moved the rest client to a subclass that provides its own authentication