more work on authorization and fixing of REST interface