diff --git a/changelog/unreleased/pull-386 b/changelog/unreleased/pull-386
new file mode 100644
index 0000000..95d4a07
--- /dev/null
+++ b/changelog/unreleased/pull-386
@@ -0,0 +1,6 @@
+Bugfix: Keep cached htpasswd credentials for one minute
+
+The password cache removed entries withing seconds instead of after
+one minute as intended. This has been fixed.
+
+https://github.com/restic/rest-server/pull/386
diff --git a/cmd/rest-server/main.go b/cmd/rest-server/main.go
index 12fd6b6..9194693 100644
--- a/cmd/rest-server/main.go
+++ b/cmd/rest-server/main.go
@@ -206,6 +206,7 @@ func (app *restServerApp) runRoot(_ *cobra.Command, _ []string) error {
 
 	// run server in background
 	go func() {
+		var err error
 		if !enabledTLS {
 			err = srv.Serve(listener)
 		} else {
diff --git a/handlers.go b/handlers.go
index 691afa8..784fdd4 100644
--- a/handlers.go
+++ b/handlers.go
@@ -51,7 +51,7 @@ func httpDefaultError(w http.ResponseWriter, code int) {
 	http.Error(w, http.StatusText(code), code)
 }
 
-// ServeHTTP makes this server an http.Handler. It handlers the administrative
+// ServeHTTP makes this server an http.Handler. It handles the administrative
 // part of the request (figuring out the filesystem location, performing
 // authentication, etc) and then passes it on to repo.Handler for actual
 // REST API processing.
diff --git a/htpasswd.go b/htpasswd.go
index ad67a1e..430c991 100644
--- a/htpasswd.go
+++ b/htpasswd.go
@@ -123,7 +123,7 @@ func (h *HtpasswdFile) expiryTimer() {
 		var zeros [sha256.Size]byte
 		// try to wipe expired cache entries
 		for user, entry := range h.cache {
-			if entry.expiry.After(now) {
+			if now.After(entry.expiry) {
 				copy(entry.verifier, zeros[:])
 				delete(h.cache, user)
 			}
@@ -251,7 +251,6 @@ func (h *HtpasswdFile) Validate(user string, password string) bool {
 	isValid := isMatchingHashAndPassword(hashedPassword, password)
 
 	if !isValid {
-		log.Printf("Invalid htpasswd entry for %s.", user)
 		return false
 	}
 
diff --git a/quota/quota.go b/quota/quota.go
index 8437f65..ee243c6 100644
--- a/quota/quota.go
+++ b/quota/quota.go
@@ -70,7 +70,7 @@ func (m *Manager) WrapWriter(req *http.Request, w io.Writer) (io.Writer, int, er
 	if contentLenStr := req.Header.Get("Content-Length"); contentLenStr != "" {
 		contentLen, err := strconv.ParseInt(contentLenStr, 10, 64)
 		if err != nil {
-			return nil, http.StatusLengthRequired, err
+			return nil, http.StatusBadRequest, err
 		}
 		if currentSize+contentLen > m.maxRepoSize {
 			err := fmt.Errorf("incoming blob (%d bytes) would exceed maximum size of repository (%d bytes)",
diff --git a/repo/repo.go b/repo/repo.go
index adc4a55..52806aa 100644
--- a/repo/repo.go
+++ b/repo/repo.go
@@ -305,11 +305,15 @@ func (h *Handler) saveConfig(w http.ResponseWriter, r *http.Request) {
 	cfg := h.getSubPath("config")
 
 	f, err := os.OpenFile(cfg, os.O_CREATE|os.O_WRONLY|os.O_EXCL, h.opt.fileMode)
-	if err != nil && os.IsExist(err) {
+	if err != nil {
 		if h.opt.Debug {
 			log.Print(err)
 		}
-		httpDefaultError(w, http.StatusForbidden)
+		if os.IsExist(err) {
+			httpDefaultError(w, http.StatusForbidden)
+		} else {
+			h.internalServerError(w, err)
+		}
 		return
 	}
 
@@ -810,7 +814,7 @@ func (h *Handler) internalServerError(w http.ResponseWriter, err error) {
 	httpDefaultError(w, http.StatusInternalServerError)
 }
 
-// internalServerError is called to report an error that occurred while
+// fileAccessError is called to report an error that occurred while
 // accessing a file. If the does not exist, the corresponding http status code
 // will be returned to the client. All other errors are passed on to
 // internalServerError