REST with authorization working