skeleton for RESTful authentication