response rest works with new auth mechanism