CAS auth for web services too