add AuthenticationFilter for REST access