ref #0007 search auth issues and best REST auth practice