basic rest api passing basic tests - further hardening