diff --git a/generic/templates/generic/cid_view.html b/generic/templates/generic/cid_view.html
index a5bb64f4..8da87b44 100644
--- a/generic/templates/generic/cid_view.html
+++ b/generic/templates/generic/cid_view.html
@@ -20,7 +20,7 @@
 
     <details>
         <summary><h3>Add/Edit CID users</h3></summary>
-        <button id="add-exams-selected-cids">Add exams to selected</button>
+        <button id="add-exams-selected-cids">Change selected exams</button>
         <button id="clear-exams-selected-cids">Clear selected exams</button>
         <button id="activate-selected-cids">Activate selected</button>
         <button id="deactivate-selected-cids">Deactivate selected</button>
diff --git a/physics/urls.py b/physics/urls.py
index 9786fafe..f29a4a01 100644
--- a/physics/urls.py
+++ b/physics/urls.py
@@ -20,7 +20,7 @@ urlpatterns = [
     path("exam/<int:pk>/", views.PhysicsExamViews.exam_overview, name="exam_overview"),
     path("exam/<int:pk>/scores", views.exam_scores_cid,
          name="exam_scores_cid"),
-    path("exam/<int:pk>/scores/<int:sk>/", views.exam_scores_cid_user,
+    path("exam/<int:pk>/scores/<int:sk>/<str:passcode>/", views.exam_scores_cid_user,
          name="exam_scores_cid_user"),
     path("exam/<int:pk>/toggle_active", views.PhysicsExamViews.exam_toggle_active, name="exam_toggle_active"),
     path("exam/<int:pk>/toggle_results_published", views.PhysicsExamViews.exam_toggle_results_published, name="exam_toggle_results_published"),
diff --git a/physics/views.py b/physics/views.py
index 29844a19..9da6a4e2 100644
--- a/physics/views.py
+++ b/physics/views.py
@@ -189,11 +189,12 @@ def exam_scores_cid(request, pk):
     )
 
 
-def exam_scores_cid_user(request, pk, sk):
+def exam_scores_cid_user(request, pk, sk, passcode=None):
     exam = get_object_or_404(Exam, pk=pk)
 
-    # TODO:Need some kind of test for cid
     cid = sk
+    if not exam.check_cid_user(cid, passcode):
+        raise Http404("Error accessing exam")
 
     questions = exam.exam_questions.all()
 
@@ -281,6 +282,9 @@ def exam_start(request, pk):
 def exam_finish(request, pk, cid, passcode=None):
     exam = get_object_or_404(Exam, pk=pk)
 
+    if not exam.check_cid_user(cid, passcode):
+        raise Http404("Error accessing exam")
+
     questions = exam.exam_questions.all()
 
     answers = CidUserAnswer.objects.filter(cid=cid, exam=exam)
@@ -311,7 +315,7 @@ def exam_finish(request, pk, cid, passcode=None):
             "question_answer_tuples": question_answer_tuples,
             "answer_count": answer_count,
             "exam_length": len(questions),
-            "passcode": passcode
+            "passcode": passcode,
         },
     )
 
@@ -347,11 +351,7 @@ def exam_take(request, pk, sk, cid, passcode=None):
             # answer.published_date = timezone.now()
             answer.save()
 
-        kwargs = {
-            "pk": pk,
-            "cid" : cid,
-            "passcode" : passcode
-        }
+        kwargs = {"pk": pk, "cid": cid, "passcode": passcode}
         take_url = "physics:exam_take"
         finish_url = "physics:exam_finish"
 
@@ -362,9 +362,7 @@ def exam_take(request, pk, sk, cid, passcode=None):
         elif "finish" in request.POST:
             return redirect(finish_url, **kwargs)
         elif "goto" in request.POST:
-            return redirect(
-                take_url, sk=int(request.POST.get("goto")), **kwargs 
-            )
+            return redirect(take_url, sk=int(request.POST.get("goto")), **kwargs)
     else:
         form = CidUserAnswerForm(instance=answer)
 
@@ -473,11 +471,13 @@ class ExamCreate(RevisionMixin, LoginRequiredMixin, CreateView):
 class ExamClone(AuthorOrCheckerRequiredMixin, ExamCloneMixin, ExamCreate):
     """Clone exam view"""
 
+
 class ExamDelete(RevisionMixin, AuthorOrCheckerRequiredMixin, DeleteView):
     model = Exam
     template_name = "exam_confirm_delete.html"
     success_url = reverse_lazy("physics:index")
 
+
 class ExamUpdate(
     RevisionMixin, LoginRequiredMixin, AuthorOrCheckerRequiredMixin, UpdateView
 ):
@@ -491,6 +491,7 @@ class ExamUpdate(
         form.instance.author.add(self.request.user.id)
         return super().form_valid(form)
 
+
 class QuestionView(
     LoginRequiredMixin, SingleTableMixin, FilterView, AuthorOrCheckerRequiredMixin
 ):