rest client, authorization url