moved auth to after REST overview