REST working without security