This config works. the REST resource "/rest/persons/id" is only accessible with a token