RestUser added, behavior of RestApi changed, ACL for RestApi added