add AuthenticationFilter for REST access

This is where we should add roles/permissions check.