@simong I think this still needs some acknowledgement. It's not clear why we're using `request` for the `/api/auth/cas/callback` request as opposed to the `RestUtil` that we have.