now using saml bearer token auth between UI and API in jetty