REST layer extracted, moved security to REST layer