configure REST ACL