part 2: REST controller shouldn't required authentication, but it should fall back to default public portal user if user isn't login (in Warden)