth.js
index fa4c0c8615..0321ec598f 100644
--- a/js/server/modules/@arangodb/foxx/auth.js
+++ b/js/server/modules/@arangodb/foxx/auth.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/context.js b/js/server/modules/@arangodb/foxx/context.js
index b10ba39597..8260466278 100644
--- a/js/server/modules/@arangodb/foxx/context.js
+++ b/js/server/modules/@arangodb/foxx/context.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/generator.js b/js/server/modules/@arangodb/foxx/generator.js
index 53be4f87b5..6284108681 100644
--- a/js/server/modules/@arangodb/foxx/generator.js
+++ b/js/server/modules/@arangodb/foxx/generator.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/index.js b/js/server/modules/@arangodb/foxx/index.js
index df282291b5..4b4ee60adb 100644
--- a/js/server/modules/@arangodb/foxx/index.js
+++ b/js/server/modules/@arangodb/foxx/index.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/legacy/base_middleware.js b/js/server/modules/@arangodb/foxx/legacy/base_middleware.js
index fdf24ec4f5..a16cf425e5 100644
--- a/js/server/modules/@arangodb/foxx/legacy/base_middleware.js
+++ b/js/server/modules/@arangodb/foxx/legacy/base_middleware.js
@@ -243,8 +243,8 @@ function BaseMiddleware() {
                   actions.stringifyRequest(request));
     }
 
-    _.extend(request, requestFunctions);
-    _.extend(response, responseFunctions);
+    Object.assign(request, requestFunctions);
+    Object.assign(response, responseFunctions);
 
     next();
 
diff --git a/js/server/modules/@arangodb/foxx/legacy/controller.js b/js/server/modules/@arangodb/foxx/legacy/controller.js
index 831dd61091..d93c2e1a57 100644
--- a/js/server/modules/@arangodb/foxx/legacy/controller.js
+++ b/js/server/modules/@arangodb/foxx/legacy/controller.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -25,7 +26,6 @@
 
 const RequestContext = require('@arangodb/foxx/legacy/request_context');
 const BaseMiddleware = require('@arangodb/foxx/legacy/base_middleware').BaseMiddleware;
-const _ = require('lodash');
 const is = require('@arangodb/is');
 const internal = require('@arangodb/foxx/legacy/internals');
 const swagger = require('@arangodb/foxx/legacy/swagger');
@@ -184,7 +184,7 @@ class Controller {
 
   addInjector(name, factory) {
     if (factory === undefined) {
-      _.extend(this.injectors, name);
+      Object.assign(this.injectors, name);
     } else {
       this.injectors[name] = factory;
     }
@@ -344,7 +344,7 @@ class Controller {
 ////////////////////////////////////////////////////////////////////////////////
   activateAuthentication(opts) {
     var authentication = require('@arangodb/foxx/legacy/authentication');
-    _.extend(this, authControllerProps);
+    Object.assign(this, authControllerProps);
 
     this.auth = authentication.createAuthObject(this.applicationContext, opts);
     this.before('/*', authentication.createAuthenticationMiddleware(this.auth, this.applicationContext));
@@ -357,7 +357,7 @@ class Controller {
 
   activateSessions(opts) {
     var sessions = require('@arangodb/foxx/legacy/sessions');
-    _.extend(this, sessionControllerProps);
+    Object.assign(this, sessionControllerProps);
 
     this.sessions = new sessions.Sessions(opts);
     sessions.decorateController(this.sessions, this);
diff --git a/js/server/modules/@arangodb/foxx/legacy/index.js b/js/server/modules/@arangodb/foxx/legacy/index.js
index 275629fdb2..8f9e3f608d 100644
--- a/js/server/modules/@arangodb/foxx/legacy/index.js
+++ b/js/server/modules/@arangodb/foxx/legacy/index.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/legacy/model.js b/js/server/modules/@arangodb/foxx/legacy/model.js
index a46693a15c..8cb43c2e58 100644
--- a/js/server/modules/@arangodb/foxx/legacy/model.js
+++ b/js/server/modules/@arangodb/foxx/legacy/model.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -92,7 +93,7 @@ function Model(attributes) {
 }
 
 Model.prototype = Object.create(EventEmitter.prototype);
-_.extend(Model.prototype, {
+Object.assign(Model.prototype, {
 
 ////////////////////////////////////////////////////////////////////////////////
 /// @brief was docuBlock JSF_foxx_model_get
diff --git a/js/server/modules/@arangodb/foxx/legacy/query.js b/js/server/modules/@arangodb/foxx/legacy/query.js
index 38a36fd6f9..1e42ba534c 100644
--- a/js/server/modules/@arangodb/foxx/legacy/query.js
+++ b/js/server/modules/@arangodb/foxx/legacy/query.js
@@ -81,7 +81,7 @@ exports.createQuery = function createQuery (cfg) {
     } else {
       vars = args.shift();
     }
-    vars = _.extend({}, defaults, vars);
+    vars = Object.assign({}, defaults, vars);
     if (context) {
       _.each(vars, function (value, key) {
         if (key.charAt(0) === '@') {
diff --git a/js/server/modules/@arangodb/foxx/legacy/repository.js b/js/server/modules/@arangodb/foxx/legacy/repository.js
index 610ea6d823..e7d5154b25 100644
--- a/js/server/modules/@arangodb/foxx/legacy/repository.js
+++ b/js/server/modules/@arangodb/foxx/legacy/repository.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -94,7 +95,7 @@ function Repository(collection, opts) {
 
 
 Repository.prototype = Object.create(EventEmitter.prototype);
-_.extend(Repository.prototype, {
+Object.assign(Repository.prototype, {
 
 // -----------------------------------------------------------------------------
 // --SUBSECTION--                                                 Adding Entries
diff --git a/js/server/modules/@arangodb/foxx/legacy/request_context.js b/js/server/modules/@arangodb/foxx/legacy/request_context.js
index d817aa7895..a32d8c6c88 100644
--- a/js/server/modules/@arangodb/foxx/legacy/request_context.js
+++ b/js/server/modules/@arangodb/foxx/legacy/request_context.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -323,7 +324,7 @@ class RequestContext {
           cfg.options = [cfg.options];
         }
         _.each(cfg.options, function (options) {
-          _.extend(validateOptions, options);
+          Object.assign(validateOptions, options);
         });
       }
       construct = function (raw) {
@@ -425,7 +426,7 @@ class RequestContextBuffer {
   }
 }
 
-_.extend(RequestContextBuffer.prototype, {
+Object.assign(RequestContextBuffer.prototype, {
   applyEachFunction(target) {
     _.each(this.applyChain, function (x) {
       target[x.functionName].apply(target, x.argumentList);
@@ -459,7 +460,7 @@ _.each([
 ////////////////////////////////////////////////////////////////////////////////
   'onlyIfAuthenticated'
 ], function (functionName) {
-  _.extend(RequestContextBuffer.prototype[functionName] = function () {
+  Object.assign(RequestContextBuffer.prototype[functionName] = function () {
     this.applyChain.push({
       functionName: functionName,
       argumentList: arguments
diff --git a/js/server/modules/@arangodb/foxx/legacy/routing.js b/js/server/modules/@arangodb/foxx/legacy/routing.js
index 44fe078ba1..da629278c9 100644
--- a/js/server/modules/@arangodb/foxx/legacy/routing.js
+++ b/js/server/modules/@arangodb/foxx/legacy/routing.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -321,7 +322,7 @@ function mountController(service, mount, filename) {
     var foxx = foxxes[i];
     var ri = foxx.routingInfo;
 
-    _.extend(service.routes.models, foxx.models);
+    Object.assign(service.routes.models, foxx.models);
 
     if (ri.middleware) {
       createMiddlewareMatchers(ri.middleware, service.routes, mount, ri.urlPrefix);
diff --git a/js/server/modules/@arangodb/foxx/legacy/schema.js b/js/server/modules/@arangodb/foxx/legacy/schema.js
index e5c0d25938..aaf68d8d35 100644
--- a/js/server/modules/@arangodb/foxx/legacy/schema.js
+++ b/js/server/modules/@arangodb/foxx/legacy/schema.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/legacy/sessions.js b/js/server/modules/@arangodb/foxx/legacy/sessions.js
index 9e9294604d..a5f945c8a6 100644
--- a/js/server/modules/@arangodb/foxx/legacy/sessions.js
+++ b/js/server/modules/@arangodb/foxx/legacy/sessions.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/legacy/swagger.js b/js/server/modules/@arangodb/foxx/legacy/swagger.js
index df42b26c82..a2b66daee7 100644
--- a/js/server/modules/@arangodb/foxx/legacy/swagger.js
+++ b/js/server/modules/@arangodb/foxx/legacy/swagger.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/legacy/template_middleware.js b/js/server/modules/@arangodb/foxx/legacy/template_middleware.js
index 632e321b5c..dcde363742 100644
--- a/js/server/modules/@arangodb/foxx/legacy/template_middleware.js
+++ b/js/server/modules/@arangodb/foxx/legacy/template_middleware.js
@@ -90,12 +90,12 @@ function TemplateMiddleware(templateCollection, helper) {
           throw new Error("Unknown template language '" + template.templateLanguage + "'");
         }
 
-        this.body = _.template(template.content)(_.extend(data, helper));
+        this.body = _.template(template.content)(Object.assign(data, helper));
         this.contentType = template.contentType;
       }
     };
 
-    _.extend(response, responseFunctions);
+    Object.assign(response, responseFunctions);
   };
 
   if (_.isString(templateCollection)) {
diff --git a/js/server/modules/@arangodb/foxx/manager.js b/js/server/modules/@arangodb/foxx/manager.js
index 0435258d46..b58df32ad9 100644
--- a/js/server/modules/@arangodb/foxx/manager.js
+++ b/js/server/modules/@arangodb/foxx/manager.js
@@ -236,7 +236,7 @@ function refillCaches(dbname) {
 
   while (cursor.hasNext()) {
     var config = cursor.next();
-    var app = new FoxxService(_.extend({}, config));
+    var app = new FoxxService(Object.assign({}, config));
     var mount = app.mount;
     cache[mount] = app;
     routes.push(mount);
@@ -840,7 +840,7 @@ function _scanFoxx(mount, options, activateDevelopment) {
           if (old === null) {
             throw new Error(`Could not find app for mountpoint "${mount}"`);
           }
-          var data = _.extend({}, old);
+          var data = Object.assign({}, old);
           data.manifest = app.toJSON().manifest;
           utils.getStorage().replace(old, data);
         }
@@ -884,7 +884,7 @@ function rescanFoxx(mount) {
   initCache();
   _scanFoxx(
     mount,
-    _.extend({}, old.options, {replace: true}),
+    Object.assign({}, old.options, {replace: true}),
     old.isDevelopment
   );
 }
diff --git a/js/server/modules/@arangodb/foxx/mocha.js b/js/server/modules/@arangodb/foxx/mocha.js
index b17041f9b1..50a17345c4 100644
--- a/js/server/modules/@arangodb/foxx/mocha.js
+++ b/js/server/modules/@arangodb/foxx/mocha.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/oauth2.js b/js/server/modules/@arangodb/foxx/oauth2.js
index d38064dbf6..5cbaefead5 100644
--- a/js/server/modules/@arangodb/foxx/oauth2.js
+++ b/js/server/modules/@arangodb/foxx/oauth2.js
@@ -1,5 +1,6 @@
 /*eslint camelcase:false */
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -22,7 +23,6 @@
 /// @author Alan Plum
 ////////////////////////////////////////////////////////////////////////////////
 
-const _ = require('lodash');
 const url = require('url');
 const parseUrl = url.parse;
 const formatUrl = url.format;
@@ -43,7 +43,7 @@ function parse(str) {
 module.exports = function oauth2(cfg) {
   function getTokenRequest(code, redirect_uri) {
     const endpoint = parseUrl(cfg.tokenEndpoint);
-    const body = _.extend(
+    const body = Object.assign(
       {grant_type: 'authorization_code'},
       parseQuery(endpoint.query),
       {
@@ -63,7 +63,7 @@ module.exports = function oauth2(cfg) {
   function getActiveUserUrl(access_token) {
     const endpoint = parseUrl(cfg.activeUserEndpoint);
     delete endpoint.search;
-    endpoint.query = _.extend(
+    endpoint.query = Object.assign(
       parseQuery(endpoint.query),
       {access_token}
     );
@@ -78,7 +78,7 @@ module.exports = function oauth2(cfg) {
       }
       const endpoint = parseUrl(cfg.authEndpoint);
       delete endpoint.search;
-      endpoint.query = _.extend(
+      endpoint.query = Object.assign(
         {response_type: 'code'},
         parseQuery(endpoint.query),
         opts,
diff --git a/js/server/modules/@arangodb/foxx/queues/index.js b/js/server/modules/@arangodb/foxx/queues/index.js
index ddb977d9be..bb2539117d 100644
--- a/js/server/modules/@arangodb/foxx/queues/index.js
+++ b/js/server/modules/@arangodb/foxx/queues/index.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -42,7 +43,7 @@ function validate(data, schema) {
   }));
   if (isTuple) {
     raw = Array.isArray(raw) ? raw : [raw];
-    data = _.extend({}, raw);
+    data = Object.assign({}, raw);
   }
   var result = schema.validate(data);
   if (result.error) {
@@ -182,7 +183,7 @@ function Job(id) {
   }, this);
 }
 
-_.extend(Job.prototype, {
+Object.assign(Job.prototype, {
   abort: function () {
     var self = this;
     db._executeTransaction({
@@ -231,13 +232,13 @@ function asNumber(num) {
   return num ? Number(num) : 0;
 }
 
-_.extend(Queue.prototype, {
+Object.assign(Queue.prototype, {
   push: function (type, data, opts) {
     if (!type) {
       throw new Error('Must pass a job type!');
     }
 
-    type = _.extend({}, type);
+    type = Object.assign({}, type);
 
     if (type.schema) {
       data = validate(data, type.schema);
diff --git a/js/server/modules/@arangodb/foxx/queues/manager.js b/js/server/modules/@arangodb/foxx/queues/manager.js
index 417e969018..3252c4ac9d 100644
--- a/js/server/modules/@arangodb/foxx/queues/manager.js
+++ b/js/server/modules/@arangodb/foxx/queues/manager.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -22,7 +23,6 @@
 /// @author Alan Plum
 ////////////////////////////////////////////////////////////////////////////////
 
-var _ = require('lodash');
 var tasks = require('@arangodb/tasks');
 var db = require('@arangodb').db;
 var qb = require('aqb');
@@ -85,7 +85,7 @@ var runInDatabase = function () {
             offset: 1,
             isSystem: true,
             params: {
-              job: _.extend({}, job, {status: 'progress'}),
+              job: Object.assign({}, job, {status: 'progress'}),
               db: db._name()
             }
           });
diff --git a/js/server/modules/@arangodb/foxx/queues/worker.js b/js/server/modules/@arangodb/foxx/queues/worker.js
index b81ee8a3aa..3c258cfc7a 100644
--- a/js/server/modules/@arangodb/foxx/queues/worker.js
+++ b/js/server/modules/@arangodb/foxx/queues/worker.js
@@ -1,5 +1,6 @@
 /*jshint evil: true */
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -23,7 +24,6 @@
 /// @author Alan Plum
 ////////////////////////////////////////////////////////////////////////////////
 
-var _ = require('lodash');
 var db = require('@arangodb').db;
 var flatten = require('internal').flatten;
 var exponentialBackOff = require('internal').exponentialBackOff;
@@ -153,7 +153,7 @@ exports.work = function (job) {
         data.runFailures = 0;
       }
       db._jobs.update(job._key, data);
-      job = _.extend(job, data);
+      job = Object.assign(job, data);
     }
   });
 
diff --git a/js/server/modules/@arangodb/foxx/router/index.js b/js/server/modules/@arangodb/foxx/router/index.js
index ff838993a7..77044fe38f 100644
--- a/js/server/modules/@arangodb/foxx/router/index.js
+++ b/js/server/modules/@arangodb/foxx/router/index.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/middleware.js b/js/server/modules/@arangodb/foxx/router/middleware.js
index 9bb1b4911d..3190fba087 100644
--- a/js/server/modules/@arangodb/foxx/router/middleware.js
+++ b/js/server/modules/@arangodb/foxx/router/middleware.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/request.js b/js/server/modules/@arangodb/foxx/router/request.js
index 67ef508f2e..91ebdfaaf1 100644
--- a/js/server/modules/@arangodb/foxx/router/request.js
+++ b/js/server/modules/@arangodb/foxx/router/request.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/response.js b/js/server/modules/@arangodb/foxx/router/response.js
index 972ee3c592..1f403b9fec 100644
--- a/js/server/modules/@arangodb/foxx/router/response.js
+++ b/js/server/modules/@arangodb/foxx/router/response.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/route.js b/js/server/modules/@arangodb/foxx/router/route.js
index 2dd17b0bde..0343487063 100644
--- a/js/server/modules/@arangodb/foxx/router/route.js
+++ b/js/server/modules/@arangodb/foxx/router/route.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/router.js b/js/server/modules/@arangodb/foxx/router/router.js
index 418153e746..f9743f6356 100644
--- a/js/server/modules/@arangodb/foxx/router/router.js
+++ b/js/server/modules/@arangodb/foxx/router/router.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/swagger-context.js b/js/server/modules/@arangodb/foxx/router/swagger-context.js
index 716015bf44..ff2d710e96 100644
--- a/js/server/modules/@arangodb/foxx/router/swagger-context.js
+++ b/js/server/modules/@arangodb/foxx/router/swagger-context.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/router/tokenize.js b/js/server/modules/@arangodb/foxx/router/tokenize.js
index cdb04b3a81..5914446e6b 100644
--- a/js/server/modules/@arangodb/foxx/router/tokenize.js
+++ b/js/server/modules/@arangodb/foxx/router/tokenize.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -21,7 +22,6 @@
 /// @author Alan Plum
 ////////////////////////////////////////////////////////////////////////////////
 
-const _ = require('lodash');
 const joi = require('joi');
 const DEFAULT_PARAM_SCHEMA = joi.string().required();
 
@@ -45,7 +45,7 @@ function reverse(pathTokens, pathParamNames) {
   return '/' + path.join('/');
 }
 
-module.exports = _.extend(
+module.exports = Object.assign(
   function tokenize(path, ctx) {
     if (path === '/') {
       return [$_TERMINAL];
diff --git a/js/server/modules/@arangodb/foxx/router/tree.js b/js/server/modules/@arangodb/foxx/router/tree.js
index 1aa4a0a120..c7642d6204 100644
--- a/js/server/modules/@arangodb/foxx/router/tree.js
+++ b/js/server/modules/@arangodb/foxx/router/tree.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -212,7 +213,7 @@ function applyPathParams(route) {
 function dispatch(route, req, res) {
   const ignoreRequestBody = actions.BODYFREE_METHODS.indexOf(req.method) !== -1;
   let pathParams = {};
-  let queryParams = _.clone(req.queryParams);
+  let queryParams = Object.assign({}, req.queryParams);
 
   {
     let basePath = [];
@@ -309,7 +310,7 @@ function dispatch(route, req, res) {
         throw new Error(`Route could not be resolved: "${routeName}"`);
       }
 
-      params = _.extend({}, params);
+      params = Object.assign({}, params);
       const parts = [];
       for (const item of reversedRoute) {
         const context = item.router || item.endpoint || item.middleware;
@@ -354,13 +355,13 @@ function dispatch(route, req, res) {
     };
 
     if (item.endpoint || item.router) {
-      pathParams = _.extend(pathParams, item.pathParams);
-      queryParams = _.extend(queryParams, item.queryParams);
+      pathParams = Object.assign(pathParams, item.pathParams);
+      queryParams = Object.assign(queryParams, item.queryParams);
       req.pathParams = pathParams;
       req.queryParams = queryParams;
     } else {
-      req.pathParams = _.extend(_.clone(pathParams), item.pathParams);
-      req.queryParams = _.extend(_.clone(queryParams), item.queryParams);
+      req.pathParams = Object.assign({}, pathParams, item.pathParams);
+      req.queryParams = Object.assign({}, queryParams, item.queryParams);
     }
 
     if (!context._handler) {
diff --git a/js/server/modules/@arangodb/foxx/router/validation.js b/js/server/modules/@arangodb/foxx/router/validation.js
index 7b4ca69855..094eda11e5 100644
--- a/js/server/modules/@arangodb/foxx/router/validation.js
+++ b/js/server/modules/@arangodb/foxx/router/validation.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/routing.js b/js/server/modules/@arangodb/foxx/routing.js
index 61fba57e42..7ea996ff0a 100644
--- a/js/server/modules/@arangodb/foxx/routing.js
+++ b/js/server/modules/@arangodb/foxx/routing.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/service.js b/js/server/modules/@arangodb/foxx/service.js
index 99325c16c8..d40b120d6a 100644
--- a/js/server/modules/@arangodb/foxx/service.js
+++ b/js/server/modules/@arangodb/foxx/service.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
@@ -312,7 +313,7 @@ module.exports = class FoxxService {
     const options = this.options.configuration;
     _.each(definitions, function (dfn, name) {
       const value = options[name] === undefined ? dfn.default : options[name];
-      config[name] = simple ? value : _.extend({}, dfn, {
+      config[name] = simple ? value : Object.assign({}, dfn, {
         title: getReadableName(name),
         current: value
       });
@@ -350,7 +351,7 @@ module.exports = class FoxxService {
 
     const module = new Module(filename, this.main);
     module[$_MODULE_CONTEXT].console = this.main[$_MODULE_CONTEXT].console;
-    module.context = _.extend(
+    module.context = Object.assign(
       new FoxxContext(this),
       this.main.context,
       options.foxxContext
diff --git a/js/server/modules/@arangodb/foxx/sessions/index.js b/js/server/modules/@arangodb/foxx/sessions/index.js
index f2973c323b..508c6c9f9f 100644
--- a/js/server/modules/@arangodb/foxx/sessions/index.js
+++ b/js/server/modules/@arangodb/foxx/sessions/index.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/sessions/storages/_system.js b/js/server/modules/@arangodb/foxx/sessions/storages/_system.js
index 81b1f5c621..f015c307ff 100644
--- a/js/server/modules/@arangodb/foxx/sessions/storages/_system.js
+++ b/js/server/modules/@arangodb/foxx/sessions/storages/_system.js
@@ -44,19 +44,20 @@ module.exports = function systemStorage(cfg) {
     },
     fromClient(sid) {
       try {
+        const now = Date.now();
         const doc = db._sessions.document(sid);
         const internalAccessTime = internal.accessSid(sid);
         if (internalAccessTime) {
           doc.lastAccess = internalAccessTime;
         }
-        if ((doc.lastAccess + expiry) < Date.now()) {
+        if ((doc.lastAccess + expiry) < now) {
           this.clear(sid);
           return null;
         }
+        db._sessions.update(sid, {lastAccess: now});
         return {
           _key: doc._key,
           uid: doc.uid,
-          userData: doc.userData,
           created: doc.created,
           data: doc.sessionData
         };
@@ -77,7 +78,6 @@ module.exports = function systemStorage(cfg) {
       const uid = session.uid;
       const payload = {
         uid: uid || null,
-        userData: session.userData || {},
         sessionData: session.data || {},
         created: session.created || Date.now(),
         lastAccess: Date.now(),
@@ -105,13 +105,11 @@ module.exports = function systemStorage(cfg) {
     setUser(session, user) {
       if (user) {
         session.uid = user._key;
-        session.userData = user.userData;
         if (session._key) {
           internal.createSid(session._key, user.user);
         }
       } else {
         session.uid = null;
-        session.userData = {};
         if (session._key) {
           internal.clearSid(session._key);
         }
@@ -136,7 +134,6 @@ module.exports = function systemStorage(cfg) {
     new() {
       return {
         uid: null,
-        userData: {},
         created: Date.now(),
         data: {}
       };
diff --git a/js/server/modules/@arangodb/foxx/sessions/storages/collection.js b/js/server/modules/@arangodb/foxx/sessions/storages/collection.js
index cf887b17d8..b6cb19d87c 100644
--- a/js/server/modules/@arangodb/foxx/sessions/storages/collection.js
+++ b/js/server/modules/@arangodb/foxx/sessions/storages/collection.js
@@ -36,6 +36,7 @@ module.exports = function collectionStorage(cfg) {
   if (!cfg) {
     cfg = {};
   }
+  const autoUpdate = Boolean(cfg.autoUpdate);
   const pruneExpired = Boolean(cfg.pruneExpired);
   const expiry = (cfg.expiry || 60) * 60 * 1000;
   const collection = (
@@ -56,13 +57,17 @@ module.exports = function collectionStorage(cfg) {
     },
     fromClient(sid) {
       try {
+        const now = Date.now();
         const session = collection.document(sid);
-        if (session.expires < Date.now()) {
+        if (session.expires < now) {
           if (pruneExpired) {
             collection.remove(session);
           }
           return null;
         }
+        if (autoUpdate) {
+          collection.update(sid, {expires: now + expiry});
+        }
         return {
           _key: session._key,
           uid: session.uid,
diff --git a/js/server/modules/@arangodb/foxx/sessions/transports/cookie.js b/js/server/modules/@arangodb/foxx/sessions/transports/cookie.js
index 1d28af5133..c396391b89 100644
--- a/js/server/modules/@arangodb/foxx/sessions/transports/cookie.js
+++ b/js/server/modules/@arangodb/foxx/sessions/transports/cookie.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/sessions/transports/header.js b/js/server/modules/@arangodb/foxx/sessions/transports/header.js
index fda09e8ded..b222cdab34 100644
--- a/js/server/modules/@arangodb/foxx/sessions/transports/header.js
+++ b/js/server/modules/@arangodb/foxx/sessions/transports/header.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/swagger.js b/js/server/modules/@arangodb/foxx/swagger.js
index ad253455b8..41865ef4f1 100644
--- a/js/server/modules/@arangodb/foxx/swagger.js
+++ b/js/server/modules/@arangodb/foxx/swagger.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/templates/dcRouter.js.tmpl b/js/server/modules/@arangodb/foxx/templates/dcRouter.js.tmpl
index 73c914cacc..1c3abd1f54 100644
--- a/js/server/modules/@arangodb/foxx/templates/dcRouter.js.tmpl
+++ b/js/server/modules/@arangodb/foxx/templates/dcRouter.js.tmpl
@@ -1,5 +1,4 @@
 'use strict';
-const _ = require('lodash');
 const dd = require('dedent');
 const joi = require('joi');
 const httpError = require('http-errors');
@@ -43,7 +42,7 @@ router.post(function (req, res) {
     }
     throw e;
   }
-  _.extend(<%= document %>, meta);
+  Object.assign(<%= document %>, meta);
   res.status(201);
   res.set('location', req.makeAbsolute(
     req.reverse('detail', {key: <%= document %>._key})
@@ -96,7 +95,7 @@ router.put(':key', function (req, res) {
     }
     throw e;
   }
-  _.extend(<%= document %>, meta);
+  Object.assign(<%= document %>, meta);
   res.send(<%= document %>);
 }, 'replace')
 .pathParam('key', keySchema)
diff --git a/js/server/modules/@arangodb/foxx/templates/ecRouter.js.tmpl b/js/server/modules/@arangodb/foxx/templates/ecRouter.js.tmpl
index 11eb13263e..270101f539 100644
--- a/js/server/modules/@arangodb/foxx/templates/ecRouter.js.tmpl
+++ b/js/server/modules/@arangodb/foxx/templates/ecRouter.js.tmpl
@@ -1,5 +1,4 @@
 'use strict';
-const _ = require('lodash');
 const dd = require('dedent');
 const joi = require('joi');
 const httpError = require('http-errors');
@@ -21,8 +20,8 @@ const HTTP_CONFLICT = status('conflict');
 const router = createRouter();
 module.exports = router;
 
-const New<%= model %> = _.extend({}, <%= model %>, {
-  schema: _.extend({}, <%= model %>.schema, {
+const New<%= model %> = Object.assign({}, <%= model %>, {
+  schema: Object.assign({}, <%= model %>.schema, {
     _from: joi.string(),
     _to: joi.string()
   })
@@ -50,7 +49,7 @@ router.post(function (req, res) {
     }
     throw e;
   }
-  _.extend(<%= document %>, meta);
+  Object.assign(<%= document %>, meta);
   res.status(201);
   res.set('location', req.makeAbsolute(
     req.reverse('detail', {key: <%= document %>._key})
@@ -103,7 +102,7 @@ router.put(':key', function (req, res) {
     }
     throw e;
   }
-  _.extend(<%= document %>, meta);
+  Object.assign(<%= document %>, meta);
   res.send(<%= document %>);
 }, 'replace')
 .pathParam('key', keySchema)
diff --git a/js/server/modules/@arangodb/foxx/test-utils.js b/js/server/modules/@arangodb/foxx/test-utils.js
index c7c2ea80c2..4785aeea18 100644
--- a/js/server/modules/@arangodb/foxx/test-utils.js
+++ b/js/server/modules/@arangodb/foxx/test-utils.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/modules/@arangodb/foxx/types.js b/js/server/modules/@arangodb/foxx/types.js
index bf1030ccf3..4821752474 100644
--- a/js/server/modules/@arangodb/foxx/types.js
+++ b/js/server/modules/@arangodb/foxx/types.js
@@ -1,4 +1,5 @@
 'use strict';
+
 ////////////////////////////////////////////////////////////////////////////////
 /// DISCLAIMER
 ///
diff --git a/js/server/tests/shell/shell-foxx.js b/js/server/tests/shell/shell-foxx.js
index f2504070af..87108ec1de 100644
--- a/js/server/tests/shell/shell-foxx.js
+++ b/js/server/tests/shell/shell-foxx.js
@@ -56,7 +56,7 @@ FunctionStub = function(obj) {
   this.obj = obj;
 };
 
-_.extend(FunctionStub.prototype, {
+Object.assign(FunctionStub.prototype, {
   toReceive: function (functionName) {
     'use strict';
     this.functionName = functionName;