allow rest:api from web ui