authentication and authorization for rest interface