completing server rest security with shiro