locked down access to rest api settings