diff --git a/js/src/track.js b/js/src/track.js
index f4fc91b..bacc700 100644
--- a/js/src/track.js
+++ b/js/src/track.js
@@ -17,7 +17,6 @@
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-import { auth } from './initializer.js';
 import uAjax from './ajax.js';
 import uPosition from './position.js';
 import uPositionSet from './positionset.js';
@@ -196,12 +195,10 @@ export default class uTrack extends uPositionSet {
   /**
    * Imports tracks submited with HTML form and returns last imported track id
    * @param {HTMLFormElement} form
+   * @param {uUser} user
    * @return {Promise<uTrack[], Error>}
    */
-  static import(form) {
-    if (!auth.isAuthenticated) {
-      throw new Error('User not authenticated');
-    }
+  static import(form, user) {
     return uAjax.post('utils/import.php', form)
       .then(
         /**
@@ -211,7 +208,7 @@ export default class uTrack extends uPositionSet {
         (_tracks) => {
           const tracks = [];
           for (const track of _tracks) {
-            tracks.push(new uTrack(track.id, track.name, auth.user));
+            tracks.push(new uTrack(track.id, track.name, user));
           }
           return tracks;
       });
diff --git a/js/src/trackviewmodel.js b/js/src/trackviewmodel.js
index 1d4e02b..31ba148 100644
--- a/js/src/trackviewmodel.js
+++ b/js/src/trackviewmodel.js
@@ -17,7 +17,7 @@
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-import { lang as $, config } from './initializer.js';
+import { lang as $, auth, config } from './initializer.js';
 import ViewModel from './viewmodel.js';
 import uObserve from './observe.js';
 import uPositionSet from './positionset.js';
@@ -157,7 +157,11 @@ export default class TrackViewModel extends ViewModel {
       uUtils.error(uUtils.sprintf($._('isizefailure'), sizeMax));
       return;
     }
-    uTrack.import(form)
+    if (!auth.isAuthenticated) {
+      uUtils.error($._('notauthorized'));
+      return;
+    }
+    uTrack.import(form, auth.user)
       .then((trackList) => {
         if (trackList.length) {
           if (trackList.length > 1) {
diff --git a/js/test/track.test.js b/js/test/track.test.js
index a0183e8..1e78152 100644
--- a/js/test/track.test.js
+++ b/js/test/track.test.js
@@ -17,7 +17,6 @@
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-import { auth } from '../src/initializer.js';
 import uPosition from '../src/position.js';
 import uTrack from '../src/track.js';
 import uUser from '../src/user.js';
@@ -27,7 +26,6 @@ import uUtils from '../src/utils.js';
 describe('Track tests', () => {
 
   let track;
-
   let posId;
   let latitude;
   let longitude;
@@ -376,12 +374,10 @@ describe('Track tests', () => {
     it('should make successful track import request', (done) => {
       // given
       const authUser = new uUser(1, 'admin');
-      spyOnProperty(auth, 'isAuthenticated').and.returnValue(true);
-      spyOnProperty(auth, 'user').and.returnValue(authUser);
       spyOnProperty(XMLHttpRequest.prototype, 'responseText').and.returnValue(JSON.stringify(validListResponse));
       const form = document.createElement('form');
       // when
-      uTrack.import(form)
+      uTrack.import(form, authUser)
         .then((tracks) => {
           expect(XMLHttpRequest.prototype.open).toHaveBeenCalledWith('POST', 'utils/import.php', true);
           expect(XMLHttpRequest.prototype.send).toHaveBeenCalledWith(new FormData(form));
@@ -391,13 +387,6 @@ describe('Track tests', () => {
         .catch((e) => done.fail(`reject callback called (${e})`));
     });
 
-    it('should fail on import request without authorized user', () => {
-      // given
-      const form = document.createElement('form');
-      // when
-      expect(() => uTrack.import(form)).toThrowError(/auth/);
-    });
-
     it('should not open export url when track has no positions', () => {
       // given
       spyOn(uUtils, 'openUrl');
diff --git a/js/test/trackviewmodel.test.js b/js/test/trackviewmodel.test.js
index ff7cbcc..4ce577f 100644
--- a/js/test/trackviewmodel.test.js
+++ b/js/test/trackviewmodel.test.js
@@ -17,7 +17,7 @@
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-import { config, lang } from '../src/initializer.js';
+import { auth, config, lang } from '../src/initializer.js';
 import TrackFactory from './helpers/trackfactory.js';
 import TrackViewModel from '../src/trackviewmodel.js';
 import ViewModel from '../src/viewmodel.js';
@@ -108,6 +108,7 @@ describe('TrackViewModel tests', () => {
   afterEach(() => {
     document.body.removeChild(document.querySelector('#fixture'));
     uObserve.unobserveAll(lang);
+    auth.user = null;
   });
 
   it('should create instance with state as parameter', () => {
@@ -469,6 +470,7 @@ describe('TrackViewModel tests', () => {
     const optLength = trackEl.options.length;
     vm.model.trackList = tracks;
     vm.model.currentTrackId = track1.listValue;
+    auth.user = user;
     state.currentTrack = track1;
     state.currentUser = user;
     inputFileEl.onclick = () => {
@@ -483,7 +485,7 @@ describe('TrackViewModel tests', () => {
     // then
     setTimeout(() => {
       expect(uTrack.import).toHaveBeenCalledTimes(1);
-      expect(uTrack.import).toHaveBeenCalledWith(jasmine.any(HTMLFormElement));
+      expect(uTrack.import).toHaveBeenCalledWith(jasmine.any(HTMLFormElement), user);
       expect(state.currentTrack).toBe(imported[0]);
       expect(vm.model.currentTrackId).toBe(imported[0].listValue);
       expect(state.currentTrack.length).toBe(positions.length);
@@ -511,6 +513,7 @@ describe('TrackViewModel tests', () => {
     const optLength = trackEl.options.length;
     vm.model.trackList = tracks;
     vm.model.currentTrackId = track1.listValue;
+    auth.user = user;
     state.currentTrack = track1;
     state.currentUser = user;
     inputFileEl.onclick = () => {
@@ -534,6 +537,45 @@ describe('TrackViewModel tests', () => {
     }, 100);
   });
 
+  it('should raise error on non-authorized user', (done) => {
+    // given
+    const imported = [
+      TrackFactory.getTrack(0, { id: 3, name: 'track3', user: user }),
+      TrackFactory.getTrack(0, { id: 4, name: 'track4', user: user })
+    ];
+    const file = new File([ 'blob' ], '/path/filepath.gpx');
+    spyOn(uTrack, 'import').and.returnValue(Promise.resolve(imported));
+    spyOn(uPositionSet, 'fetch').and.returnValue(Promise.resolve(positions));
+    spyOn(uUtils, 'error');
+    const options = '<option selected value="1">track1</option><option value="2">track2</option>';
+    trackEl.insertAdjacentHTML('afterbegin', options);
+    const optLength = trackEl.options.length;
+    vm.model.trackList = tracks;
+    vm.model.currentTrackId = track1.listValue;
+    state.currentTrack = track1;
+    state.currentUser = user;
+    inputFileEl.onclick = () => {
+      const dt = new DataTransfer();
+      dt.items.add(file);
+      inputFileEl.files = dt.files;
+      inputFileEl.dispatchEvent(new Event('change'));
+    };
+    vm.init();
+    // when
+    importGpxEl.click();
+    // then
+    setTimeout(() => {
+      expect(uTrack.import).not.toHaveBeenCalled();
+      expect(state.currentTrack).toBe(track1);
+      expect(vm.model.currentTrackId).toBe(track1.listValue);
+      expect(uUtils.error).toHaveBeenCalledTimes(1);
+      expect(lang._).toHaveBeenCalledWith('notauthorized');
+      expect(trackEl.options.length).toBe(optLength);
+      expect(vm.model.trackList.length).toBe(optLength);
+      done();
+    }, 100);
+  });
+
   it('should restart running auto-reload on config interval change', (done) => {
     // given
     const newInterval = 99;