Completing token based authentication to make REST really stateless