modify testapp_1.pl to run at /testapp1, behind a reverse-proxy
add a Cookie/REST auth backend that can authenticate with REST login services.  same-origin only.