make REST stuff be own middleware module; put it behind auth&auth like everything else