Authentication policy for restful app