Handle authentication as a query arg for the REST api

Without this we can't authenticated REST clients differently
from regular clients