rest authentication (client hardcoded)