Require authentication for all REST services.

Looks like my REST API allowed unauthenticated access. Fixed by
requiring a valid User session.

The AuthRouter checks that the request comes with a User context. If
there's no user context, the request is rejected as forbidden.

There is an additional check for the systemconfig calls that require the
user to have the System Administrator system role.